@totalreclaw/totalreclaw 3.3.12 → 3.3.13-rc.1

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: totalreclaw
 description: "End-to-end encrypted, decentralized memory for OpenClaw. A native kind:memory provider — recall is automatic via memory_search/memory_get, and facts are captured in the background. Trigger on 'install TotalReclaw', 'set up TotalReclaw', 'restore my recovery phrase', any recall request ('what do you remember about me', 'what's my X'), AND any explicit remember request ('remember X', 'save X')."
-version: 3.3.12-rc.23
+version: 3.3.13-rc.1
 author: TotalReclaw Team
 license: MIT
 homepage: https://totalreclaw.xyz
@@ -45,24 +45,41 @@ The 12-word recovery phrase MUST NEVER enter chat or the agent's LLM context. Th
 ```
 openclaw plugins install @totalreclaw/totalreclaw
 openclaw skills install totalreclaw
+openclaw plugins enable totalreclaw
 ```
 
-Published on npm + ClawHub (`p-diogo`, GitHub-verified). For a release candidate, pin with `@rc`; stable resolves from `latest`. The plugin self-applies any gateway config it needs on load and auto-reloads (see Restart below) — no manual gateway restart.
+Published on npm + ClawHub (`p-diogo`, GitHub-verified). For a release candidate, pin with `@rc`; stable resolves from `latest`. Run `openclaw plugins enable totalreclaw` right after install, always — it binds the memory slot. On a clean install that's a no-op; on a **reinstall over a previous version** it's what stops the plugin from landing `Status: disabled` with the slot stuck at `memory-core` (a disabled plugin never registers its memory tools or pair routes, so pairing later fails with a 502). The plugin self-applies the rest of the gateway config it needs on load and auto-reloads (see Restart below) — no manual gateway restart.
+
+**Reinstall recovery.** If install reports `already exists` / `delete it first`, do **not** add `--force` (it writes a broken `version=None` record). Clean the leftover package dir and reinstall — this never touches your credentials, which live under `~/.totalreclaw/`:
+
+```
+openclaw plugins uninstall totalreclaw
+rm -rf ~/.openclaw/npm/projects/*totalreclaw-totalreclaw*
+openclaw plugins install @totalreclaw/totalreclaw
+openclaw plugins enable totalreclaw
+```
 
 ## Setup (pair — user-initiated QR)
 
-Pairing is a deliberate, user-initiated QR flow (the plugin does **not** auto-pair on load). When credentials don't exist:
+Pairing is a deliberate, user-initiated flow (the plugin does **not** auto-pair on load). When credentials don't exist:
+
+1. Mint a pair session via the plugin's **in-process HTTP route** — the gateway process owns the relay pair WebSocket, so it survives until the user completes:
+
+   ```bash
+   curl -s http://localhost:18789/plugin/totalreclaw/pair/init
+   ```
+
+   → returns `{"url":"https://…/pair/p/<id>#pk=…","pin":"123456","expires_at_ms":…}`.
 
-1. Run `tr pair --json` → returns `{"url":"https://…/pair/p/<id>#pk=…","pin":"123456","expires_at_ms":…}`.
-2. Surface the **url** and **pin** to the user verbatim (read from the JSON; never invent values): "Open `<url>` in your browser, enter PIN `<pin>`, and generate or paste your 12-word recovery phrase. Reply done once it's sealed."
-3. The user completes in the browser (phrase is generated/imported browser-side, encrypted, posted to the relay — never touches this chat). On completion `~/.totalreclaw/credentials.json` is written.
+   **Do NOT use `tr pair --json` for this.** The CLI holds the pair WebSocket in a subprocess that OpenClaw's ~30s shell-tool timeout kills — the WS then drops, and when the user submits their phrase the relay returns a **502** (`gateway_disconnected`). The in-process route above avoids that entirely. Only fall back to the CLI if the route is unreachable (no `curl`, or a pre-3.3.14 plugin), and then it MUST be detached so the WS outlives the shell exec: `setsid -f node "$TR_CLI" pair --json < /dev/null` — never run `tr pair` in the foreground.
+2. Surface the **url** and **pin** to the user verbatim (read from the JSON; never invent values): "Open `<url>` in your browser, enter PIN `<pin>`, and generate or paste your 12-word recovery phrase. Reply done once it's sealed." Emit the URL as plain text on its own line — the `#pk=` fragment breaks if wrapped in backticks/markdown.
+3. The user completes in the browser (phrase is generated/imported browser-side, encrypted, uploaded to the relay — never touches this chat). On completion `~/.totalreclaw/credentials.json` is written.
 4. Confirm: `✓ TotalReclaw set up.` (If credentials already exist when first asked: `✓ TotalReclaw is already set up.`)
 
