@signetai/connector-hermes-agent 0.227.1 → 0.228.0

package/dist/index.js

@@ -1,6 +1,6 @@
 // ../../../platform/core/dist/index.js
 import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   execFile as nodeExecFile,
@@ -12,15 +12,16 @@ import {
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
 import { homedir as homedir2 } from "node:os";
-import { join as join2, resolve } from "node:path";
+import { join as join2, resolve as resolve2 } from "node:path";
+import { constants as fsConstants } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname5, join as join9, resolve as resolve3 } from "node:path";
+import { dirname as dirname6, join as join14, resolve as resolve8 } from "node:path";
 import { homedir as homedir6, platform as platform2 } from "node:os";
-import { basename, dirname as dirname6, resolve as resolve5 } from "node:path";
-import { existsSync as existsSync12, readFileSync as readFileSync9, realpathSync, statSync as statSync7 } from "node:fs";
+import { basename, dirname as dirname7, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync13, realpathSync, statSync as statSync8 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname7, join as join12 } from "node:path";
+import { dirname as dirname8, join as join16 } from "node:path";
 import { homedir as homedir8 } from "node:os";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -15903,6 +15904,102 @@ function up159(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns(db, table, definitions) {
+  const present = columns(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns.join(",")})
+			SELECT ${ledgerColumns.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up160(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -17191,6 +17288,18 @@ var MIGRATIONS = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up5
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up160,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -17205,30 +17314,17 @@ function expandHome(p2, home = homedir2()) {
     return join2(home, p2.slice(2));
   return p2;
 }
-var STATES = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation = Promise.resolve();
-var LOOPBACK_HOST = "127.0.0.1";
-var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml2 = __toESM(require_dist(), 1);
-var native = null;
-try {
-  const esmRequire = createRequire2(import.meta.url);
-  native = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR = join9(homedir5(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}`,
@@ -17267,7 +17363,13 @@ var SIGNET_GIT_TRACKED_PATHS = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}/`,
   "memory/memories.db*",
@@ -17287,17 +17389,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | (fsConstants.O_NOFOLLOW ?? 0);
+var FILE_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+var NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER = new Map(PROTECTION_COMPONENT_IDS.map((id, index) => [id, index]));
+var BLOCKING = new Set(["missing", "stale", "degraded"]);
+var STATES = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation = Promise.resolve();
+var LOOPBACK_HOST = "127.0.0.1";
+var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml2 = __toESM(require_dist(), 1);
+var native = null;
+try {
+  const esmRequire = createRequire2(import.meta.url);
+  native = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR = join14(homedir5(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH = defaultDiscordDesktopCachePath();
 var DEFAULT_GITHUB_RESOURCE_TYPES = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES = new Set(DEFAULT_GITHUB_RESOURCE_TYPES);
 function defaultDiscordDesktopCachePath() {
   switch (platform2()) {
     case "darwin":
-      return resolve5(homedir6(), "Library", "Application Support", "discord");
+      return resolve9(homedir6(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve5(process.env.APPDATA || resolve5(homedir6(), "AppData", "Roaming"), "discord");
+      return resolve9(process.env.APPDATA || resolve9(homedir6(), "AppData", "Roaming"), "discord");
     default:
-      return resolve5(process.env.XDG_CONFIG_HOME || resolve5(homedir6(), ".config"), "discord");
