@signetai/connector-forge 0.236.1 → 0.237.0

package/dist/index.js

@@ -10408,99 +10408,6 @@ var execFileHiddenImpl = (...args) => Reflect.apply(nodeExecFile, undefined, wit
 Object.defineProperty(execFileHiddenImpl, promisify.custom, {
   value: (...args) => Reflect.apply(nodeExecFileAsync, undefined, withWindowsHideArgument(args, 1))
 });
-var MEMORY_CONTENT_SAFETY_POLICY_VERSION = "memory-content-safety-v1";
-var MEMORY_CONTENT_SAFETY_REASONS = [
-  "prompt_injection",
-  "exfiltration",
-  "credential_harvesting",
-  "malicious_shell",
-  "tool_directive",
-  "invisible_unicode"
-];
-var INVISIBLE_UNICODE_RE = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
-var STRONG_DEFENSIVE_CONTEXT_RE = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
-var REPORTING_CONTEXT_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
-var REPORTING_BEFORE_RE = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
-var REPORTING_AFTER_RE = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
-var NEGATED_DIRECTIVE_RE = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
-var PROMPT_INJECTION_RES = [
-  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
-  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
-  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
-  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
-  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
-];
-var TOOL_DIRECTIVE_RES = [
-  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
-  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
-  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
-];
-var EXFILTRATION_RE = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
-var EXFILTRATION_REVERSE = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
-var CREDENTIAL_HARVESTING_RE = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
-var DANGEROUS_SHELL_RE = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
-function matchHasDefensiveContext(content, match) {
-  if (!match || !match[0])
-    return false;
-  const start = match.index ?? 0;
-  const before = content.slice(Math.max(0, start - 120), start);
-  const after = content.slice(start + match[0].length, start + match[0].length + 160);
-  return STRONG_DEFENSIVE_CONTEXT_RE.test(match[0]) || NEGATED_DIRECTIVE_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(before) || STRONG_DEFENSIVE_CONTEXT_RE.test(after) || REPORTING_BEFORE_RE.test(before) || REPORTING_CONTEXT_RE.test(before) && REPORTING_AFTER_RE.test(after);
-}
-function hasActionableMatch(content, patterns) {
-  return patterns.some((pattern) => {
-    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
-    const searchable = new RegExp(pattern.source, flags);
-    let match;
-    while ((match = searchable.exec(content)) !== null) {
-      if (!matchHasDefensiveContext(content, match))
-        return true;
-      if (match[0].length === 0)
-        searchable.lastIndex += 1;
-    }
-    return false;
-  });
-}
-function hasDangerousShell(content) {
-  const searchable = new RegExp(DANGEROUS_SHELL_RE.source, `${DANGEROUS_SHELL_RE.flags}g`);
-  let match;
-  while ((match = searchable.exec(content)) !== null) {
-    if (matchHasDefensiveContext(content, match))
-      continue;
-    const end = (match.index ?? 0) + match[0].length;
-    const after = content.slice(end, end + 160);
-    if (!STRONG_DEFENSIVE_CONTEXT_RE.test(after) && !REPORTING_AFTER_RE.test(after))
-      return true;
-    if (match[0].length === 0)
-      searchable.lastIndex += 1;
-  }
-  return false;
-}
-function scanMemoryContent(content) {
-  const raw = typeof content === "string" ? content : String(content ?? "");
-  const normalized = raw.normalize("NFKC");
-  const reasons = new Set;
-  if (INVISIBLE_UNICODE_RE.test(raw))
-    reasons.add("invisible_unicode");
-  if (hasActionableMatch(normalized, PROMPT_INJECTION_RES))
-    reasons.add("prompt_injection");
-  if (hasActionableMatch(normalized, TOOL_DIRECTIVE_RES))
-    reasons.add("tool_directive");
-  if (hasActionableMatch(normalized, [EXFILTRATION_RE, EXFILTRATION_REVERSE]))
-    reasons.add("exfiltration");
-  if (hasActionableMatch(normalized, [CREDENTIAL_HARVESTING_RE]))
-    reasons.add("credential_harvesting");
-  if (hasDangerousShell(normalized))
-    reasons.add("malicious_shell");
-  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS.filter((reason) => reasons.has(reason));
-  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
-  return {
-    status,
-    contextEligible: status === "clean",
-    reasons: orderedReasons,
-    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION
-  };
-}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES = [
   "extract",
   "aggregate-recall",
@@ -10623,7 +10530,7 @@ function up4(db) {
 function up5(db) {
   db.exec("DROP TABLE IF EXISTS mcp_invocations");
 }
-var MEMORIES_FTS_TOKENIZER = "unicode61";
+var MEMORIES_FTS_TOKENIZER = "porter unicode61";
 var FTS_STATE_TABLE = "memories_fts_state";
 function normalizeSql(sql) {
   return sql.replace(/\s+/g, " ").trim().toLowerCase();
@@ -10733,10 +10640,7 @@ function readMemoriesFtsSql(db) {
 function memoriesFtsNeedsTokenizerRepair(sql) {
   if (sql === null)
     return false;
-  const normalized = normalizeSql(sql);
-  if (normalized.includes("porter unicode61"))
-    return true;
-  return !normalized.includes(`tokenize='${MEMORIES_FTS_TOKENIZER}'`);
+  return !normalizeSql(sql).includes(`tokenize='${MEMORIES_FTS_TOKENIZER}'`);
 }
 function up6(db) {
   db.exec(`
@@ -14649,38 +14553,6 @@ function up129(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
-function tableExists2(db, table) {
-  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
-}
-function hasColumn24(db, table, column) {
-  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
-}
-function backfill(db, rows, sourceKind, scannedAt) {
-  const statement = db.prepare(`INSERT INTO memory_content_safety
-		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
-		   status = excluded.status,
-		   context_eligible = excluded.context_eligible,
-		   reasons_json = excluded.reasons_json,
-		   policy_version = excluded.policy_version,
-		   scanned_at = excluded.scanned_at`);
-  for (const row of rows) {
-    const sourceId = row.source_id?.trim();
-    if (!sourceId)
-      continue;
-    const assessment = scanMemoryContent(row.content ?? "");
