@signetai/connector-openclaw 0.227.1 → 0.228.0

package/dist/index.js

@@ -1,14 +1,14 @@
 // src/index.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { delimiter, join as join4, resolve as resolve2 } from "node:path";
+import { delimiter, join as join4, resolve as resolve3 } from "node:path";
 
 // ../../../libs/connector-base/dist/index.js
 import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join3, relative, sep } from "node:path";
 import { createRequire } from "node:module";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import {
   execFile as nodeExecFile,
@@ -19,14 +19,15 @@ import {
 } from "node:child_process";
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname5, join as join9, resolve as resolve3 } from "node:path";
+import { dirname as dirname6, join as join14, resolve as resolve8 } from "node:path";
 import { homedir as homedir6, platform as platform2 } from "node:os";
-import { basename, dirname as dirname6, resolve as resolve5 } from "node:path";
+import { basename, dirname as dirname7, resolve as resolve9 } from "node:path";
 import { homedir as homedir8 } from "node:os";
-import { existsSync as existsSync14, lstatSync, mkdirSync as mkdirSync8, readdirSync as readdirSync6, symlinkSync, unlinkSync as unlinkSync2 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync3, mkdirSync as mkdirSync10, readdirSync as readdirSync9, symlinkSync as symlinkSync2, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join18 } from "node:path";
 var __create2 = Object.create;
 var __getProtoOf2 = Object.getPrototypeOf;
 var __defProp2 = Object.defineProperty;
@@ -15893,6 +15894,102 @@ function up159(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns(db, table, definitions) {
+  const present = columns(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns.join(",")})
+			SELECT ${ledgerColumns.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up160(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS = [
   {
     version: 1,
@@ -17181,6 +17278,18 @@ var MIGRATIONS = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up5
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up160,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -17188,30 +17297,17 @@ var NETWORK_FILESYSTEM_TYPES = new Set(["afpfs", "nfs", "smbfs", "webdav"]);
 var __filename2 = fileURLToPath(import.meta.url);
 var __dirname2 = dirname(__filename2);
 var import_yaml = __toESM2(require_dist(), 1);
-var STATES = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation = Promise.resolve();
-var LOOPBACK_HOST = "127.0.0.1";
-var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml2 = __toESM2(require_dist(), 1);
-var native = null;
-try {
-  const esmRequire = createRequire2(import.meta.url);
-  native = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR = join9(homedir5(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}`,
@@ -17250,7 +17346,13 @@ var SIGNET_GIT_TRACKED_PATHS = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME}/`,
   "memory/memories.db*",
@@ -17270,17 +17372,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | (fsConstants.O_NOFOLLOW ?? 0);
+var FILE_FLAGS = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+var NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER = new Map(PROTECTION_COMPONENT_IDS.map((id, index) => [id, index]));
+var BLOCKING = new Set(["missing", "stale", "degraded"]);
+var STATES = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation = Promise.resolve();
+var LOOPBACK_HOST = "127.0.0.1";
+var LOCAL_BINDS = new Set([LOOPBACK_HOST, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml2 = __toESM2(require_dist(), 1);
+var native = null;
+try {
+  const esmRequire = createRequire2(import.meta.url);
+  native = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR = join14(homedir5(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH = defaultDiscordDesktopCachePath();
