@signetai/connector-claude-code 0.227.1 → 0.228.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // ../../../platform/core/dist/index.js
 import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   execFile as nodeExecFile,
@@ -12,12 +12,13 @@ import {
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
 import { homedir as homedir2 } from "node:os";
-import { join as join2, resolve } from "node:path";
+import { join as join2, resolve as resolve2 } from "node:path";
+import { constants as fsConstants } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname5, join as join9, resolve as resolve3 } from "node:path";
+import { dirname as dirname6, join as join14, resolve as resolve8 } from "node:path";
 import { homedir as homedir6, platform as platform2 } from "node:os";
-import { basename, dirname as dirname6, resolve as resolve5 } from "node:path";
+import { basename, dirname as dirname7, resolve as resolve9 } from "node:path";
 import { homedir as homedir8 } from "node:os";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -15899,6 +15900,102 @@ function up159(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns(db, table, definitions) {
+  const present = columns(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns.join(",")})
+			SELECT ${ledgerColumns.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up160(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -17187,6 +17284,18 @@ var MIGRATIONS = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up5
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up160,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -17201,30 +17310,17 @@ function expandHome(p2, home = homedir2()) {
     return join2(home, p2.slice(2));
   return p2;
 }
-var STATES = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation = Promise.resolve();
-var LOOPBACK_HOST = "127.0.0.1";
-var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml2 = __toESM(require_dist(), 1);
-var native = null;
-try {
-  const esmRequire = createRequire2(import.meta.url);
-  native = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR = join9(homedir5(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}`,
@@ -17263,7 +17359,13 @@ var SIGNET_GIT_TRACKED_PATHS = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}/`,
   "memory/memories.db*",
@@ -17283,17 +17385,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | (fsConstants.O_NOFOLLOW ?? 0);
+var FILE_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+var NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER = new Map(PROTECTION_COMPONENT_IDS.map((id, index) => [id, index]));
+var BLOCKING = new Set(["missing", "stale", "degraded"]);
+var STATES = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation = Promise.resolve();
+var LOOPBACK_HOST = "127.0.0.1";
+var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml2 = __toESM(require_dist(), 1);
+var native = null;
+try {
+  const esmRequire = createRequire2(import.meta.url);
+  native = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR = join14(homedir5(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH = defaultDiscordDesktopCachePath();
 var DEFAULT_GITHUB_RESOURCE_TYPES = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES = new Set(DEFAULT_GITHUB_RESOURCE_TYPES);
 function defaultDiscordDesktopCachePath() {
   switch (platform2()) {
     case "darwin":
-      return resolve5(homedir6(), "Library", "Application Support", "discord");
+      return resolve9(homedir6(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve5(process.env.APPDATA || resolve5(homedir6(), "AppData", "Roaming"), "discord");
+      return resolve9(process.env.APPDATA || resolve9(homedir6(), "AppData", "Roaming"), "discord");
     default:
-      return resolve5(process.env.XDG_CONFIG_HOME || resolve5(homedir6(), ".config"), "discord");
+      return resolve9(process.env.XDG_CONFIG_HOME || resolve9(homedir6(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES = {
@@ -17383,7 +17521,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join3, relative, sep } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import {
   execFile as nodeExecFile2,
@@ -17394,14 +17532,15 @@ import {
 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { createHash as createHash2 } from "node:crypto";
+import { constants as fsConstants2 } from "node:fs";
 import { createRequire as createRequire22 } from "node:module";
 import { homedir as homedir52 } from "node:os";
-import { dirname as dirname52, join as join92, resolve as resolve32 } from "node:path";
+import { dirname as dirname62, join as join142, resolve as resolve82 } from "node:path";
 import { homedir as homedir62, platform as platform22 } from "node:os";
-import { basename as basename2, dirname as dirname62, resolve as resolve52 } from "node:path";
+import { basename as basename2, dirname as dirname72, resolve as resolve92 } from "node:path";
 import { homedir as homedir82 } from "node:os";