 Pair is UNCONDITIONAL when no credentials — the user installing/requesting setup IS the consent; do not add a second consent gate. `tr --help` lists every subcommand.
 
 ```bash
-TR_CLI="$(ls -d ~/.openclaw/npm/node_modules/@totalreclaw/totalreclaw/dist/tr-cli.js ~/.openclaw/extensions/totalreclaw/dist/tr-cli.js 2>/dev/null | head -1)"
-node "$TR_CLI" pair --json        # start/re-pair
+TR_CLI="$(ls -d ~/.openclaw/npm/node_modules/@totalreclaw/totalreclaw/dist/cli/tr-cli.js ~/.openclaw/extensions/totalreclaw/dist/cli/tr-cli.js 2>/dev/null | head -1)"
 node "$TR_CLI" status --json      # {"version":"…","paired":true,…}
 ```
 

package/{billing-cache.ts → billing/billing-cache.ts}

@@ -27,7 +27,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from './config.js';
+import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from '../config.js';
 
 /** A plausible EVM address — anything else from billing is ignored (#460). */
 const DATA_EDGE_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;

package/{relay-headers.ts → billing/relay-headers.ts}

@@ -18,7 +18,7 @@
  * the variable.
  */
 
-import { getSessionId } from './config.js';
+import { getSessionId } from '../config.js';
 
 /** Default `X-TotalReclaw-Client` value. */
 export const DEFAULT_CLIENT_ID = 'openclaw-plugin';

package/{tr-cli-export-helper.ts → cli/tr-cli-export-helper.ts}

@@ -13,9 +13,9 @@
  * pre-derived auth-key + wallet-address + encryption-key from the caller.
  */
 
-import { CONFIG } from './config.js';
-import { buildRelayHeaders } from './relay-headers.js';
-import { decrypt } from './crypto.js';
+import { CONFIG } from '../config.js';
+import { buildRelayHeaders } from '../billing/relay-headers.js';
+import { decrypt } from '../crypto/crypto.js';
 
 /** Decode a hex blob written by submitFactBatchOnChain back to plaintext. */
 function fromHexBlob(hexBlob: string, encryptionKey: Buffer): string {
@@ -104,8 +104,8 @@ export async function exportAllFacts(
       ? { owner: walletAddress, first: PAGE_SIZE, lastId }
       : { owner: walletAddress, first: PAGE_SIZE };
 
-    const data = await gql<{ facts?: FactRow[] }>(query, variables);
-    const facts = data?.facts ?? [];
+    const subgraphResponse = await gql<{ facts?: FactRow[] }>(query, variables);
+    const facts = subgraphResponse?.facts ?? [];
     if (facts.length === 0) break;
 
     for (const f of facts) {

package/{tr-cli.ts → cli/tr-cli.ts}

@@ -31,23 +31,23 @@
  * --json flag: all agent-facing CLI calls MUST use --json for clean machine-parseable output.
  *              Plain text mode is for direct user CLI use only.
  *
- * Install: wired via package.json `bin.tr` → dist/tr-cli.js
- * Usage from container: `docker exec tr-openclaw node ~/.openclaw/extensions/totalreclaw/dist/tr-cli.js status --json`
+ * Install: wired via package.json `bin.tr` → dist/cli/tr-cli.js
+ * Usage from container: `docker exec tr-openclaw node ~/.openclaw/extensions/totalreclaw/dist/cli/tr-cli.js status --json`
  */
 
 import { randomUUID } from 'node:crypto';
 