 var DEFAULT_GITHUB_RESOURCE_TYPES = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES = new Set(DEFAULT_GITHUB_RESOURCE_TYPES);
 function defaultDiscordDesktopCachePath() {
   switch (platform2()) {
     case "darwin":
-      return resolve5(homedir6(), "Library", "Application Support", "discord");
+      return resolve9(homedir6(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve5(process.env.APPDATA || resolve5(homedir6(), "AppData", "Roaming"), "discord");
+      return resolve9(process.env.APPDATA || resolve9(homedir6(), "AppData", "Roaming"), "discord");
     default:
-      return resolve5(process.env.XDG_CONFIG_HOME || resolve5(homedir6(), ".config"), "discord");
+      return resolve9(process.env.XDG_CONFIG_HOME || resolve9(homedir6(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES = {
@@ -17340,7 +17478,7 @@ var REQUIRED_IDENTITY_KEYS = Object.entries(IDENTITY_FILES).filter(([, spec]) =>
 var OPTIONAL_IDENTITY_KEYS = Object.entries(IDENTITY_FILES).filter(([, spec]) => spec.optional).map(([key]) => key);
 function linkDirSync(target, path) {
   const type = process.platform === "win32" ? "junction" : "dir";
-  symlinkSync(target, path, type);
+  symlinkSync2(target, path, type);
 }
 function symlinkSkills(sourceDir, targetDir, options = {}) {
   const result = {
@@ -17348,19 +17486,19 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     skipped: [],
     errors: []
   };
-  if (!existsSync14(sourceDir)) {
+  if (!existsSync18(sourceDir)) {
     return result;
   }
-  const targetParent = join14(targetDir, "..");
-  if (!existsSync14(targetParent)) {
-    mkdirSync8(targetParent, { recursive: true });
+  const targetParent = join18(targetDir, "..");
+  if (!existsSync18(targetParent)) {
+    mkdirSync10(targetParent, { recursive: true });
   }
-  if (!existsSync14(targetDir)) {
-    mkdirSync8(targetDir, { recursive: true });
+  if (!existsSync18(targetDir)) {
+    mkdirSync10(targetDir, { recursive: true });
   }
   let entries;
   try {
-    entries = readdirSync6(sourceDir);
+    entries = readdirSync9(sourceDir);
   } catch (e) {
     result.errors.push({
       path: sourceDir,
@@ -17369,10 +17507,10 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
     return result;
   }
   for (const entry of entries) {
-    const srcPath = join14(sourceDir, entry);
-    const destPath = join14(targetDir, entry);
+    const srcPath = join18(sourceDir, entry);
+    const destPath = join18(targetDir, entry);
     try {
-      const src = lstatSync(srcPath);
+      const src = lstatSync3(srcPath);
       if (src.isSymbolicLink() || !src.isDirectory()) {
         result.skipped.push(srcPath);
         continue;
@@ -17385,7 +17523,7 @@ function symlinkSkills(sourceDir, targetDir, options = {}) {
       continue;
     }
     try {
-      const destStat = lstatSync(destPath);
+      const destStat = lstatSync3(destPath);
       if (destStat.isSymbolicLink()) {
         if (!options.dryRun) {
           unlinkSync2(destPath);
@@ -19545,7 +19683,7 @@ function parseLenientJsonObject(raw, options) {
 
 // ../../../platform/core/dist/index.js
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname3, join as join2 } from "node:path";
+import { dirname as dirname3, join as join2, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import {
   execFile as nodeExecFile2,
@@ -19557,12 +19695,13 @@ import {
 import { promisify as promisify2 } from "node:util";
 import { createHash as createHash2 } from "node:crypto";
 import { homedir as homedir2 } from "node:os";
-import { join as join22, resolve } from "node:path";
+import { join as join22, resolve as resolve22 } from "node:path";
+import { constants as fsConstants2 } from "node:fs";
 import { createRequire as createRequire22 } from "node:module";
 import { homedir as homedir52 } from "node:os";