-import { existsSync as existsSync14, lstatSync, mkdirSync as mkdirSync8, readdirSync as readdirSync6, symlinkSync, unlinkSync as unlinkSync2 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync3, mkdirSync as mkdirSync10, readdirSync as readdirSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join18 } from "node:path";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
 var __defProp2 = Object.defineProperty;
@@ -27967,7 +28106,7 @@ var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = [
   "checkpoint",
   "dreaming"
 ];
-function up160(db) {
+function up161(db) {
   const hasColumn26 = (table, column) => {
     const statement = db.prepare(`SELECT 1 FROM pragma_table_info('${table}') WHERE name = ?`);
     try {
@@ -28034,8 +28173,8 @@ function up210(db) {
 	`);
 }
 function addColumnIfMissing30(db, column, definition) {
-  const columns = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE transcript_capture_jobs ADD COLUMN ${column} ${definition}`);
 }
@@ -28916,8 +29055,8 @@ function up252(db) {
   addColumnIfMissing82(db, "session_memories", "structural_density", "INTEGER");
 }
 function up262(db) {
-  const columns = db.prepare("PRAGMA table_info(session_checkpoints)").all();
-  const columnNames = new Set(columns.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
+  const columns2 = db.prepare("PRAGMA table_info(session_checkpoints)").all();
+  const columnNames = new Set(columns2.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
   if (!columnNames.has("focal_entity_ids")) {
     db.exec("ALTER TABLE session_checkpoints ADD COLUMN focal_entity_ids TEXT");
   }
@@ -31229,8 +31368,8 @@ function up972(db) {
 	`);
 }
 function up982(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "evidence_cursor")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "evidence_cursor")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN evidence_cursor TEXT");
   }
 }
@@ -31274,8 +31413,8 @@ function up1012(db) {
   db.exec("DROP TABLE IF EXISTS ingestion_jobs");
 }
 function up1022(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "last_failure_at")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "last_failure_at")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN last_failure_at TEXT");
   }
   db.exec("UPDATE dreaming_state SET last_failure_at = updated_at WHERE consecutive_failures > 0 AND last_failure_at IS NULL");
@@ -31318,11 +31457,11 @@ function up1042(db) {
 	`);
 }
 function up1052(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
-  if (!columns.some((column) => column.name === "evidence_window_json")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!columns2.some((column) => column.name === "evidence_window_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN evidence_window_json TEXT");
   }
-  if (!columns.some((column) => column.name === "runbook_json")) {
+  if (!columns2.some((column) => column.name === "runbook_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN runbook_json TEXT");
   }
 }
@@ -31761,8 +31900,8 @@ function hasTable42(db, table) {
   return db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
 }
 function addColumnIfMissing262(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
@@ -31774,8 +31913,8 @@ function hashTranscript2(content) {
   return createHash2("sha256").update(content, "utf8").digest("hex");
 }
 function backfillTranscriptHashes2(db) {
-  const columns = tableColumns2(db, "session_transcripts");
-  if (!columns.has("content_hash") || !columns.has("content"))
+  const columns2 = tableColumns2(db, "session_transcripts");
+  if (!columns2.has("content_hash") || !columns2.has("content"))
     return;
   const rows = db.prepare("SELECT session_key, agent_id, content FROM session_transcripts WHERE content_hash IS NULL").all();
   const update = db.prepare("UPDATE session_transcripts SET content_hash = ? WHERE agent_id = ? AND session_key = ? AND content_hash IS NULL");
@@ -31801,8 +31940,8 @@ function laterTimestamp2(current, candidate) {
   }
   return candidate > current ? candidate : current;
 }
-function isCompletionBoundary2(job, columns) {
-  return columns.has("trigger") && job.trigger === "session_end" || columns.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
+function isCompletionBoundary2(job, columns2) {
+  return columns2.has("trigger") && job.trigger === "session_end" || columns2.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
 }
 function mergeTranscriptContent2(current, next) {
   if (current.length === 0)
@@ -32050,8 +32189,8 @@ function up1262(db) {
 	`);
 }
 function up1272(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
-  const names = new Set(columns.map((column) => column.name));
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
+  const names = new Set(columns2.map((column) => column.name));
   if (!names.has("failure_class")) {