+      return resolve9(process.env.XDG_CONFIG_HOME || resolve9(homedir6(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES = {
@@ -17360,27 +17498,27 @@ function userHome() {
 }
 function resolveHermesHomePath() {
   const hermesHome = process.env.HERMES_HOME?.trim();
-  return hermesHome || join12(userHome(), ".hermes");
+  return hermesHome || join16(userHome(), ".hermes");
 }
 function hermesAgentCandidateDirs() {
   const home = userHome();
   const hermesHome = resolveHermesHomePath();
   return [
     hermesHome,
-    join12(hermesHome, "hermes-agent"),
-    join12(home, "hermes-agent"),
-    join12(home, ".local", "share", "hermes-agent"),
-    join12(home, "src", "hermes-agent"),
+    join16(hermesHome, "hermes-agent"),
+    join16(home, "hermes-agent"),
+    join16(home, ".local", "share", "hermes-agent"),
+    join16(home, "src", "hermes-agent"),
     "/opt/hermes-agent"
   ];
 }
 function resolveHermesRepoPath() {
   const hermesRepo = process.env.HERMES_REPO?.trim();
-  if (hermesRepo && existsSync12(join12(hermesRepo, "plugins", "memory"))) {
+  if (hermesRepo && existsSync16(join16(hermesRepo, "plugins", "memory"))) {
     return hermesRepo;
   }
   for (const base of hermesAgentCandidateDirs()) {
-    if (existsSync12(join12(base, "plugins", "memory")))
+    if (existsSync16(join16(base, "plugins", "memory")))
       return base;
   }
   try {
@@ -17390,8 +17528,8 @@ function resolveHermesRepoPath() {
       timeout: 3000
     }).trim();
     if (hermesPath) {
-      const repoDir = dirname7(realpathSync(hermesPath));
-      if (existsSync12(join12(repoDir, "plugins", "memory")))
+      const repoDir = dirname8(realpathSync(hermesPath));
+      if (existsSync16(join16(repoDir, "plugins", "memory")))
         return repoDir;
     }
   } catch {}
@@ -17407,7 +17545,7 @@ import {
   existsSync as existsSync2,
   fstatSync,
   ftruncateSync,
-  lstatSync as lstatSync2,
+  lstatSync,
   mkdirSync,
   openSync,
   readFileSync as readFileSync2,
@@ -17416,7 +17554,7 @@ import {
   writeSync
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute2, join as join6, relative as relative2, resolve as resolvePath, sep as sep2 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join6, relative as relative2, resolve as resolvePath, sep as sep2 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../../../libs/connector-base/dist/index.js
@@ -17424,7 +17562,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync, realpathSync as realpathSync2, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join3, relative, sep } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import {
   execFile as nodeExecFile2,
@@ -17435,14 +17573,15 @@ import {
 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 import { createHash as createHash2 } from "node:crypto";
+import { constants as fsConstants2 } from "node:fs";
 import { createRequire as createRequire22 } from "node:module";
 import { homedir as homedir52 } from "node:os";
-import { dirname as dirname52, join as join92, resolve as resolve32 } from "node:path";
+import { dirname as dirname62, join as join142, resolve as resolve82 } from "node:path";
 import { homedir as homedir62, platform as platform22 } from "node:os";
-import { basename as basename2, dirname as dirname62, resolve as resolve52 } from "node:path";
+import { basename as basename2, dirname as dirname72, resolve as resolve92 } from "node:path";
 import { homedir as homedir82 } from "node:os";
-import { existsSync as existsSync14, lstatSync, mkdirSync as mkdirSync8, readdirSync as readdirSync6, symlinkSync, unlinkSync as unlinkSync2 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync3, mkdirSync as mkdirSync10, readdirSync as readdirSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join18 } from "node:path";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
 var __defProp2 = Object.defineProperty;
@@ -28008,7 +28147,7 @@ var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = [
   "checkpoint",
   "dreaming"
 ];
-function up160(db) {
+function up161(db) {
   const hasColumn26 = (table, column) => {
     const statement = db.prepare(`SELECT 1 FROM pragma_table_info('${table}') WHERE name = ?`);
     try {
@@ -28075,8 +28214,8 @@ function up210(db) {