-import { CONFIG, setRecoveryPhraseOverride } from './config.js';
-import { loadCredentialsJson } from './fs-helpers.js';
-import { printStatus } from './onboarding-cli.js';
+import { CONFIG, setRecoveryPhraseOverride } from '../config.js';
+import { loadCredentialsJson } from '../fs-helpers.js';
+import { printStatus } from '../pairing/onboarding-cli.js';
 import {
   deriveKeys,
   computeAuthKeyHash,
   encrypt,
   generateBlindIndices,
   generateContentFingerprint,
-} from './crypto.js';
-import { createApiClient } from './api-client.js';
+} from '../crypto/crypto.js';
+import { createApiClient } from '../billing/api-client.js';
 import {
   encodeFactProtobuf,
   submitFactBatchOnChain,
@@ -55,7 +55,7 @@ import {
   getSubgraphConfig,
   PROTOBUF_VERSION_V4,
   type FactPayload,
-} from './subgraph-store.js';
+} from '../subgraph/subgraph-store.js';
 import { exportAllFacts } from './tr-cli-export-helper.js';
 
 // ---------------------------------------------------------------------------
@@ -68,7 +68,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.23';
+const PLUGIN_VERSION = '3.3.13-rc.1';
 
 function die(msg: string, code = 1): never {
   process.stderr.write(`tr: ${msg}\n`);
@@ -124,7 +124,7 @@ interface CliContext {
 async function buildContext(): Promise<CliContext> {
   const creds = loadCredentialsJson(CREDENTIALS_PATH);
   if (!creds) {
-    die('TotalReclaw is not set up. Run: node ~/.openclaw/extensions/totalreclaw/dist/tr-cli.js pair --json');
+    die('TotalReclaw is not set up. Run: node ~/.openclaw/extensions/totalreclaw/dist/cli/tr-cli.js pair --json');
   }
 
   const mnemonic =
@@ -244,8 +244,8 @@ async function cmdPair(args: string[]): Promise<void> {
   // Phrase-safety: pair-cli-relay.ts is x25519-only; mnemonic never appears.
   const outputMode = args.includes('--json') ? 'json' : args.includes('--url-pin') ? 'url-pin' : 'human';
 
-  const { runRelayPairCli } = await import('./pair-cli-relay.js');
-  const { defaultRenderQr, buildDefaultPairCliIo } = await import('./pair-cli.js');
+  const { runRelayPairCli } = await import('../pairing/pair-cli-relay.js');
+  const { defaultRenderQr, buildDefaultPairCliIo } = await import('../pairing/pair-cli.js');
 
   const io = buildDefaultPairCliIo();
   const outcome = await runRelayPairCli('generate', {
@@ -261,7 +261,7 @@ async function cmdPair(args: string[]): Promise<void> {
     deriveScopeAddress: undefined,
     renderQr: defaultRenderQr,
     io,
-    outputMode: outputMode as import('./pair-cli.js').PairCliOutputMode,
+    outputMode: outputMode as import('../pairing/pair-cli.js').PairCliOutputMode,
   });
 
   if (outcome.status !== 'completed' && outcome.status !== 'canceled') {
@@ -333,12 +333,12 @@ async function cmdRemember(rawArgs: string[]): Promise<void> {
       authKeyHex: ctx.authKeyHex,
       walletAddress: ctx.walletAddress,
     };
-    const result = await submitFactBatchOnChain([protobuf], config);
+    const submitResult = await submitFactBatchOnChain([protobuf], config);
 
-    if (!result.success) {
+    if (!submitResult.success) {
       die(
         `remember failed: on-chain UserOp did not succeed (userOpHash=${
-          result.userOpHash || 'none'
+          submitResult.userOpHash || 'none'
         })`,
       );
     }
@@ -404,18 +404,18 @@ async function cmdForget(rawArgs: string[]): Promise<void> {
       authKeyHex: ctx.authKeyHex,
       walletAddress: ctx.walletAddress,
     };
-    const result = await submitFactBatchOnChain([protobuf], config);
+    const submitResult = await submitFactBatchOnChain([protobuf], config);
 