-    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION, scannedAt);
-  }
-}
-function backfillTable(db, params) {
-  if (!tableExists2(db, params.table) || !hasColumn24(db, params.table, params.sourceIdColumn) || !hasColumn24(db, params.table, params.contentColumn))
-    return;
-  const agentColumn = hasColumn24(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
-  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
-			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
-  backfill(db, rows, params.sourceKind, params.scannedAt);
-}
 function up130(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS memory_content_safety (
@@ -14700,43 +14572,6 @@ function up130(db) {
 		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
 			ON memory_content_safety(agent_id, source_kind, context_eligible);
 	`);
-  const scannedAt = new Date().toISOString();
-  backfillTable(db, {
-    table: "memories",
-    sourceKind: "memory",
-    sourceIdColumn: "id",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable(db, {
-    table: "memory_artifacts",
-    sourceKind: "artifact",
-    sourceIdColumn: "source_path",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable(db, {
-    table: "session_transcripts",
-    sourceKind: "transcript",
-    sourceIdColumn: "session_key",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable(db, {
-    table: "session_summaries",
-    sourceKind: "summary",
-    sourceIdColumn: "id",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable(db, {
-    table: "embeddings",
-    sourceKind: "source_chunk",
-    sourceIdColumn: "id",
-    contentColumn: "chunk_text",
-    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
-    scannedAt
-  });
 }
 function up131(db) {
   const table = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'dreaming_attention'").get();
@@ -14840,13 +14675,13 @@ function up133(db) {
 			  AND error IS NOT NULL;
 	`);
 }
-function tableExists3(db, table) {
+function tableExists2(db, table) {
   return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
 }
 function up134(db) {
-  if (!tableExists3(db, "memory_jobs"))
+  if (!tableExists2(db, "memory_jobs"))
     return;
-  if (!tableExists3(db, "job_cancellations")) {
+  if (!tableExists2(db, "job_cancellations")) {
     throw new Error("job_cancellations table missing; cannot retire structural jobs without an audit trail");
   }
   db.prepare(`
@@ -15075,12 +14910,12 @@ function up142(db) {
     if (!cols.has(name))
       db.exec(`ALTER TABLE dreaming_passes ADD COLUMN ${name} ${type}`);
 }
-function hasColumn25(db, table, column) {
+function hasColumn24(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((row) => row.name === column);
 }
 function addColumnIfMissing28(db, table, column, definition) {
-  if (!hasColumn25(db, table, column))
+  if (!hasColumn24(db, table, column))
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function up143(db) {
@@ -15952,6 +15787,138 @@ function up162(db) {
 		END;
 	`);
 }
+function up163(db) {
+  db.exec(`
+		DROP TRIGGER IF EXISTS memory_content_safety_head_freshness_ai;
+		DROP TRIGGER IF EXISTS memory_content_safety_head_freshness_au;
+		DROP INDEX IF EXISTS idx_memory_content_safety_status;
+		DROP INDEX IF EXISTS idx_memory_content_safety_eligibility;
+		DROP TABLE IF EXISTS memory_content_safety;
+	`);
+}
+var COLUMNS3 = ["occurred_start", "occurred_end", "valid_from", "valid_until", "time_precision"];
+function up164(db) {
+  const cols = db.prepare("PRAGMA table_info(entity_attributes)").all();
+  for (const column of COLUMNS3) {
+    if (!cols.some((col) => col.name === column)) {
+      db.exec(`ALTER TABLE entity_attributes ADD COLUMN ${column} TEXT`);
+    }
+  }
+}
+function up165(db) {
+  const passColumns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!passColumns.some((column) => column.name === "scope_key")) {
+    db.exec("ALTER TABLE dreaming_passes ADD COLUMN scope_key TEXT");
+  }
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS dreaming_history_nodes (
+			agent_id TEXT NOT NULL,
+			scope_key TEXT NOT NULL,
+			level INTEGER NOT NULL,
+			idx INTEGER NOT NULL,
+			pass_id TEXT,
+			text TEXT NOT NULL,
+			tokens_input INTEGER,
+			tokens_output INTEGER,
+			tokens_cache_read INTEGER,
+			created_at TEXT NOT NULL DEFAULT (datetime('now')),
+			PRIMARY KEY (agent_id, scope_key, level, idx)
+		);
+		CREATE UNIQUE INDEX IF NOT EXISTS idx_dreaming_history_nodes_pass
+			ON dreaming_history_nodes(pass_id) WHERE pass_id IS NOT NULL;
+	`);
+}
+function up166(db) {
+  const columns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!columns.some((column) => column.name === "tokens_peak_context")) {
+    db.exec("ALTER TABLE dreaming_passes ADD COLUMN tokens_peak_context INTEGER");
+  }
+}
+function up167(db) {
+  const sql = readMemoriesFtsSql(db);
+  if (sql !== null && !memoriesFtsNeedsTokenizerRepair(sql))
+    return;
+  recreateMemoriesFts(db);
+}
+function hasTable5(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn25(db, table, column) {
+  return db.prepare(`PRAGMA table_info(${table})`).all().some((row) => row.name === column);
+}
+function up168(db) {
+  if (!hasTable5(db, "entity_attributes") || !hasTable5(db, "entity_aspects") || !hasTable5(db, "entities") || !hasColumn25(db, "entity_attributes", "source_root") || !hasColumn25(db, "entities", "source_root")) {
+    return;
+  }
+  const now = new Date().toISOString();
+  db.exec(`
+		CREATE TEMP TABLE retired_source_paragraphs AS
+		SELECT attr.id, attr.memory_id, attr.agent_id, asp.entity_id
+		FROM entity_attributes attr
+		JOIN entity_aspects asp ON asp.id = attr.aspect_id
+		JOIN entities e ON e.id = asp.entity_id
+		WHERE e.entity_type IN ('source_document', 'source_document_reference')
+		  AND attr.source_root IS NOT NULL
+		  AND attr.source_root = e.source_root
+		  AND attr.source_id = e.source_id
+		  AND attr.source_root NOT IN ('dreaming', 'dreaming_attention')
+	`);
+  if (hasColumn25(db, "entity_attributes", "memory_id") && hasTable5(db, "memories")) {
+    if (hasTable5(db, "memory_history")) {
+      db.prepare(`INSERT INTO memory_history (id, memory_id, event, old_content, new_content, changed_by, reason, metadata, created_at)
+				 SELECT lower(hex(randomblob(16))), mem.id, 'deleted', mem.content, NULL, 'migration:168',
+				        'Source paragraph claims retired', '{"force":true}', ?