 	`);
 }
 function addColumnIfMissing30(db, column, definition) {
-  const columns = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE transcript_capture_jobs ADD COLUMN ${column} ${definition}`);
 }
@@ -28957,8 +29096,8 @@ function up252(db) {
   addColumnIfMissing82(db, "session_memories", "structural_density", "INTEGER");
 }
 function up262(db) {
-  const columns = db.prepare("PRAGMA table_info(session_checkpoints)").all();
-  const columnNames = new Set(columns.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
+  const columns2 = db.prepare("PRAGMA table_info(session_checkpoints)").all();
+  const columnNames = new Set(columns2.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
   if (!columnNames.has("focal_entity_ids")) {
     db.exec("ALTER TABLE session_checkpoints ADD COLUMN focal_entity_ids TEXT");
   }
@@ -31270,8 +31409,8 @@ function up972(db) {
 	`);
 }
 function up982(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "evidence_cursor")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "evidence_cursor")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN evidence_cursor TEXT");
   }
 }
@@ -31315,8 +31454,8 @@ function up1012(db) {
   db.exec("DROP TABLE IF EXISTS ingestion_jobs");
 }
 function up1022(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "last_failure_at")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "last_failure_at")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN last_failure_at TEXT");
   }
   db.exec("UPDATE dreaming_state SET last_failure_at = updated_at WHERE consecutive_failures > 0 AND last_failure_at IS NULL");
@@ -31359,11 +31498,11 @@ function up1042(db) {
 	`);
 }
 function up1052(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
-  if (!columns.some((column) => column.name === "evidence_window_json")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!columns2.some((column) => column.name === "evidence_window_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN evidence_window_json TEXT");
   }
-  if (!columns.some((column) => column.name === "runbook_json")) {
+  if (!columns2.some((column) => column.name === "runbook_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN runbook_json TEXT");
   }
 }
@@ -31802,8 +31941,8 @@ function hasTable42(db, table) {
   return db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
 }
 function addColumnIfMissing262(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
@@ -31815,8 +31954,8 @@ function hashTranscript2(content) {
   return createHash2("sha256").update(content, "utf8").digest("hex");
 }
 function backfillTranscriptHashes2(db) {
-  const columns = tableColumns2(db, "session_transcripts");
-  if (!columns.has("content_hash") || !columns.has("content"))
+  const columns2 = tableColumns2(db, "session_transcripts");
+  if (!columns2.has("content_hash") || !columns2.has("content"))
     return;
   const rows = db.prepare("SELECT session_key, agent_id, content FROM session_transcripts WHERE content_hash IS NULL").all();
   const update = db.prepare("UPDATE session_transcripts SET content_hash = ? WHERE agent_id = ? AND session_key = ? AND content_hash IS NULL");
@@ -31842,8 +31981,8 @@ function laterTimestamp2(current, candidate) {
   }
   return candidate > current ? candidate : current;
 }
-function isCompletionBoundary2(job, columns) {
-  return columns.has("trigger") && job.trigger === "session_end" || columns.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
+function isCompletionBoundary2(job, columns2) {
+  return columns2.has("trigger") && job.trigger === "session_end" || columns2.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
 }
 function mergeTranscriptContent2(current, next) {
   if (current.length === 0)
@@ -32091,8 +32230,8 @@ function up1262(db) {
 	`);
 }
 function up1272(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
-  const names = new Set(columns.map((column) => column.name));
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
+  const names = new Set(columns2.map((column) => column.name));
   if (!names.has("failure_class")) {
     db.exec("ALTER TABLE dreaming_evidence_exclusions ADD COLUMN failure_class TEXT NOT NULL DEFAULT 'unknown' CHECK (failure_class IN ('incomplete_transcript', 'source_projection', 'scope_mismatch', 'quote_mismatch', 'unknown'))");