-    if (!result.success) {
+    if (!submitResult.success) {
       die(
         `forget failed: on-chain tombstone did not succeed (userOpHash=${
-          result.userOpHash || 'none'
+          submitResult.userOpHash || 'none'
         })`,
       );
     }
 
     if (jsonMode) {
-      log(JSON.stringify({ ok: true, id: factId, tx_hash: result.txHash }));
+      log(JSON.stringify({ ok: true, id: factId, tx_hash: submitResult.txHash }));
     } else {
       log(`ok — tombstoned ${factId} (tx=${result.txHash || 'pending'})`);
     }

package/{contradiction-sync.ts → contradiction/contradiction-sync.ts}

@@ -24,12 +24,12 @@ import {
   envNumber,
   envString,
   envStringLower,
-} from './entry.js';
+} from '../entry.js';
 import {
   computeEntityTrapdoor,
   isDigestBlob,
   type AutoResolveMode,
-} from './claims-helper.js';
+} from '../extraction/claims-helper.js';
 
 const requireWasm = createRequire(import.meta.url);
 let _wasm: typeof import('@totalreclaw/core') | null = null;
@@ -306,17 +306,17 @@ export interface CandidateClaim {
  */
 export function parseCandidateClaim(decryptedJson: string): CanonicalClaim | null {
   if (isDigestBlob(decryptedJson)) return null;
-  let obj: Record<string, unknown>;
+  let parsed: Record<string, unknown>;
   try {
-    obj = JSON.parse(decryptedJson) as Record<string, unknown>;
+    parsed = JSON.parse(decryptedJson) as Record<string, unknown>;
   } catch {
     return null;
   }
-  if (typeof obj.t !== 'string' || typeof obj.c !== 'string') return null;
+  if (typeof parsed.t !== 'string' || typeof parsed.c !== 'string') return null;
   // Filter out infra categories — digests and entity rollup claims are not
   // user-facing knowledge and must never be considered contradictions.
-  if (obj.c === 'dig' || obj.c === 'ent') return null;
-  return obj as CanonicalClaim;
+  if (parsed.c === 'dig' || parsed.c === 'ent') return null;
+  return parsed as CanonicalClaim;
 }
 
 /** Is this candidate claim pinned (status `p`)? Delegates to WASM core. */
@@ -1052,9 +1052,9 @@ export function findDecisionForPin(
 ): DecisionLogEntry | null {
   if (!logContent || logContent.length === 0) return null;
   try {
-    const result = getWasm().findDecisionForPin(factId, role, logContent);
-    if (result === 'null') return null;
-    return JSON.parse(result) as DecisionLogEntry;
+    const decisionJson = getWasm().findDecisionForPin(factId, role, logContent);
+    if (decisionJson === 'null') return null;
+    return JSON.parse(decisionJson) as DecisionLogEntry;
   } catch {
     // Fallback: local implementation if WASM fails.
     const lines = logContent.split('\n').filter((l) => l.length > 0);
@@ -1141,13 +1141,13 @@ export function buildFeedbackFromDecision(
 ): FeedbackEntry | null {
   if (!decision.winner_components || !decision.loser_components) return null;
   try {
-    const result = getWasm().buildFeedbackFromDecision(
+    const feedbackJson = getWasm().buildFeedbackFromDecision(
       JSON.stringify(decision),
       action,
       Math.floor(nowUnixSeconds),
     );
-    if (result === 'null') return null;
-    return JSON.parse(result) as FeedbackEntry;
+    if (feedbackJson === 'null') return null;
+    return JSON.parse(feedbackJson) as FeedbackEntry;
   } catch {
     // Fallback: local implementation if WASM fails.
     if (action === 'pin_loser') {

package/{digest-sync.ts → digest/digest-sync.ts}

@@ -21,7 +21,7 @@ import {
   isDigestStale,
   shouldRecompile,
   type DigestMode,
-} from './claims-helper.js';
+} from '../extraction/claims-helper.js';
 
 const requireWasm = createRequire(import.meta.url);
 let _wasm: typeof import('@totalreclaw/core') | null = null;
@@ -134,9 +134,30 @@ export function endRecompile(): void {
   _recompileInProgress = false;
 }
 