+				 FROM memories mem
+				 JOIN retired_source_paragraphs retired ON retired.memory_id = mem.id
+				 WHERE mem.is_deleted = 0`).run(now);
+    }
+    if (hasTable5(db, "derived_memory_sources") && hasColumn25(db, "memories", "stale_at")) {
+      db.prepare(`UPDATE memories
+				 SET stale_at = ?
+				 WHERE stale_at IS NULL
+				   AND is_deleted = 0
+				   AND id IN (
+				     SELECT dms.derived_memory_id
+				     FROM derived_memory_sources dms
+				     JOIN retired_source_paragraphs retired ON retired.agent_id = dms.agent_id
+				     WHERE (dms.source_kind = 'memory' AND dms.source_id = retired.memory_id)
+				        OR (dms.source_kind = 'ontology_claim' AND dms.source_id = retired.id)
+				   )`).run(now);
+    }
+    const forget = [
+      "is_deleted = 1",
+      ...["deleted_at", "updated_at"].filter((column) => hasColumn25(db, "memories", column)).map((column) => `${column} = $now`),
+      ...hasColumn25(db, "memories", "updated_by") ? ["updated_by = 'migration:168'"] : [],
+      ...hasColumn25(db, "memories", "version") ? ["version = version + 1"] : []
+    ];
+    db.prepare(`UPDATE memories
+			 SET ${forget.join(", ")}
+			 WHERE is_deleted = 0
+			   AND id IN (SELECT memory_id FROM retired_source_paragraphs WHERE memory_id IS NOT NULL)`).run({ $now: now });
+    if (hasTable5(db, "memory_entity_mentions")) {
+      db.exec(`
+				DELETE FROM memory_entity_mentions
+				WHERE memory_id IN (SELECT memory_id FROM retired_source_paragraphs WHERE memory_id IS NOT NULL)
+			`);
+    }
+  }
+  if (hasTable5(db, "ontology_contradictions")) {
+    db.prepare(`UPDATE ontology_contradictions
+			 SET status = 'resolved', resolved_at = ?, resolution_reason = 'source paragraph claims retired', updated_at = ?
+			 WHERE status = 'active'
+			   AND (left_attribute_id IN (SELECT id FROM retired_source_paragraphs)
+			     OR right_attribute_id IN (SELECT id FROM retired_source_paragraphs))`).run(now, now);
+  }
+  db.exec(`
+		DELETE FROM entity_attributes WHERE id IN (SELECT id FROM retired_source_paragraphs);
+		DELETE FROM entity_aspects
+		WHERE entity_id IN (
+		    SELECT id FROM entities WHERE entity_type IN ('source_document', 'source_document_reference')
+		  )
+		  AND NOT EXISTS (SELECT 1 FROM entity_attributes attr WHERE attr.aspect_id = entity_aspects.id);
+		DROP TABLE retired_source_paragraphs;
+	`);
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -16961,8 +16928,7 @@ var MIGRATIONS = [
   {
     version: 125,
     name: "memory-content-safety",
-    up: up130,
-    artifacts: { tables: ["memory_content_safety"] }
+    up: up130
   },
   {
     version: 126,
@@ -17264,6 +17230,48 @@ var MIGRATIONS = [
     name: "generic-entity-prune-scan-generation",
     up: up162,
     artifacts: { tables: ["generic_entity_prune_scan_state"] }
+  },
+  {
+    version: 163,
+    name: "retire-memory-content-safety",
+    up: up163
+  },
+  {
+    version: 164,
+    name: "claim-event-time",
+    up: up164,
+    artifacts: {
+      columns: ["occurred_start", "occurred_end", "valid_from", "valid_until", "time_precision"].map((column) => ({
+        table: "entity_attributes",
+        column
+      }))
+    }
+  },
+  {
+    version: 165,
+    name: "dreaming-history",
+    up: up165,
+    artifacts: {
+      tables: ["dreaming_history_nodes"],
+      indexes: ["idx_dreaming_history_nodes_pass"],
+      columns: [{ table: "dreaming_passes", column: "scope_key" }]
+    }
+  },
+  {
+    version: 166,
+    name: "dreaming-pass-peak-context",
+    up: up166,
+    artifacts: { columns: [{ table: "dreaming_passes", column: "tokens_peak_context" }] }
+  },
+  {
+    version: 167,
+    name: "memories-fts-porter",
+    up: up167
+  },
+  {
+    version: 168,
+    name: "retire-source-paragraph-claims",
+    up: up168
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -17505,6 +17513,37 @@ var PIPELINE_PROVIDER_CHOICES = [
 var SYNTHESIS_PROVIDER_CHOICES = PIPELINE_PROVIDER_CHOICES.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET = new Set(PIPELINE_PROVIDER_CHOICES);
 var SYNTHESIS_PROVIDER_SET = new Set(SYNTHESIS_PROVIDER_CHOICES);
+var SECRET_NAMES = "(?:access[_-]?token|api[_-]?key|apikey|auth[_-]?token|client[_-]?secret|passw(?:or)?d|refresh[_-]?token|private[_-]?key|secret(?:[_-]?key)?|token)";
+var SECRET_VALUE = `(?=[^\\s"',;&<>()\\[\\]{}$]*\\d)[^\\s"',;&<>()\\[\\]{}$]{8,}`;