-import { dirname as dirname52, join as join92, resolve as resolve32 } from "node:path";
+import { dirname as dirname62, join as join142, resolve as resolve82 } from "node:path";
 import { homedir as homedir62, platform as platform22 } from "node:os";
-import { basename as basename2, dirname as dirname62, resolve as resolve52 } from "node:path";
+import { basename as basename2, dirname as dirname72, resolve as resolve92 } from "node:path";
 import { homedir as homedir82 } from "node:os";
 var __create3 = Object.create;
 var __getProtoOf3 = Object.getPrototypeOf;
@@ -30129,7 +30268,7 @@ var DAEMON_DERIVED_MEMORY_SOURCE_TYPES2 = [
   "checkpoint",
   "dreaming"
 ];
-function up160(db) {
+function up161(db) {
   const hasColumn26 = (table, column) => {
     const statement = db.prepare(`SELECT 1 FROM pragma_table_info('${table}') WHERE name = ?`);
     try {
@@ -30196,8 +30335,8 @@ function up210(db) {
 	`);
 }
 function addColumnIfMissing30(db, column, definition) {
-  const columns = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare("PRAGMA table_info(transcript_capture_jobs)").all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE transcript_capture_jobs ADD COLUMN ${column} ${definition}`);
 }
@@ -31078,8 +31217,8 @@ function up252(db) {
   addColumnIfMissing82(db, "session_memories", "structural_density", "INTEGER");
 }
 function up262(db) {
-  const columns = db.prepare("PRAGMA table_info(session_checkpoints)").all();
-  const columnNames = new Set(columns.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
+  const columns2 = db.prepare("PRAGMA table_info(session_checkpoints)").all();
+  const columnNames = new Set(columns2.flatMap((column) => typeof column.name === "string" ? [column.name] : []));
   if (!columnNames.has("focal_entity_ids")) {
     db.exec("ALTER TABLE session_checkpoints ADD COLUMN focal_entity_ids TEXT");
   }
@@ -33391,8 +33530,8 @@ function up972(db) {
 	`);
 }
 function up982(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "evidence_cursor")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "evidence_cursor")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN evidence_cursor TEXT");
   }
 }
@@ -33436,8 +33575,8 @@ function up1012(db) {
   db.exec("DROP TABLE IF EXISTS ingestion_jobs");
 }
 function up1022(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_state)").all();
-  if (!columns.some((column) => column.name === "last_failure_at")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_state)").all();
+  if (!columns2.some((column) => column.name === "last_failure_at")) {
     db.exec("ALTER TABLE dreaming_state ADD COLUMN last_failure_at TEXT");
   }
   db.exec("UPDATE dreaming_state SET last_failure_at = updated_at WHERE consecutive_failures > 0 AND last_failure_at IS NULL");
@@ -33480,11 +33619,11 @@ function up1042(db) {
 	`);
 }
 function up1052(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_passes)").all();
-  if (!columns.some((column) => column.name === "evidence_window_json")) {
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_passes)").all();
+  if (!columns2.some((column) => column.name === "evidence_window_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN evidence_window_json TEXT");
   }
-  if (!columns.some((column) => column.name === "runbook_json")) {
+  if (!columns2.some((column) => column.name === "runbook_json")) {
     db.exec("ALTER TABLE dreaming_passes ADD COLUMN runbook_json TEXT");
   }
 }
@@ -33923,8 +34062,8 @@ function hasTable42(db, table) {
   return db.prepare("SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) != null;
 }
 function addColumnIfMissing262(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (columns2.some((row) => row.name === column))
     return;
   db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
@@ -33936,8 +34075,8 @@ function hashTranscript2(content) {