     db.exec("ALTER TABLE dreaming_evidence_exclusions ADD COLUMN failure_class TEXT NOT NULL DEFAULT 'unknown' CHECK (failure_class IN ('incomplete_transcript', 'source_projection', 'scope_mismatch', 'quote_mismatch', 'unknown'))");
   }
@@ -32463,8 +32602,8 @@ function up1382(db) {
 		CREATE INDEX IF NOT EXISTS idx_memory_head_revision_entries_entry
 			ON memory_head_revision_entries(agent_id, entry_id, revision DESC);
 	`);
-  const columns = db.prepare("PRAGMA table_info(memory_md_heads)").all();
-  const names = new Set(columns.map((column) => String(column.name)));
+  const columns2 = db.prepare("PRAGMA table_info(memory_md_heads)").all();
+  const names = new Set(columns2.map((column) => String(column.name)));
   if (!names.has("revision_id"))
     db.exec("ALTER TABLE memory_md_heads ADD COLUMN revision_id TEXT");
   if (!names.has("pass_id"))
@@ -32890,13 +33029,13 @@ function up1462(db) {
 	`);
 }
 function up1472(db) {
-  const columns = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
-  if (!columns.some((column) => column.name === "frontier")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
+  if (!columns2.some((column) => column.name === "frontier")) {
     db.exec("ALTER TABLE source_sync_checkpoints ADD COLUMN frontier TEXT");
   }
 }
 function up1482(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
   const additions = [
     ["migration_phase", "TEXT"],
     ["progress_staged", "INTEGER NOT NULL DEFAULT 0"],
@@ -32907,7 +33046,7 @@ function up1482(db) {
     ["provider_endpoint", "TEXT"]
   ];
   for (const [name, definition] of additions) {
-    if (!columns.has(name))
+    if (!columns2.has(name))
       db.exec(`ALTER TABLE embedding_index_state ADD COLUMN ${name} ${definition}`);
   }
   db.exec(`
@@ -32931,8 +33070,8 @@ function up1482(db) {
   }
 }
 function up1492(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
-  if (!columns.has("lease_token")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  if (!columns2.has("lease_token")) {
     db.exec("ALTER TABLE memory_jobs ADD COLUMN lease_token TEXT");
   }
 }
@@ -33025,8 +33164,8 @@ function up1522(db) {
   db.exec("CREATE INDEX IF NOT EXISTS idx_source_import_files_job_state ON source_import_files(job_id, state)");
 }
 function up1532(db) {
-  const columns = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
-  if (!columns.some((column) => column.name === "source_id")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
+  if (!columns2.some((column) => column.name === "source_id")) {
     db.exec("ALTER TABLE source_import_record_attempts ADD COLUMN source_id TEXT");
   }
 }
@@ -33047,8 +33186,8 @@ function up1542(db) {
   addColumn("source_import_files", "error", "TEXT");
 }
 function addColumnIfMissing292(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (!columns2.some((row) => row.name === column))
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function up1552(db) {
@@ -33248,8 +33387,8 @@ function up1572(db) {
 	`);
 }
 function up1582(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
-  if (!columns.has("profile_fingerprint")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
+  if (!columns2.has("profile_fingerprint")) {
     db.exec("ALTER TABLE embedding_repair_checkpoints ADD COLUMN profile_fingerprint TEXT");
   }
   db.exec(`
@@ -33268,6 +33407,102 @@ function up1592(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns2 = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns2(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns2(db, table, definitions) {
+  const present = columns2(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey2(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns2.join(",")})
+			SELECT ${ledgerColumns2.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up1602(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns2(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns2(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey2(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS2 = [
   {
     version: 1,
@@ -34472,7 +34707,7 @@ var MIGRATIONS2 = [
   {
     version: 151,
     name: "transcript-import-bytes",
-    up: up160,
+    up: up161,
     artifacts: {
       tables: [
         "source_import_chunks",
@@ -34556,6 +34791,18 @@ var MIGRATIONS2 = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up510
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up1602,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;
@@ -34563,30 +34810,17 @@ var NETWORK_FILESYSTEM_TYPES2 = new Set(["afpfs", "nfs", "smbfs", "webdav"]);
 var __filename22 = fileURLToPath2(import.meta.url);
 var __dirname22 = dirname3(__filename22);
 var import_yaml3 = __toESM2(require_dist2(), 1);
-var STATES2 = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation2 = Promise.resolve();
-var LOOPBACK_HOST2 = "127.0.0.1";
-var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml22 = __toESM2(require_dist2(), 1);
-var native2 = null;
-try {
-  const esmRequire = createRequire22(import.meta.url);