+var PATTERNS = [
+  {
+    kind: "private_key",
+    pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g
+  },
+  {
+    kind: "provider_key",
+    pattern: /\b(?:(?:AKIA|ASIA)[0-9A-Z]{16}|github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}|xox[abprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{35}|glpat-[A-Za-z0-9_-]{20,}|npm_[A-Za-z0-9]{36})\b/g
+  },
+  {
+    kind: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+  },
+  {
+    kind: "bearer_token",
+    pattern: /\bBearer\s+([A-Za-z0-9._~+/-]{16,}=*)/g,
+    valueGroup: 1
+  },
+  {
+    kind: "secret_assignment",
+    pattern: new RegExp(`\\b${SECRET_NAMES}["']?\\s*[:=]\\s*["']?(${SECRET_VALUE})`, "gi"),
+    valueGroup: 1
+  },
+  {
+    kind: "secret_assignment",
+    pattern: new RegExp(`\\b[A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)\\s*=\\s*["']?(${SECRET_VALUE})`, "g"),
+    valueGroup: 1
+  }
+];
 var LOOPBACK_HOST = "127.0.0.1";
 function normalizeLoopbackHost(host) {
   const normalized = host.trim().toLowerCase().replace(/^\[|\]$/g, "");
@@ -28431,99 +28470,6 @@ var execFileHiddenImpl2 = (...args) => Reflect.apply(nodeExecFile2, undefined, w
 Object.defineProperty(execFileHiddenImpl2, promisify2.custom, {
   value: (...args) => Reflect.apply(nodeExecFileAsync2, undefined, withWindowsHideArgument2(args, 1))
 });
-var MEMORY_CONTENT_SAFETY_POLICY_VERSION2 = "memory-content-safety-v1";
-var MEMORY_CONTENT_SAFETY_REASONS2 = [
-  "prompt_injection",
-  "exfiltration",
-  "credential_harvesting",
-  "malicious_shell",
-  "tool_directive",
-  "invisible_unicode"
-];
-var INVISIBLE_UNICODE_RE2 = /(?:\u034f|[\u00ad\u061c\u070f\u180e\u200b\u200c\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\u206a-\u206f\ufeff]|[\u{e0000}-\u{e007f}])/u;
-var STRONG_DEFENSIVE_CONTEXT_RE2 = /\b(?:security\s+(?:guidance|discussion|analysis)|threat\s+model|defensive)\b/i;
-var REPORTING_CONTEXT_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b/i;
-var REPORTING_BEFORE_RE2 = /\b(?:example|illustrat\w*|sample|quote|quoted|detector|scanner|classif\w*)\b[\s\S]{0,80}\b(?:say\w*|read\w*|show\w*|flag\w*|detect\w*|describ\w*|demonstrat\w*|contain\w*|match\w*|pattern)\b/i;
-var REPORTING_AFTER_RE2 = /\b(?:detector|scanner|classif\w*|flag\w*|pattern|dangerous|unsafe|malicious|hostile|should|would|must|never|do not|don't|avoid|quoted)\b/i;
-var NEGATED_DIRECTIVE_RE2 = /\b(?:never|do not|don't|should not|must not|cannot|can't|avoid|prevent|detect|mitigat\w*)\b[\s\S]{0,80}$/i;
-var PROMPT_INJECTION_RES2 = [
-  /\b(?:ignore|disregard|override|forget|bypass)\b[\s\S]{0,100}\b(?:previous|prior|above|earlier|system|developer|assistant|safety|security)?\s*(?:instructions?|rules?|prompt|message)\b/i,
-  /\b(?:new|following|these)\s+(?:(?:system|developer|assistant|hidden)\s+)?instructions?\b/i,
-  /(?:^|\n)\s*(?:system|developer|instruction|prompt)\s*:/im,
-  /<\s*(?:system|developer|assistant|instruction|prompt)\b[^>]*>/i,
-  /\b(?:you are now|act as|roleplay as|pretend to be)\b[\s\S]{0,80}\b(?:system|admin|developer|unrestricted|jailbreak|different agent)\b/i
-];
-var TOOL_DIRECTIVE_RES2 = [
-  /<\s*(?:tool[_-]?call|function[_-]?call|invoke|tool)\b/i,
-  /\b(?:assistant|system)\s+to\s*=\s*[a-z0-9_.-]+/i,
-  /\b(?:call|invoke|use|run|execute)\s+(?:the\s+)?[a-z0-9_.-]+\s+tool\b/i
-];
-var EXFILTRATION_RE2 = /\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b[\s\S]{0,120}(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)/i;
-var EXFILTRATION_REVERSE2 = /(?:\b(?:system\s+prompt|hidden\s+instructions?|secret(?:s)?|credential(?:s)?|password(?:s)?|api\s*keys?|tokens?|private\s+keys?|environment\s+variables?)\b|\.env\b|~\/(?:\.ssh)\/\S+|\/etc\/(?:shadow|passwd)\b)[\s\S]{0,120}\b(?:reveal|show|print|send|upload|exfiltrat\w*|dump|forward|leak|transmit|export)\b/i;
-var CREDENTIAL_HARVESTING_RE2 = /\b(?:enter|paste|provide|share|send|give|submit|type|hand over)\b[\s\S]{0,80}\b(?:password|api\s*key|token|secret|credential|private\s+key)\b/i;
-var DANGEROUS_SHELL_RE2 = /\b(?:curl|wget)\b[^\n]{0,240}\|\s*(?:ba|z|fi)?sh\b|\brm\s+-rf\s+(?:\/|~|\.ssh)[^\n]{0,240}|\b(?:cat|head|tail)\s+~\/?\.ssh\/(?:id_[a-z]+|authorized_keys)\b|\b(?:printenv|env)\b[^\n]{0,120}\b(?:curl|wget|send|upload|post)\b/i;
-function matchHasDefensiveContext2(content, match) {
-  if (!match || !match[0])
-    return false;