+/**
+ * Signature of the claim set that drove the last *scheduled* recompile —
+ * the recency probe's `maxCreatedAt` at the moment we called `recompileFn`.
+ * `null` means "no attempt yet", which is distinct from any real timestamp
+ * (including 0 for an empty vault), so the very first attempt is never
+ * mistaken for a repeat.
+ *
+ * Issue #455: a recompile's on-chain write (digest store + previous-digest
+ * tombstone) isn't visible to `loadLatestDigest` until the subgraph indexes
+ * it (can take ~20s). Every `before_agent_start` call in that window still
+ * sees the OLD digest against the SAME unchanged set of active claims, so
+ * `evaluateDigestState` keeps reporting stale+recompile and would fire a
+ * second (third, fourth…) UserOp for content that produces an identical
+ * digest. Tracking the signature we already acted on lets us skip those
+ * repeats while still recompiling the instant a genuinely newer claim
+ * (or a tombstone/supersession, which also bumps the recency probe's
+ * `maxCreatedAt`) shows up.
+ */
+let _lastRecompileSignature: number | null = null;
+
 /** Test-only helper to reset module state between cases. */
 export function __resetDigestSyncState(): void {
   _recompileInProgress = false;
+  _lastRecompileSignature = null;
 }
 
 // ---------------------------------------------------------------------------
@@ -562,7 +583,16 @@ export async function maybeInjectDigest(
   });
 
   if (state.stale && state.recompile && !isRecompileInProgress()) {
-    recompileFn(loaded.claimId);
+    // Coalesce: only fire if the claim set feeding the digest has actually
+    // moved since the last recompile we scheduled. Otherwise we're re-firing
+    // for the same content while the previous write is still propagating
+    // through subgraph indexing — see `_lastRecompileSignature` above.
+    if (probe.maxCreatedAt !== _lastRecompileSignature) {
+      _lastRecompileSignature = probe.maxCreatedAt;
+      recompileFn(loaded.claimId);
+    } else {
+      logger.info('Digest: skip recompile — claim set unchanged');
+    }
   }
 
   const promptText = typeof loaded.digest.prompt_text === 'string' ? loaded.digest.prompt_text : null;

package/dist/{billing-cache.js → billing/billing-cache.js}

@@ -26,7 +26,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from './config.js';
+import { CONFIG, setChainIdOverride, setDataEdgeAddressOverride } from '../config.js';
 /** A plausible EVM address — anything else from billing is ignored (#460). */
 const DATA_EDGE_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 // ---------------------------------------------------------------------------

package/dist/{relay-headers.js → billing/relay-headers.js}

@@ -17,7 +17,7 @@
  * runs (see internal#127). This helper is the canonical re-entry point for
  * the variable.
  */
-import { getSessionId } from './config.js';
+import { getSessionId } from '../config.js';
 /** Default `X-TotalReclaw-Client` value. */
 export const DEFAULT_CLIENT_ID = 'openclaw-plugin';
 /**

package/dist/{tr-cli-export-helper.js → cli/tr-cli-export-helper.js}

@@ -12,9 +12,9 @@
  * Phrase-safety: this module never touches the recovery phrase. It receives
  * pre-derived auth-key + wallet-address + encryption-key from the caller.
  */
-import { CONFIG } from './config.js';
-import { buildRelayHeaders } from './relay-headers.js';
-import { decrypt } from './crypto.js';
+import { CONFIG } from '../config.js';
+import { buildRelayHeaders } from '../billing/relay-headers.js';
+import { decrypt } from '../crypto/crypto.js';
 /** Decode a hex blob written by submitFactBatchOnChain back to plaintext. */
 function fromHexBlob(hexBlob, encryptionKey) {
     const hex = hexBlob.startsWith('0x') ? hexBlob.slice(2) : hexBlob;
@@ -71,8 +71,8 @@ export async function exportAllFacts(walletAddress, authKeyHex, encryptionKey) {
         const variables = hasLastId
             ? { owner: walletAddress, first: PAGE_SIZE, lastId }
             : { owner: walletAddress, first: PAGE_SIZE };
-        const data = await gql(query, variables);
-        const facts = data?.facts ?? [];
+        const subgraphResponse = await gql(query, variables);
+        const facts = subgraphResponse?.facts ?? [];
         if (facts.length === 0)
             break;
         for (const f of facts) {