   }
@@ -32504,8 +32643,8 @@ function up1382(db) {
 		CREATE INDEX IF NOT EXISTS idx_memory_head_revision_entries_entry
 			ON memory_head_revision_entries(agent_id, entry_id, revision DESC);
 	`);
-  const columns = db.prepare("PRAGMA table_info(memory_md_heads)").all();
-  const names = new Set(columns.map((column) => String(column.name)));
+  const columns2 = db.prepare("PRAGMA table_info(memory_md_heads)").all();
+  const names = new Set(columns2.map((column) => String(column.name)));
   if (!names.has("revision_id"))
     db.exec("ALTER TABLE memory_md_heads ADD COLUMN revision_id TEXT");
   if (!names.has("pass_id"))
@@ -32931,13 +33070,13 @@ function up1462(db) {
 	`);
 }
 function up1472(db) {
-  const columns = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
-  if (!columns.some((column) => column.name === "frontier")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
+  if (!columns2.some((column) => column.name === "frontier")) {
     db.exec("ALTER TABLE source_sync_checkpoints ADD COLUMN frontier TEXT");
   }
 }
 function up1482(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
   const additions = [
     ["migration_phase", "TEXT"],
     ["progress_staged", "INTEGER NOT NULL DEFAULT 0"],
@@ -32948,7 +33087,7 @@ function up1482(db) {
     ["provider_endpoint", "TEXT"]
   ];
   for (const [name, definition] of additions) {
-    if (!columns.has(name))
+    if (!columns2.has(name))
       db.exec(`ALTER TABLE embedding_index_state ADD COLUMN ${name} ${definition}`);
   }
   db.exec(`
@@ -32972,8 +33111,8 @@ function up1482(db) {
   }
 }
 function up1492(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
-  if (!columns.has("lease_token")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  if (!columns2.has("lease_token")) {
     db.exec("ALTER TABLE memory_jobs ADD COLUMN lease_token TEXT");
   }
 }
@@ -33066,8 +33205,8 @@ function up1522(db) {
   db.exec("CREATE INDEX IF NOT EXISTS idx_source_import_files_job_state ON source_import_files(job_id, state)");
 }
 function up1532(db) {
-  const columns = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
-  if (!columns.some((column) => column.name === "source_id")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
+  if (!columns2.some((column) => column.name === "source_id")) {
     db.exec("ALTER TABLE source_import_record_attempts ADD COLUMN source_id TEXT");
   }
 }
@@ -33088,8 +33227,8 @@ function up1542(db) {
   addColumn("source_import_files", "error", "TEXT");
 }
 function addColumnIfMissing292(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (!columns2.some((row) => row.name === column))
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function up1552(db) {
@@ -33289,8 +33428,8 @@ function up1572(db) {
 	`);
 }
 function up1582(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
-  if (!columns.has("profile_fingerprint")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
+  if (!columns2.has("profile_fingerprint")) {
     db.exec("ALTER TABLE embedding_repair_checkpoints ADD COLUMN profile_fingerprint TEXT");
   }
   db.exec(`
@@ -33309,6 +33448,102 @@ function up1592(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns2 = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns2(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns2(db, table, definitions) {
+  const present = columns2(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey2(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns2.join(",")})
+			SELECT ${ledgerColumns2.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up1602(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns2(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns2(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey2(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS2 = [
   {
     version: 1,
@@ -34513,7 +34748,7 @@ var MIGRATIONS2 = [
   {
     version: 151,
     name: "transcript-import-bytes",
-    up: up160,
+    up: up161,
     artifacts: {
       tables: [
         "source_import_chunks",
@@ -34597,6 +34832,18 @@ var MIGRATIONS2 = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up510