   return createHash2("sha256").update(content, "utf8").digest("hex");
 }
 function backfillTranscriptHashes2(db) {
-  const columns = tableColumns2(db, "session_transcripts");
-  if (!columns.has("content_hash") || !columns.has("content"))
+  const columns2 = tableColumns2(db, "session_transcripts");
+  if (!columns2.has("content_hash") || !columns2.has("content"))
     return;
   const rows = db.prepare("SELECT session_key, agent_id, content FROM session_transcripts WHERE content_hash IS NULL").all();
   const update = db.prepare("UPDATE session_transcripts SET content_hash = ? WHERE agent_id = ? AND session_key = ? AND content_hash IS NULL");
@@ -33963,8 +34102,8 @@ function laterTimestamp2(current, candidate) {
   }
   return candidate > current ? candidate : current;
 }
-function isCompletionBoundary2(job, columns) {
-  return columns.has("trigger") && job.trigger === "session_end" || columns.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
+function isCompletionBoundary2(job, columns2) {
+  return columns2.has("trigger") && job.trigger === "session_end" || columns2.has("boundary_reason") && COMPLETION_BOUNDARY_REASONS2.has(job.boundary_reason ?? "");
 }
 function mergeTranscriptContent2(current, next) {
   if (current.length === 0)
@@ -34212,8 +34351,8 @@ function up1262(db) {
 	`);
 }
 function up1272(db) {
-  const columns = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
-  const names = new Set(columns.map((column) => column.name));
+  const columns2 = db.prepare("PRAGMA table_info(dreaming_evidence_exclusions)").all();
+  const names = new Set(columns2.map((column) => column.name));
   if (!names.has("failure_class")) {
     db.exec("ALTER TABLE dreaming_evidence_exclusions ADD COLUMN failure_class TEXT NOT NULL DEFAULT 'unknown' CHECK (failure_class IN ('incomplete_transcript', 'source_projection', 'scope_mismatch', 'quote_mismatch', 'unknown'))");
   }
@@ -34625,8 +34764,8 @@ function up1382(db) {
 		CREATE INDEX IF NOT EXISTS idx_memory_head_revision_entries_entry
 			ON memory_head_revision_entries(agent_id, entry_id, revision DESC);
 	`);
-  const columns = db.prepare("PRAGMA table_info(memory_md_heads)").all();
-  const names = new Set(columns.map((column) => String(column.name)));
+  const columns2 = db.prepare("PRAGMA table_info(memory_md_heads)").all();
+  const names = new Set(columns2.map((column) => String(column.name)));
   if (!names.has("revision_id"))
     db.exec("ALTER TABLE memory_md_heads ADD COLUMN revision_id TEXT");
   if (!names.has("pass_id"))
@@ -35052,13 +35191,13 @@ function up1462(db) {
 	`);
 }
 function up1472(db) {
-  const columns = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
-  if (!columns.some((column) => column.name === "frontier")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_sync_checkpoints)").all();
+  if (!columns2.some((column) => column.name === "frontier")) {
     db.exec("ALTER TABLE source_sync_checkpoints ADD COLUMN frontier TEXT");
   }
 }
 function up1482(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_index_state)").all().map((row) => row.name).filter((name) => typeof name === "string"));
   const additions = [
     ["migration_phase", "TEXT"],
     ["progress_staged", "INTEGER NOT NULL DEFAULT 0"],
@@ -35069,7 +35208,7 @@ function up1482(db) {
     ["provider_endpoint", "TEXT"]
   ];
   for (const [name, definition] of additions) {
-    if (!columns.has(name))
+    if (!columns2.has(name))
       db.exec(`ALTER TABLE embedding_index_state ADD COLUMN ${name} ${definition}`);
   }
   db.exec(`
@@ -35093,8 +35232,8 @@ function up1482(db) {
   }
 }
 function up1492(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
-  if (!columns.has("lease_token")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(memory_jobs)").all().map((row) => row.name).filter((name) => typeof name === "string"));