package/dist/{tr-cli.js → cli/tr-cli.js}

@@ -31,16 +31,16 @@
  * --json flag: all agent-facing CLI calls MUST use --json for clean machine-parseable output.
  *              Plain text mode is for direct user CLI use only.
  *
- * Install: wired via package.json `bin.tr` → dist/tr-cli.js
- * Usage from container: `docker exec tr-openclaw node ~/.openclaw/extensions/totalreclaw/dist/tr-cli.js status --json`
+ * Install: wired via package.json `bin.tr` → dist/cli/tr-cli.js
+ * Usage from container: `docker exec tr-openclaw node ~/.openclaw/extensions/totalreclaw/dist/cli/tr-cli.js status --json`
  */
 import { randomUUID } from 'node:crypto';
-import { CONFIG, setRecoveryPhraseOverride } from './config.js';
-import { loadCredentialsJson } from './fs-helpers.js';
-import { printStatus } from './onboarding-cli.js';
-import { deriveKeys, computeAuthKeyHash, encrypt, generateBlindIndices, generateContentFingerprint, } from './crypto.js';
-import { createApiClient } from './api-client.js';
-import { encodeFactProtobuf, submitFactBatchOnChain, deriveSmartAccountAddress, getSubgraphConfig, PROTOBUF_VERSION_V4, } from './subgraph-store.js';
+import { CONFIG, setRecoveryPhraseOverride } from '../config.js';
+import { loadCredentialsJson } from '../fs-helpers.js';
+import { printStatus } from '../pairing/onboarding-cli.js';
+import { deriveKeys, computeAuthKeyHash, encrypt, generateBlindIndices, generateContentFingerprint, } from '../crypto/crypto.js';
+import { createApiClient } from '../billing/api-client.js';
+import { encodeFactProtobuf, submitFactBatchOnChain, deriveSmartAccountAddress, getSubgraphConfig, PROTOBUF_VERSION_V4, } from '../subgraph/subgraph-store.js';
 import { exportAllFacts } from './tr-cli-export-helper.js';
 // ---------------------------------------------------------------------------
 // Helpers
@@ -51,7 +51,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.23';
+const PLUGIN_VERSION = '3.3.13-rc.1';
 function die(msg, code = 1) {
     process.stderr.write(`tr: ${msg}\n`);
     process.exit(code);
@@ -85,7 +85,7 @@ function toHexBlob(plaintext, encryptionKey) {
 async function buildContext() {
     const creds = loadCredentialsJson(CREDENTIALS_PATH);
     if (!creds) {
-        die('TotalReclaw is not set up. Run: node ~/.openclaw/extensions/totalreclaw/dist/tr-cli.js pair --json');
+        die('TotalReclaw is not set up. Run: node ~/.openclaw/extensions/totalreclaw/dist/cli/tr-cli.js pair --json');
     }
     const mnemonic = (typeof creds.mnemonic === 'string' && creds.mnemonic.trim()) ||
         (typeof creds.recovery_phrase === 'string' && creds.recovery_phrase.trim()) ||
@@ -192,8 +192,8 @@ async function cmdPair(args) {
     // The pair flow is relay-brokered (works through Docker NAT).
     // Phrase-safety: pair-cli-relay.ts is x25519-only; mnemonic never appears.
     const outputMode = args.includes('--json') ? 'json' : args.includes('--url-pin') ? 'url-pin' : 'human';
-    const { runRelayPairCli } = await import('./pair-cli-relay.js');
-    const { defaultRenderQr, buildDefaultPairCliIo } = await import('./pair-cli.js');
+    const { runRelayPairCli } = await import('../pairing/pair-cli-relay.js');
+    const { defaultRenderQr, buildDefaultPairCliIo } = await import('../pairing/pair-cli.js');
     const io = buildDefaultPairCliIo();
     const outcome = await runRelayPairCli('generate', {
         relayBaseUrl: CONFIG.pairRelayUrl,
@@ -271,9 +271,9 @@ async function cmdRemember(rawArgs) {
             authKeyHex: ctx.authKeyHex,
             walletAddress: ctx.walletAddress,
         };
-        const result = await submitFactBatchOnChain([protobuf], config);
-        if (!result.success) {
-            die(`remember failed: on-chain UserOp did not succeed (userOpHash=${result.userOpHash || 'none'})`);
+        const submitResult = await submitFactBatchOnChain([protobuf], config);
+        if (!submitResult.success) {
+            die(`remember failed: on-chain UserOp did not succeed (userOpHash=${submitResult.userOpHash || 'none'})`);
         }
         if (jsonMode) {
             // JSON-first output for agent parsing.
@@ -331,12 +331,12 @@ async function cmdForget(rawArgs) {
             authKeyHex: ctx.authKeyHex,
             walletAddress: ctx.walletAddress,
         };
-        const result = await submitFactBatchOnChain([protobuf], config);
-        if (!result.success) {
-            die(`forget failed: on-chain tombstone did not succeed (userOpHash=${result.userOpHash || 'none'})`);
+        const submitResult = await submitFactBatchOnChain([protobuf], config);
+        if (!submitResult.success) {
+            die(`forget failed: on-chain tombstone did not succeed (userOpHash=${submitResult.userOpHash || 'none'})`);
         }
         if (jsonMode) {
-            log(JSON.stringify({ ok: true, id: factId, tx_hash: result.txHash }));
+            log(JSON.stringify({ ok: true, id: factId, tx_hash: submitResult.txHash }));
         }
         else {
             log(`ok — tombstoned ${factId} (tx=${result.txHash || 'pending'})`);