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up1602,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;
@@ -34604,30 +34851,17 @@ var NETWORK_FILESYSTEM_TYPES2 = new Set(["afpfs", "nfs", "smbfs", "webdav"]);
 var __filename22 = fileURLToPath2(import.meta.url);
 var __dirname22 = dirname3(__filename22);
 var import_yaml3 = __toESM2(require_dist2(), 1);
-var STATES2 = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation2 = Promise.resolve();
-var LOOPBACK_HOST2 = "127.0.0.1";
-var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml22 = __toESM2(require_dist2(), 1);
-var native2 = null;
-try {
-  const esmRequire = createRequire22(import.meta.url);
-  native2 = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join92(homedir52(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME2 = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES2 = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS2 = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}`,
@@ -34666,7 +34900,13 @@ var SIGNET_GIT_TRACKED_PATHS2 = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}/`,
   "memory/memories.db*",
@@ -34686,17 +34926,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT2 = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_DIRECTORY ?? 0) | (fsConstants2.O_NOFOLLOW ?? 0);
+var FILE_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_NOFOLLOW ?? 0) | (fsConstants2.O_NONBLOCK ?? 0);
+var NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS2 = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER2 = new Map(PROTECTION_COMPONENT_IDS2.map((id, index) => [id, index]));
+var BLOCKING2 = new Set(["missing", "stale", "degraded"]);
+var STATES2 = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation2 = Promise.resolve();
+var LOOPBACK_HOST2 = "127.0.0.1";
+var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml22 = __toESM2(require_dist2(), 1);
+var native2 = null;
+try {
+  const esmRequire = createRequire22(import.meta.url);
+  native2 = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join142(homedir52(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH2 = defaultDiscordDesktopCachePath2();
 var DEFAULT_GITHUB_RESOURCE_TYPES2 = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES2 = new Set(DEFAULT_GITHUB_RESOURCE_TYPES2);
 function defaultDiscordDesktopCachePath2() {
   switch (platform22()) {
     case "darwin":
-      return resolve52(homedir62(), "Library", "Application Support", "discord");
+      return resolve92(homedir62(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve52(process.env.APPDATA || resolve52(homedir62(), "AppData", "Roaming"), "discord");
+      return resolve92(process.env.APPDATA || resolve92(homedir62(), "AppData", "Roaming"), "discord");
     default:
-      return resolve52(process.env.XDG_CONFIG_HOME || resolve52(homedir62(), ".config"), "discord");
+      return resolve92(process.env.XDG_CONFIG_HOME || resolve92(homedir62(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES2 = {
@@ -34756,7 +35032,7 @@ var REQUIRED_IDENTITY_KEYS2 = Object.entries(IDENTITY_FILES2).filter(([, spec])
 var OPTIONAL_IDENTITY_KEYS2 = Object.entries(IDENTITY_FILES2).filter(([, spec]) => spec.optional).map(([key]) => key);
 function linkDirSync(target, path) {
   const type = process.platform === "win32" ? "junction" : "dir";
-  symlinkSync(target, path, type);
+  symlinkSync2(target, path, type);
 }
 function symlinkSkills(sourceDir, targetDir, options = {}) {
   const result = {
@@ -34764,19 +35040,19 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     skipped: [],
     errors: []
   };
-  if (!existsSync14(sourceDir)) {
+  if (!existsSync18(sourceDir)) {
     return result;
   }
-  const targetParent = join14(targetDir, "..");
-  if (!existsSync14(targetParent)) {
-    mkdirSync8(targetParent, { recursive: true });
+  const targetParent = join18(targetDir, "..");
+  if (!existsSync18(targetParent)) {
+    mkdirSync10(targetParent, { recursive: true });
   }
-  if (!existsSync14(targetDir)) {
-    mkdirSync8(targetDir, { recursive: true });
+  if (!existsSync18(targetDir)) {
+    mkdirSync10(targetDir, { recursive: true });
   }
   let entries;
   try {
-    entries = readdirSync6(sourceDir);