-  const start = match.index ?? 0;
-  const before = content.slice(Math.max(0, start - 120), start);
-  const after = content.slice(start + match[0].length, start + match[0].length + 160);
-  return STRONG_DEFENSIVE_CONTEXT_RE2.test(match[0]) || NEGATED_DIRECTIVE_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(before) || STRONG_DEFENSIVE_CONTEXT_RE2.test(after) || REPORTING_BEFORE_RE2.test(before) || REPORTING_CONTEXT_RE2.test(before) && REPORTING_AFTER_RE2.test(after);
-}
-function hasActionableMatch2(content, patterns) {
-  return patterns.some((pattern) => {
-    const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
-    const searchable = new RegExp(pattern.source, flags);
-    let match;
-    while ((match = searchable.exec(content)) !== null) {
-      if (!matchHasDefensiveContext2(content, match))
-        return true;
-      if (match[0].length === 0)
-        searchable.lastIndex += 1;
-    }
-    return false;
-  });
-}
-function hasDangerousShell2(content) {
-  const searchable = new RegExp(DANGEROUS_SHELL_RE2.source, `${DANGEROUS_SHELL_RE2.flags}g`);
-  let match;
-  while ((match = searchable.exec(content)) !== null) {
-    if (matchHasDefensiveContext2(content, match))
-      continue;
-    const end = (match.index ?? 0) + match[0].length;
-    const after = content.slice(end, end + 160);
-    if (!STRONG_DEFENSIVE_CONTEXT_RE2.test(after) && !REPORTING_AFTER_RE2.test(after))
-      return true;
-    if (match[0].length === 0)
-      searchable.lastIndex += 1;
-  }
-  return false;
-}
-function scanMemoryContent2(content) {
-  const raw = typeof content === "string" ? content : String(content ?? "");
-  const normalized = raw.normalize("NFKC");
-  const reasons = new Set;
-  if (INVISIBLE_UNICODE_RE2.test(raw))
-    reasons.add("invisible_unicode");
-  if (hasActionableMatch2(normalized, PROMPT_INJECTION_RES2))
-    reasons.add("prompt_injection");
-  if (hasActionableMatch2(normalized, TOOL_DIRECTIVE_RES2))
-    reasons.add("tool_directive");
-  if (hasActionableMatch2(normalized, [EXFILTRATION_RE2, EXFILTRATION_REVERSE2]))
-    reasons.add("exfiltration");
-  if (hasActionableMatch2(normalized, [CREDENTIAL_HARVESTING_RE2]))
-    reasons.add("credential_harvesting");
-  if (hasDangerousShell2(normalized))
-    reasons.add("malicious_shell");
-  const orderedReasons = MEMORY_CONTENT_SAFETY_REASONS2.filter((reason) => reasons.has(reason));
-  const status = orderedReasons.length === 0 ? "clean" : orderedReasons.every((reason) => reason === "invisible_unicode") ? "tainted" : "blocked";
-  return {
-    status,
-    contextEligible: status === "clean",
-    reasons: orderedReasons,
-    policyVersion: MEMORY_CONTENT_SAFETY_POLICY_VERSION2
-  };
-}
 var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = [
   "extract",
   "aggregate-recall",
@@ -28531,7 +28477,7 @@ var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = [
   "checkpoint",
   "dreaming"
 ];
-function up163(db) {
+function up169(db) {
   const hasColumn = (table, column) => {
     const statement = db.prepare(`SELECT 1 FROM pragma_table_info('${table}') WHERE name = ?`);
     try {
@@ -28646,7 +28592,7 @@ function up410(db) {
 function up510(db) {
   db.exec("DROP TABLE IF EXISTS mcp_invocations");
 }
-var MEMORIES_FTS_TOKENIZER2 = "unicode61";
+var MEMORIES_FTS_TOKENIZER2 = "porter unicode61";
 var FTS_STATE_TABLE2 = "memories_fts_state";
 function normalizeSql2(sql) {
   return sql.replace(/\s+/g, " ").trim().toLowerCase();
@@ -28756,10 +28702,7 @@ function readMemoriesFtsSql2(db) {
 function memoriesFtsNeedsTokenizerRepair2(sql) {
   if (sql === null)
     return false;
-  const normalized = normalizeSql2(sql);
-  if (normalized.includes("porter unicode61"))
-    return true;
-  return !normalized.includes(`tokenize='${MEMORIES_FTS_TOKENIZER2}'`);
+  return !normalizeSql2(sql).includes(`tokenize='${MEMORIES_FTS_TOKENIZER2}'`);
 }
 function up610(db) {
   db.exec(`
@@ -29184,7 +29127,7 @@ function up1510(db) {
 		)
 	`);
 }
-function up164(db) {
+function up1610(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS session_scores (
 			id TEXT PRIMARY KEY,
@@ -30405,7 +30348,7 @@ function up542(db) {
 		);
 	`);
 }
-function hasTable5(db, name) {
+function hasTable6(db, name) {
   return db.prepare(`SELECT name
 			 FROM sqlite_master
 			 WHERE type = 'table' AND name = ?