+  if (!columns2.has("lease_token")) {
     db.exec("ALTER TABLE memory_jobs ADD COLUMN lease_token TEXT");
   }
 }
@@ -35187,8 +35326,8 @@ function up1522(db) {
   db.exec("CREATE INDEX IF NOT EXISTS idx_source_import_files_job_state ON source_import_files(job_id, state)");
 }
 function up1532(db) {
-  const columns = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
-  if (!columns.some((column) => column.name === "source_id")) {
+  const columns2 = db.prepare("PRAGMA table_info(source_import_record_attempts)").all();
+  if (!columns2.some((column) => column.name === "source_id")) {
     db.exec("ALTER TABLE source_import_record_attempts ADD COLUMN source_id TEXT");
   }
 }
@@ -35209,8 +35348,8 @@ function up1542(db) {
   addColumn("source_import_files", "error", "TEXT");
 }
 function addColumnIfMissing292(db, table, column, definition) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((row) => row.name === column))
+  const columns2 = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (!columns2.some((row) => row.name === column))
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
 }
 function up1552(db) {
@@ -35410,8 +35549,8 @@ function up1572(db) {
 	`);
 }
 function up1582(db) {
-  const columns = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
-  if (!columns.has("profile_fingerprint")) {
+  const columns2 = new Set(db.prepare("PRAGMA table_info(embedding_repair_checkpoints)").all().map((row) => row.name));
+  if (!columns2.has("profile_fingerprint")) {
     db.exec("ALTER TABLE embedding_repair_checkpoints ADD COLUMN profile_fingerprint TEXT");
   }
   db.exec(`
@@ -35430,6 +35569,102 @@ function up1592(db) {
 		ON memories(agent_id, memory_kind);
 	`);
 }
+var ledgerColumns2 = [
+  "key",
+  "agent_id",
+  "workspace_id",
+  "file_name",
+  "status",
+  "original_path",
+  "sha256",
+  "size_bytes",
+  "request_fingerprint",
+  "source_id",
+  "lease_token",
+  "lease_expires_at",
+  "attempt_count",
+  "error",
+  "created_at",
+  "updated_at"
+];
+function columns2(db, table) {
+  return new Set(db.prepare(`PRAGMA table_info(${table})`).all().map((row) => String(row.name)));
+}
+function addMissingColumns2(db, table, definitions) {
+  const present = columns2(db, table);
+  for (const definition of definitions) {
+    const name = definition.split(" ", 1)[0];
+    if (!present.has(name))
+      db.exec(`ALTER TABLE ${table} ADD COLUMN ${definition}`);
+  }
+}
+function rebuildLedgerWithoutGlobalKeyPrimaryKey2(db) {
+  const keyInfo = db.prepare("PRAGMA table_info(import_admission_ledger)").all().find((row) => row.name === "key");
+  if (!keyInfo || Number(keyInfo.pk) === 0)
+    return;
+  const savepoint = "migration_158_rebuild_ledger";
+  db.exec(`SAVEPOINT ${savepoint}`);
+  try {
+    db.exec(`
+			CREATE TABLE import_admission_ledger_v158 (
+				key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '', workspace_id TEXT NOT NULL DEFAULT '',
+				file_name TEXT NOT NULL, status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+				original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+				request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+				attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+			);
+			INSERT INTO import_admission_ledger_v158 (${ledgerColumns2.join(",")})
+			SELECT ${ledgerColumns2.join(",")} FROM import_admission_ledger;
+			DROP TABLE import_admission_ledger;
+			ALTER TABLE import_admission_ledger_v158 RENAME TO import_admission_ledger;
+		`);
+    db.exec(`RELEASE ${savepoint}`);
+  } catch (error) {
+    try {
+      db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+    } finally {
+      try {
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {}
+    }
+    throw error;
+  }
+}
+function up1602(db) {
+  db.exec(`
+		CREATE TABLE IF NOT EXISTS import_admission_ledger (