-  native2 = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join92(homedir52(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME2 = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES2 = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS2 = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}`,
@@ -34625,7 +34859,13 @@ var SIGNET_GIT_TRACKED_PATHS2 = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}/`,
   "memory/memories.db*",
@@ -34645,17 +34885,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT2 = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_DIRECTORY ?? 0) | (fsConstants2.O_NOFOLLOW ?? 0);
+var FILE_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_NOFOLLOW ?? 0) | (fsConstants2.O_NONBLOCK ?? 0);
+var NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS2 = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER2 = new Map(PROTECTION_COMPONENT_IDS2.map((id, index) => [id, index]));
+var BLOCKING2 = new Set(["missing", "stale", "degraded"]);
+var STATES2 = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation2 = Promise.resolve();
+var LOOPBACK_HOST2 = "127.0.0.1";
+var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml22 = __toESM2(require_dist2(), 1);
+var native2 = null;
+try {
+  const esmRequire = createRequire22(import.meta.url);
+  native2 = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join142(homedir52(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH2 = defaultDiscordDesktopCachePath2();
 var DEFAULT_GITHUB_RESOURCE_TYPES2 = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES2 = new Set(DEFAULT_GITHUB_RESOURCE_TYPES2);
 function defaultDiscordDesktopCachePath2() {
   switch (platform22()) {
     case "darwin":
-      return resolve52(homedir62(), "Library", "Application Support", "discord");
+      return resolve92(homedir62(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve52(process.env.APPDATA || resolve52(homedir62(), "AppData", "Roaming"), "discord");
+      return resolve92(process.env.APPDATA || resolve92(homedir62(), "AppData", "Roaming"), "discord");
     default:
-      return resolve52(process.env.XDG_CONFIG_HOME || resolve52(homedir62(), ".config"), "discord");
+      return resolve92(process.env.XDG_CONFIG_HOME || resolve92(homedir62(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES2 = {
@@ -34715,7 +34991,7 @@ var REQUIRED_IDENTITY_KEYS2 = Object.entries(IDENTITY_FILES2).filter(([, spec])
 var OPTIONAL_IDENTITY_KEYS2 = Object.entries(IDENTITY_FILES2).filter(([, spec]) => spec.optional).map(([key]) => key);
 function linkDirSync(target, path) {
   const type = process.platform === "win32" ? "junction" : "dir";
-  symlinkSync(target, path, type);
+  symlinkSync2(target, path, type);
 }
 function symlinkSkills(sourceDir, targetDir, options = {}) {
   const result = {
@@ -34723,19 +34999,19 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     skipped: [],
     errors: []
   };
-  if (!existsSync14(sourceDir)) {
+  if (!existsSync18(sourceDir)) {
     return result;
   }
-  const targetParent = join14(targetDir, "..");
-  if (!existsSync14(targetParent)) {
-    mkdirSync8(targetParent, { recursive: true });
+  const targetParent = join18(targetDir, "..");
+  if (!existsSync18(targetParent)) {
+    mkdirSync10(targetParent, { recursive: true });
   }
-  if (!existsSync14(targetDir)) {
-    mkdirSync8(targetDir, { recursive: true });
+  if (!existsSync18(targetDir)) {
+    mkdirSync10(targetDir, { recursive: true });
   }
   let entries;
   try {
-    entries = readdirSync6(sourceDir);
+    entries = readdirSync9(sourceDir);
   } catch (e) {
     result.errors.push({
       path: sourceDir,
@@ -34744,10 +35020,10 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     return result;
   }
   for (const entry of entries) {
-    const srcPath = join14(sourceDir, entry);
-    const destPath = join14(targetDir, entry);
+    const srcPath = join18(sourceDir, entry);
+    const destPath = join18(targetDir, entry);
     try {
-      const src = lstatSync(srcPath);
+      const src = lstatSync3(srcPath);
       if (src.isSymbolicLink() || !src.isDirectory()) {
         result.skipped.push(srcPath);
         continue;
@@ -34760,7 +35036,7 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
       continue;
     }
     try {
-      const destStat = lstatSync(destPath);
+      const destStat = lstatSync3(destPath);
       if (destStat.isSymbolicLink()) {
         if (!options.dryRun) {
           unlinkSync2(destPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-claude-code",
-  "version": "0.227.1",
+  "version": "0.228.0",
   "description": "Signet connector for Claude Code (Anthropic CLI)",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,8 +24,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.227.1",
-    "@signetai/core": "0.227.1"
+    "@signetai/connector-base": "0.228.0",
+    "@signetai/core": "0.228.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",