+    entries = readdirSync9(sourceDir);
   } catch (e) {
     result.errors.push({
       path: sourceDir,
@@ -34785,10 +35061,10 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     return result;
   }
   for (const entry of entries) {
-    const srcPath = join14(sourceDir, entry);
-    const destPath = join14(targetDir, entry);
+    const srcPath = join18(sourceDir, entry);
+    const destPath = join18(targetDir, entry);
     try {
-      const src = lstatSync(srcPath);
+      const src = lstatSync3(srcPath);
       if (src.isSymbolicLink() || !src.isDirectory()) {
         result.skipped.push(srcPath);
         continue;
@@ -34801,7 +35077,7 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
       continue;
     }
     try {
-      const destStat = lstatSync(destPath);
+      const destStat = lstatSync3(destPath);
       if (destStat.isSymbolicLink()) {
         if (!options.dryRun) {
           unlinkSync2(destPath);
@@ -34953,7 +35229,7 @@ function resolveSignetApiKey() {
 }
 
 // src/index.ts
-var __dirname3 = dirname8(fileURLToPath3(import.meta.url));
+var __dirname3 = dirname5(fileURLToPath3(import.meta.url));
 function getPluginSourceDir() {
   const fromDist = join6(__dirname3, "..", "hermes-plugin");
   if (existsSync2(fromDist))
@@ -34989,21 +35265,21 @@ var REQUIRED_TOOL_NAMES = [
   "recall",
   "remember"
 ];
-var DESCRIPTOR_ROOT = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : null;
-var DESCRIPTOR_WRITES_SUPPORTED = DESCRIPTOR_ROOT !== null && typeof constants.O_DIRECTORY === "number" && typeof constants.O_NOFOLLOW === "number";
+var DESCRIPTOR_ROOT3 = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : null;
+var DESCRIPTOR_WRITES_SUPPORTED = DESCRIPTOR_ROOT3 !== null && typeof constants.O_DIRECTORY === "number" && typeof constants.O_NOFOLLOW === "number";
 var DESCRIPTOR_WRITE_UNAVAILABLE_ERROR = "Targeted Hermes profile writes require descriptor-backed no-follow filesystem support";
 function pathEntryExists(path) {
   try {
-    lstatSync2(path);
+    lstatSync(path);
     return true;
   } catch {
     return false;
   }
 }
 function descriptorPath(fd) {
-  if (DESCRIPTOR_ROOT === null)
+  if (DESCRIPTOR_ROOT3 === null)
     throw new Error(DESCRIPTOR_WRITE_UNAVAILABLE_ERROR);
-  return join6(DESCRIPTOR_ROOT, String(fd));
+  return join6(DESCRIPTOR_ROOT3, String(fd));
 }
 function isPathWithin(root, candidate) {
   const rel = relative2(root, candidate);
@@ -35060,7 +35336,7 @@ function getPythonCandidates() {
   ];
 }
 function runSecureEntryOperation(parentFd, parentPath, name, expectedDev, expectedIno, operation) {
-  if (DESCRIPTOR_ROOT === null)
+  if (DESCRIPTOR_ROOT3 === null)
     throw new Error(DESCRIPTOR_WRITE_UNAVAILABLE_ERROR);
   const errors = [];
   for (const candidate of getPythonCandidates()) {
@@ -35073,7 +35349,7 @@ function runSecureEntryOperation(parentFd, parentPath, name, expectedDev, expect
       operation,
       name,
       parentPath,
-      DESCRIPTOR_ROOT
+      DESCRIPTOR_ROOT3
     ], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe", parentFd],
@@ -35114,7 +35390,7 @@ function ensureContainedDirectory(directory, targetRoot) {
   let existing = absoluteDirectory;
   const missing = [];
   while (!pathEntryExists(existing)) {
-    const parent = dirname8(existing);
+    const parent = dirname5(existing);
     if (parent === existing)
       throw new Error(`Hermes target directory has no existing ancestor: ${directory}`);
     missing.unshift(existing.slice(parent.length + 1));
@@ -35159,7 +35435,7 @@ function writeContainedFile(targetPath, content, targetRoot) {
     throw new Error(DESCRIPTOR_WRITE_UNAVAILABLE_ERROR);
   }
   const rootPath = resolvePath(targetRoot);
-  ensureContainedDirectory(dirname8(safePath), targetRoot);
+  ensureContainedDirectory(dirname5(safePath), targetRoot);
   const relativePath = relative2(rootPath, safePath);
   if (!relativePath || relativePath.startsWith("..") || isAbsolute2(relativePath)) {
     throw new Error(`Hermes target file escapes validated root: ${targetPath}`);
@@ -35192,7 +35468,7 @@ function writeContainedFile(targetPath, content, targetRoot) {
     const filePath = join6(descriptorPath(parentFd), fileName);