@@ -30435,7 +30378,7 @@ function up552(db) {
 		CREATE INDEX IF NOT EXISTS idx_entity_dependency_history_created
 			ON entity_dependency_history(created_at DESC);
 	`);
-  if (!hasTable5(db, "entity_dependencies"))
+  if (!hasTable6(db, "entity_dependencies"))
     return;
   db.exec("DROP TRIGGER IF EXISTS trg_entity_dependencies_related_to_reason_insert");
   db.exec("DROP TRIGGER IF EXISTS trg_entity_dependencies_related_to_reason_update");
@@ -31414,9 +31357,9 @@ function hasColumn112(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((row) => row.name === column);
 }
-var COLUMNS3 = ["harness", "session_id", "tool_use_id", "cwd", "origin", "args"];
+var COLUMNS4 = ["harness", "session_id", "tool_use_id", "cwd", "origin", "args"];
 function up872(db) {
-  for (const column of COLUMNS3) {
+  for (const column of COLUMNS4) {
     if (!hasColumn112(db, "skill_invocations", column)) {
       db.exec(`ALTER TABLE skill_invocations ADD COLUMN ${column} TEXT`);
     }
@@ -31980,7 +31923,7 @@ function up1082(db) {
 		  )
 	`);
 }
-function tableExists4(db, table) {
+function tableExists3(db, table) {
   return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined;
 }
 function hasColumn162(db, table, column) {
@@ -32002,7 +31945,7 @@ function up1092(db) {
 		CREATE INDEX IF NOT EXISTS idx_derived_memory_sources_source
 			ON derived_memory_sources(agent_id, source_kind, source_id);
 	`);
-  if (tableExists4(db, "aggregate_evidence_sources")) {
+  if (tableExists3(db, "aggregate_evidence_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -32010,7 +31953,7 @@ function up1092(db) {
 			FROM aggregate_evidence_sources
 		`);
   }
-  if (tableExists4(db, "aggregate_memory_sources")) {
+  if (tableExists3(db, "aggregate_memory_sources")) {
     db.exec(`
 			INSERT OR IGNORE INTO derived_memory_sources
 			 (derived_memory_id, source_kind, source_id, source_path, agent_id, created_at)
@@ -32018,10 +31961,10 @@ function up1092(db) {
 			FROM aggregate_memory_sources
 		`);
   }
-  if (tableExists4(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
+  if (tableExists3(db, "memories") && !hasColumn162(db, "memories", "stale_at")) {
     db.exec("ALTER TABLE memories ADD COLUMN stale_at TEXT");
   }
-  if (tableExists4(db, "memories")) {
+  if (tableExists3(db, "memories")) {
     db.exec(`
 			CREATE INDEX IF NOT EXISTS idx_memories_stale_derived
 			ON memories(agent_id, stale_at)
@@ -32672,38 +32615,6 @@ function up1292(db) {
 			ON imported_source_lifecycle(agent_id, status, updated_at DESC);
 	`);
 }
-function tableExists22(db, table) {
-  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
-}
-function hasColumn242(db, table, column) {
-  return db.prepare(`PRAGMA table_info("${table}")`).all().some((row) => row.name === column);
-}
-function backfill2(db, rows, sourceKind, scannedAt) {
-  const statement = db.prepare(`INSERT INTO memory_content_safety
-		 (agent_id, source_kind, source_id, status, context_eligible, reasons_json, policy_version, scanned_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-		 ON CONFLICT(agent_id, source_kind, source_id) DO UPDATE SET
-		   status = excluded.status,
-		   context_eligible = excluded.context_eligible,
-		   reasons_json = excluded.reasons_json,
-		   policy_version = excluded.policy_version,
-		   scanned_at = excluded.scanned_at`);
-  for (const row of rows) {
-    const sourceId = row.source_id?.trim();
-    if (!sourceId)
-      continue;
-    const assessment = scanMemoryContent2(row.content ?? "");
-    statement.run(row.agent_id?.trim() || "default", sourceKind, sourceId, assessment.status, assessment.contextEligible ? 1 : 0, JSON.stringify(assessment.reasons), MEMORY_CONTENT_SAFETY_POLICY_VERSION2, scannedAt);
-  }
-}
-function backfillTable2(db, params) {
-  if (!tableExists22(db, params.table) || !hasColumn242(db, params.table, params.sourceIdColumn) || !hasColumn242(db, params.table, params.contentColumn))
-    return;
-  const agentColumn = hasColumn242(db, params.table, "agent_id") ? "COALESCE(NULLIF(TRIM(agent_id), ''), 'default')" : "'default'";
-  const rows = db.prepare(`SELECT ${agentColumn} AS agent_id, ${params.sourceIdColumn} AS source_id, ${params.contentColumn} AS content
-			 FROM ${params.table}${params.where ? ` WHERE ${params.where}` : ""}`).all();
-  backfill2(db, rows, params.sourceKind, params.scannedAt);
-}
 function up1302(db) {
   db.exec(`
 		CREATE TABLE IF NOT EXISTS memory_content_safety (
@@ -32723,43 +32634,6 @@ function up1302(db) {
 		CREATE INDEX IF NOT EXISTS idx_memory_content_safety_eligibility
 			ON memory_content_safety(agent_id, source_kind, context_eligible);
 	`);
-  const scannedAt = new Date().toISOString();
-  backfillTable2(db, {
-    table: "memories",
-    sourceKind: "memory",
-    sourceIdColumn: "id",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable2(db, {
-    table: "memory_artifacts",
-    sourceKind: "artifact",
-    sourceIdColumn: "source_path",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable2(db, {
-    table: "session_transcripts",
-    sourceKind: "transcript",
-    sourceIdColumn: "session_key",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable2(db, {
-    table: "session_summaries",
-    sourceKind: "summary",
-    sourceIdColumn: "id",
-    contentColumn: "content",
-    scannedAt
-  });
-  backfillTable2(db, {
-    table: "embeddings",
-    sourceKind: "source_chunk",
-    sourceIdColumn: "id",
-    contentColumn: "chunk_text",
-    where: "source_type IN ('source_chunk', 'source_obsidian_chunk')",
-    scannedAt
-  });
 }
 function up1312(db) {
   const table = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'dreaming_attention'").get();
@@ -32863,13 +32737,13 @@ function up1332(db) {
 			  AND error IS NOT NULL;
 	`);
 }
-function tableExists32(db, table) {
+function tableExists22(db, table) {
   return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
 }
 function up1342(db) {
-  if (!tableExists32(db, "memory_jobs"))
+  if (!tableExists22(db, "memory_jobs"))
     return;