+			key TEXT NOT NULL, agent_id TEXT NOT NULL, workspace_id TEXT NOT NULL DEFAULT '', file_name TEXT NOT NULL,
+			status TEXT NOT NULL CHECK (status IN ('pending','processing','imported','duplicate','failed','quarantined','original_unavailable')),
+			original_path TEXT NOT NULL, sha256 TEXT NOT NULL, size_bytes INTEGER NOT NULL,
+			request_fingerprint TEXT NOT NULL DEFAULT '', source_id TEXT, lease_token TEXT, lease_expires_at TEXT,
+			attempt_count INTEGER NOT NULL DEFAULT 0, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
+		);
+		CREATE TABLE IF NOT EXISTS import_admission_events (
+			id INTEGER PRIMARY KEY AUTOINCREMENT, admission_key TEXT NOT NULL, agent_id TEXT NOT NULL DEFAULT '',
+			workspace_id TEXT NOT NULL DEFAULT '', event TEXT NOT NULL, created_at TEXT NOT NULL
+		);
+	`);
+  addMissingColumns2(db, "import_admission_ledger", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''",
+    "request_fingerprint TEXT NOT NULL DEFAULT ''",
+    "source_id TEXT",
+    "lease_token TEXT",
+    "lease_expires_at TEXT",
+    "attempt_count INTEGER NOT NULL DEFAULT 0",
+    "error TEXT"
+  ]);
+  addMissingColumns2(db, "import_admission_events", [
+    "agent_id TEXT NOT NULL DEFAULT ''",
+    "workspace_id TEXT NOT NULL DEFAULT ''"
+  ]);
+  rebuildLedgerWithoutGlobalKeyPrimaryKey2(db);
+  db.exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS uq_import_admission_scope_key ON import_admission_ledger(key, agent_id, workspace_id);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_status ON import_admission_ledger(agent_id, workspace_id, status, updated_at);
+		CREATE INDEX IF NOT EXISTS idx_import_admission_events_key ON import_admission_events(admission_key, agent_id, workspace_id, id);
+	`);
+}
 var MIGRATIONS2 = [
   {
     version: 1,
@@ -36634,7 +36869,7 @@ var MIGRATIONS2 = [
   {
     version: 151,
     name: "transcript-import-bytes",
-    up: up160,
+    up: up161,
     artifacts: {
       tables: [
         "source_import_chunks",
@@ -36718,6 +36953,18 @@ var MIGRATIONS2 = [
     version: 159,
     name: "retire-obsolete-invocation-ledger",
     up: up510
+  },
+  {
+    version: 160,
+    name: "import-admission-ledger",
+    up: up1602,
+    artifacts: {
+      tables: ["import_admission_ledger", "import_admission_events"],
+      indexes: ["idx_import_admission_status", "idx_import_admission_events_key"],
+      columns: [
+        ...["workspace_id", "request_fingerprint", "source_id", "lease_token", "lease_expires_at", "attempt_count"].map((column) => ({ table: "import_admission_ledger", column }))
+      ]
+    }
   }
 ];
 var LATEST_SCHEMA_VERSION2 = MIGRATIONS2[MIGRATIONS2.length - 1]?.version ?? 0;
@@ -36732,30 +36979,17 @@ function expandHome(p3, home2 = homedir2()) {
     return join22(home2, p3.slice(2));
   return p3;
 }
-var STATES2 = new Set([
-  "found",
-  "missing",
-  "locked",
-  "unavailable",
-  "permission-denied",
-  "corrupt",
-  "unsupported"
-]);
-var mutation2 = Promise.resolve();
-var LOOPBACK_HOST2 = "127.0.0.1";
-var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
-var import_yaml22 = __toESM3(require_dist2(), 1);
-var native2 = null;
-try {
-  const esmRequire = createRequire22(import.meta.url);
-  native2 = esmRequire("@signet/native");
-} catch {}
-var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join92(homedir52(), ".local", "bin");
 var SIGNET_SOURCE_CHECKOUT_DIRNAME2 = "signetai";
 var SIGNET_GIT_ALLOWED_DIRECTORIES2 = ["skills", "tools", "dreaming"];
 var SIGNET_GIT_PROTECTED_PATHS2 = [
   ".daemon",
+  ".secrets",
   ".shadow",
+  "cache",
+  "data",
+  "files",
+  "runtime",
+  "workspace-layout.json",
   "node_modules",
   ":(glob)**/node_modules/**",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}`,
@@ -36794,7 +37028,13 @@ var SIGNET_GIT_TRACKED_PATHS2 = [
 ];
 var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   ".daemon/",