     let existingFileIdentity;
     try {
-      const existing = lstatSync2(filePath);
+      const existing = lstatSync(filePath);
       if (existing.isSymbolicLink()) {
         throw new Error(`Hermes target file is symlinked and cannot be used for writes: ${targetPath}`);
       }
@@ -35239,12 +35515,12 @@ function rejectSymlinkedPathComponents(path, root, targetPath) {
   }
   let current = path;
   while (true) {
-    if (lstatSync2(current).isSymbolicLink()) {
+    if (lstatSync(current).isSymbolicLink()) {
       throw new Error(`Hermes target path is symlinked and cannot be used for writes: ${targetPath}`);
     }
     if (current === root)
       return;
-    const parent = dirname8(current);
+    const parent = dirname5(current);
     if (parent === current)
       throw new Error(`Hermes target path escapes validated root: ${targetPath}`);
     current = parent;
@@ -35253,7 +35529,7 @@ function rejectSymlinkedPathComponents(path, root, targetPath) {
 function resolveContainedWritePath(targetPath, targetRoot) {
   let rootPath = resolvePath(targetRoot);
   while (!pathEntryExists(rootPath)) {
-    const parent = dirname8(rootPath);
+    const parent = dirname5(rootPath);
     if (parent === rootPath)
       throw new Error(`Hermes target root does not exist: ${targetRoot}`);
     rootPath = parent;
@@ -35265,7 +35541,7 @@ function resolveContainedWritePath(targetPath, targetRoot) {
   let existing = resolvePath(targetPath);
   const missing = [];
   while (!pathEntryExists(existing)) {
-    const parent = dirname8(existing);
+    const parent = dirname5(existing);
     if (parent === existing)
       throw new Error(`Hermes target path does not have an existing ancestor: ${targetPath}`);
     missing.unshift(existing.slice(parent.length + 1));
@@ -35301,7 +35577,7 @@ function removeDirectoryContentsNoFollow(directoryFd, expectedDirectoryPath) {
       }
       continue;
     }
-    const childIdentity = lstatSync2(childPath);
+    const childIdentity = lstatSync(childPath);
     removeEntryNoFollow(directoryFd, expectedDirectoryPath, entry.name, childIdentity.dev, childIdentity.ino, false);
   }
 }
@@ -35389,7 +35665,7 @@ function removeContainedFile(targetPath, targetRoot) {
       closeDirectory(parentFd);
       parentFd = childFd;
     }
-    const targetFile = lstatSync2(join6(descriptorPath(parentFd), fileName));
+    const targetFile = lstatSync(join6(descriptorPath(parentFd), fileName));
     removeEntryNoFollow(parentFd, expected, fileName, targetFile.dev, targetFile.ino, false);
   } finally {
     closeDirectory(parentFd);
@@ -35558,7 +35834,7 @@ function writeProviderBackup(hermesHome, configPath, providerKind, previousProvi
     previousProvider,
     createdAt: new Date().toISOString()
   };
-  ensureTargetDirectory(dirname8(backupPath), targetRoot);
+  ensureTargetDirectory(dirname5(backupPath), targetRoot);
   writeTargetFile(backupPath, `${JSON.stringify(backup, null, 2)}
 `, targetRoot);
   return backupPath;
@@ -35648,7 +35924,7 @@ function configureProvider(hermesHome, warnings, targetRoot) {
     }
     if (!changed)
       return { configPath: null, backupPath: null };
-    ensureTargetDirectory(dirname8(configPath), targetRoot);
+    ensureTargetDirectory(dirname5(configPath), targetRoot);
     writeTargetFile(configPath, `${lines.join(`
 `).replace(/\n+$/g, "")}
 `, targetRoot);
@@ -35670,7 +35946,7 @@ function configureProvider(hermesHome, warnings, targetRoot) {
       lines.push("");
     lines.push("memory:", "  provider: signet");
   }
-  ensureTargetDirectory(dirname8(configPath), targetRoot);
+  ensureTargetDirectory(dirname5(configPath), targetRoot);
   writeTargetFile(configPath, `${lines.join(`
 `).replace(/\n+$/g, "")}
 `, targetRoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-hermes-agent",
-  "version": "0.227.1",
+  "version": "0.228.0",
   "description": "Signet connector for Hermes Agent — installs Signet as a pluggable memory provider",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.227.1",
-    "@signetai/core": "0.227.1"
+    "@signetai/connector-base": "0.228.0",
+    "@signetai/core": "0.228.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",