-  if (!tableExists32(db, "job_cancellations")) {
+  if (!tableExists22(db, "job_cancellations")) {
     throw new Error("job_cancellations table missing; cannot retire structural jobs without an audit trail");
   }
   db.prepare(`
@@ -33098,12 +32972,12 @@ function up1422(db) {
     if (!cols.has(name))
       db.exec(`ALTER TABLE dreaming_passes ADD COLUMN ${name} ${type}`);
 }
-function hasColumn252(db, table, column) {
+function hasColumn242(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
   return rows.some((row) => row.name === column);
 }
 function addColumnIfMissing282(db, table, column, definition) {
-  if (!hasColumn252(db, table, column))
+  if (!hasColumn242(db, table, column))
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function up1432(db) {
@@ -33975,6 +33849,138 @@ function up1622(db) {
 		END;
 	`);
 }
+function up1632(db) {
+  db.exec(`
+		DROP TRIGGER IF EXISTS memory_content_safety_head_freshness_ai;
+		DROP TRIGGER IF EXISTS memory_content_safety_head_freshness_au;
+		DROP INDEX IF EXISTS idx_memory_content_safety_status;
+		DROP INDEX IF EXISTS idx_memory_content_safety_eligibility;
+		DROP TABLE IF EXISTS memory_content_safety;
+	`);
+}
+var COLUMNS32 = ["occurred_start", "occurred_end", "valid_from", "valid_until", "time_precision"];
+function up1642(db) {
+  const cols = db.prepare("PRAGMA table_info(entity_attributes)").all();
+  for (const column of COLUMNS32) {
+    if (!cols.some((col) => col.name === column)) {
+      db.exec(`ALTER TABLE entity_attributes ADD COLUMN ${column} TEXT`);
+    }
+  }
+}
+function up1652(db) {
+  const passColumns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!passColumns.some((column) => column.name === "scope_key")) {
+    db.exec("ALTER TABLE dreaming_passes ADD COLUMN scope_key TEXT");
+  }
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS dreaming_history_nodes (
+			agent_id TEXT NOT NULL,
+			scope_key TEXT NOT NULL,
+			level INTEGER NOT NULL,
+			idx INTEGER NOT NULL,
+			pass_id TEXT,
+			text TEXT NOT NULL,
+			tokens_input INTEGER,
+			tokens_output INTEGER,
+			tokens_cache_read INTEGER,
+			created_at TEXT NOT NULL DEFAULT (datetime('now')),
+			PRIMARY KEY (agent_id, scope_key, level, idx)
+		);
+		CREATE UNIQUE INDEX IF NOT EXISTS idx_dreaming_history_nodes_pass
+			ON dreaming_history_nodes(pass_id) WHERE pass_id IS NOT NULL;
+	`);
+}
+function up1662(db) {
+  const columns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!columns.some((column) => column.name === "tokens_peak_context")) {
+    db.exec("ALTER TABLE dreaming_passes ADD COLUMN tokens_peak_context INTEGER");
+  }
+}
+function up1672(db) {
+  const sql = readMemoriesFtsSql2(db);
+  if (sql !== null && !memoriesFtsNeedsTokenizerRepair2(sql))
+    return;
+  recreateMemoriesFts2(db);
+}
+function hasTable52(db, table) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
+}
+function hasColumn252(db, table, column) {
+  return db.prepare(`PRAGMA table_info(${table})`).all().some((row) => row.name === column);
+}
+function up1682(db) {
+  if (!hasTable52(db, "entity_attributes") || !hasTable52(db, "entity_aspects") || !hasTable52(db, "entities") || !hasColumn252(db, "entity_attributes", "source_root") || !hasColumn252(db, "entities", "source_root")) {
+    return;
+  }
+  const now = new Date().toISOString();
+  db.exec(`
+		CREATE TEMP TABLE retired_source_paragraphs AS
+		SELECT attr.id, attr.memory_id, attr.agent_id, asp.entity_id
+		FROM entity_attributes attr
+		JOIN entity_aspects asp ON asp.id = attr.aspect_id
+		JOIN entities e ON e.id = asp.entity_id
+		WHERE e.entity_type IN ('source_document', 'source_document_reference')
+		  AND attr.source_root IS NOT NULL
+		  AND attr.source_root = e.source_root
+		  AND attr.source_id = e.source_id
+		  AND attr.source_root NOT IN ('dreaming', 'dreaming_attention')
+	`);
+  if (hasColumn252(db, "entity_attributes", "memory_id") && hasTable52(db, "memories")) {
+    if (hasTable52(db, "memory_history")) {
+      db.prepare(`INSERT INTO memory_history (id, memory_id, event, old_content, new_content, changed_by, reason, metadata, created_at)
+				 SELECT lower(hex(randomblob(16))), mem.id, 'deleted', mem.content, NULL, 'migration:168',
+				        'Source paragraph claims retired', '{"force":true}', ?
+				 FROM memories mem
+				 JOIN retired_source_paragraphs retired ON retired.memory_id = mem.id
+				 WHERE mem.is_deleted = 0`).run(now);
+    }
+    if (hasTable52(db, "derived_memory_sources") && hasColumn252(db, "memories", "stale_at")) {
+      db.prepare(`UPDATE memories
+				 SET stale_at = ?
+				 WHERE stale_at IS NULL
+				   AND is_deleted = 0
+				   AND id IN (
+				     SELECT dms.derived_memory_id
+				     FROM derived_memory_sources dms
+				     JOIN retired_source_paragraphs retired ON retired.agent_id = dms.agent_id
+				     WHERE (dms.source_kind = 'memory' AND dms.source_id = retired.memory_id)
+				        OR (dms.source_kind = 'ontology_claim' AND dms.source_id = retired.id)
+				   )`).run(now);
+    }
+    const forget = [
+      "is_deleted = 1",
+      ...["deleted_at", "updated_at"].filter((column) => hasColumn252(db, "memories", column)).map((column) => `${column} = $now`),
+      ...hasColumn252(db, "memories", "updated_by") ? ["updated_by = 'migration:168'"] : [],
+      ...hasColumn252(db, "memories", "version") ? ["version = version + 1"] : []
+    ];
+    db.prepare(`UPDATE memories
+			 SET ${forget.join(", ")}
+			 WHERE is_deleted = 0
+			   AND id IN (SELECT memory_id FROM retired_source_paragraphs WHERE memory_id IS NOT NULL)`).run({ $now: now });
+    if (hasTable52(db, "memory_entity_mentions")) {
+      db.exec(`
+				DELETE FROM memory_entity_mentions
+				WHERE memory_id IN (SELECT memory_id FROM retired_source_paragraphs WHERE memory_id IS NOT NULL)
+			`);
+    }
+  }
+  if (hasTable52(db, "ontology_contradictions")) {
+    db.prepare(`UPDATE ontology_contradictions
+			 SET status = 'resolved', resolved_at = ?, resolution_reason = 'source paragraph claims retired', updated_at = ?