+  ".secrets/",
   ".shadow/",
+  "cache/",
+  "data/",
+  "files/",
+  "runtime/",
+  "workspace-layout.json",
   "node_modules/",
   `${SIGNET_SOURCE_CHECKOUT_DIRNAME2}/`,
   "memory/memories.db*",
@@ -36814,17 +37054,53 @@ var SIGNET_GITIGNORE_PROTECTED_PATTERNS2 = [
   "*.sqlite",
   "*.sqlite3"
 ];
+var DESCRIPTOR_ROOT2 = process.platform === "linux" ? "/proc/self/fd" : process.platform === "darwin" ? "/dev/fd" : undefined;
+var DIRECTORY_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_DIRECTORY ?? 0) | (fsConstants2.O_NOFOLLOW ?? 0);
+var FILE_FLAGS2 = fsConstants2.O_RDONLY | (fsConstants2.O_NOFOLLOW ?? 0) | (fsConstants2.O_NONBLOCK ?? 0);
+var NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
+var PROTECTION_COMPONENT_IDS2 = [
+  "root-authored",
+  "skills",
+  "managed-originals",
+  "sqlite",
+  "transcripts",
+  "external-sources",
+  "runtime",
+  "filesystem-cache",
+  "secrets"
+];
+var ORDER2 = new Map(PROTECTION_COMPONENT_IDS2.map((id, index) => [id, index]));
+var BLOCKING2 = new Set(["missing", "stale", "degraded"]);
+var STATES2 = new Set([
+  "found",
+  "missing",
+  "locked",
+  "unavailable",
+  "permission-denied",
+  "corrupt",
+  "unsupported"
+]);
+var mutation2 = Promise.resolve();
+var LOOPBACK_HOST2 = "127.0.0.1";
+var LOCAL_BINDS2 = new Set([LOOPBACK_HOST2, "localhost", "::1", "::ffff:127.0.0.1"]);
+var import_yaml22 = __toESM3(require_dist2(), 1);
+var native2 = null;
+try {
+  const esmRequire = createRequire22(import.meta.url);
+  native2 = esmRequire("@signet/native");
+} catch {}
+var GRAPHIQ_DEFAULT_INSTALL_DIR2 = join142(homedir52(), ".local", "bin");
 var DEFAULT_DISCORD_DESKTOP_CACHE_PATH2 = defaultDiscordDesktopCachePath2();
 var DEFAULT_GITHUB_RESOURCE_TYPES2 = ["issues", "pulls", "discussions", "docs"];
 var VALID_GITHUB_RESOURCE_TYPES2 = new Set(DEFAULT_GITHUB_RESOURCE_TYPES2);
 function defaultDiscordDesktopCachePath2() {
   switch (platform22()) {
     case "darwin":
-      return resolve52(homedir62(), "Library", "Application Support", "discord");
+      return resolve92(homedir62(), "Library", "Application Support", "discord");
     case "win32":
-      return resolve52(process.env.APPDATA || resolve52(homedir62(), "AppData", "Roaming"), "discord");
+      return resolve92(process.env.APPDATA || resolve92(homedir62(), "AppData", "Roaming"), "discord");
     default:
-      return resolve52(process.env.XDG_CONFIG_HOME || resolve52(homedir62(), ".config"), "discord");
+      return resolve92(process.env.XDG_CONFIG_HOME || resolve92(homedir62(), ".config"), "discord");
   }
 }
 var IDENTITY_FILES2 = {
@@ -37115,7 +37391,7 @@ class OpenClawConnector extends BaseConnector {
         if (trimmed.length === 0) {
           continue;
         }
-        const expanded = resolve2(expandHome(trimmed, this.getHomeDir()));
+        const expanded = resolve3(expandHome(trimmed, this.getHomeDir()));
         if (seen.has(expanded)) {
           continue;
         }
@@ -37263,7 +37539,7 @@ class OpenClawConnector extends BaseConnector {
     return candidates[0];
   }
   validateWorkspacePath(p3) {
-    const resolved = resolve2(expandHome(p3, this.getHomeDir()));
+    const resolved = resolve3(expandHome(p3, this.getHomeDir()));
     const tmp = tmpdir();
     if (resolved.startsWith(tmp)) {
       throw new Error(`Refusing to set workspace to temp directory: ${resolved}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signetai/connector-openclaw",
-  "version": "0.227.1",
+  "version": "0.228.0",
   "description": "Signet connector for OpenClaw - configures workspace and memory hooks",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@signetai/connector-base": "0.227.1",
-    "@signetai/core": "0.227.1"
+    "@signetai/connector-base": "0.228.0",
+    "@signetai/core": "0.228.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",