+			 WHERE status = 'active'
+			   AND (left_attribute_id IN (SELECT id FROM retired_source_paragraphs)
+			     OR right_attribute_id IN (SELECT id FROM retired_source_paragraphs))`).run(now, now);
+  }
+  db.exec(`
+		DELETE FROM entity_attributes WHERE id IN (SELECT id FROM retired_source_paragraphs);
+		DELETE FROM entity_aspects
+		WHERE entity_id IN (
+		    SELECT id FROM entities WHERE entity_type IN ('source_document', 'source_document_reference')
+		  )
+		  AND NOT EXISTS (SELECT 1 FROM entity_attributes attr WHERE attr.aspect_id = entity_aspects.id);
+		DROP TABLE retired_source_paragraphs;
+	`);
+}
 var MIGRATIONS2 = [
   {
     version: 1,
@@ -34045,7 +34051,7 @@ var MIGRATIONS2 = [
   {
     version: 11,
     name: "session-scores",
-    up: up164,
+    up: up1610,
     artifacts: { tables: ["session_scores"] }
   },
   {
@@ -34984,8 +34990,7 @@ var MIGRATIONS2 = [
   {
     version: 125,
     name: "memory-content-safety",
-    up: up1302,
-    artifacts: { tables: ["memory_content_safety"] }
+    up: up1302
   },
   {
     version: 126,
@@ -35179,7 +35184,7 @@ var MIGRATIONS2 = [
   {
     version: 151,
     name: "transcript-import-bytes",
-    up: up163,
+    up: up169,
     artifacts: {
       tables: [
         "source_import_chunks",
@@ -35287,6 +35292,48 @@ var MIGRATIONS2 = [
     name: "generic-entity-prune-scan-generation",
     up: up1622,
     artifacts: { tables: ["generic_entity_prune_scan_state"] }
+  },
+  {
+    version: 163,
+    name: "retire-memory-content-safety",
+    up: up1632
+  },
+  {
+    version: 164,
+    name: "claim-event-time",
+    up: up1642,
+    artifacts: {
+      columns: ["occurred_start", "occurred_end", "valid_from", "valid_until", "time_precision"].map((column) => ({
+        table: "entity_attributes",
+        column
+      }))
+    }
+  },
+  {
+    version: 165,
+    name: "dreaming-history",
+    up: up1652,
+    artifacts: {
+      tables: ["dreaming_history_nodes"],
+      indexes: ["idx_dreaming_history_nodes_pass"],
+      columns: [{ table: "dreaming_passes", column: "scope_key" }]
+    }
+  },
+  {
+    version: 166,
+    name: "dreaming-pass-peak-context",
+    up: up1662,
+    artifacts: { columns: [{ table: "dreaming_passes", column: "tokens_peak_context" }] }
+  },
+  {
+    version: 167,
+    name: "memories-fts-porter",
+    up: up1672
+  },
+  {
+    version: 168,
+    name: "retire-source-paragraph-claims",
+    up: up1682
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;
@@ -35528,6 +35575,37 @@ var PIPELINE_PROVIDER_CHOICES2 = [
 var SYNTHESIS_PROVIDER_CHOICES2 = PIPELINE_PROVIDER_CHOICES2.filter((provider) => provider !== "command");
 var PIPELINE_PROVIDER_SET2 = new Set(PIPELINE_PROVIDER_CHOICES2);
 var SYNTHESIS_PROVIDER_SET2 = new Set(SYNTHESIS_PROVIDER_CHOICES2);
+var SECRET_NAMES2 = "(?:access[_-]?token|api[_-]?key|apikey|auth[_-]?token|client[_-]?secret|passw(?:or)?d|refresh[_-]?token|private[_-]?key|secret(?:[_-]?key)?|token)";
+var SECRET_VALUE2 = `(?=[^\\s"',;&<>()\\[\\]{}$]*\\d)[^\\s"',;&<>()\\[\\]{}$]{8,}`;
+var PATTERNS2 = [
+  {
+    kind: "private_key",
+    pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )*PRIVATE KEY-----/g
+  },
+  {
+    kind: "provider_key",
+    pattern: /\b(?:(?:AKIA|ASIA)[0-9A-Z]{16}|github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}|xox[abprs]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{35}|glpat-[A-Za-z0-9_-]{20,}|npm_[A-Za-z0-9]{36})\b/g
+  },
+  {
+    kind: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+  },
+  {
+    kind: "bearer_token",
+    pattern: /\bBearer\s+([A-Za-z0-9._~+/-]{16,}=*)/g,
+    valueGroup: 1
+  },
+  {
+    kind: "secret_assignment",
+    pattern: new RegExp(`\\b${SECRET_NAMES2}["']?\\s*[:=]\\s*["']?(${SECRET_VALUE2})`, "gi"),
+    valueGroup: 1
+  },
+  {
+    kind: "secret_assignment",
+    pattern: new RegExp(`\\b[A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD)\\s*=\\s*["']?(${SECRET_VALUE2})`, "g"),
+    valueGroup: 1
+  }
+];
 var LOOPBACK_HOST2 = "127.0.0.1";
 var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
 function parseSimpleYaml(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-forge",
-  "version": "0.236.1",
+  "version": "0.237.0",
   "description": "Signet connector for ForgeCode - installs MCP, identity, and skills integration",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,8 +24,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.236.1",
-    "@signetai/core": "0.236.1"
+    "@signetai/connector-base": "0.237.0",
+    "@signetai/core": "0.237.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",