package/dist/{contradiction-sync.js → contradiction/contradiction-sync.js}

@@ -17,8 +17,8 @@
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
-import { envHomedir, envNumber, envString, envStringLower, } from './entry.js';
-import { computeEntityTrapdoor, isDigestBlob, } from './claims-helper.js';
+import { envHomedir, envNumber, envString, envStringLower, } from '../entry.js';
+import { computeEntityTrapdoor, isDigestBlob, } from '../extraction/claims-helper.js';
 const requireWasm = createRequire(import.meta.url);
 let _wasm = null;
 function getWasm() {
@@ -153,20 +153,20 @@ export async function saveWeightsFile(file) {
 export function parseCandidateClaim(decryptedJson) {
     if (isDigestBlob(decryptedJson))
         return null;
-    let obj;
+    let parsed;
     try {
-        obj = JSON.parse(decryptedJson);
+        parsed = JSON.parse(decryptedJson);
     }
     catch {
         return null;
     }
-    if (typeof obj.t !== 'string' || typeof obj.c !== 'string')
+    if (typeof parsed.t !== 'string' || typeof parsed.c !== 'string')
         return null;
     // Filter out infra categories — digests and entity rollup claims are not
     // user-facing knowledge and must never be considered contradictions.
-    if (obj.c === 'dig' || obj.c === 'ent')
+    if (parsed.c === 'dig' || parsed.c === 'ent')
         return null;
-    return obj;
+    return parsed;
 }
 /** Is this candidate claim pinned (status `p`)? Delegates to WASM core. */
 export function isPinnedClaim(claim) {
@@ -715,10 +715,10 @@ export function findDecisionForPin(factId, role, logContent) {
     if (!logContent || logContent.length === 0)
         return null;
     try {
-        const result = getWasm().findDecisionForPin(factId, role, logContent);
-        if (result === 'null')
+        const decisionJson = getWasm().findDecisionForPin(factId, role, logContent);
+        if (decisionJson === 'null')
             return null;
-        return JSON.parse(result);
+        return JSON.parse(decisionJson);
     }
     catch {
         // Fallback: local implementation if WASM fails.
@@ -812,10 +812,10 @@ export function buildFeedbackFromDecision(decision, action, nowUnixSeconds) {
     if (!decision.winner_components || !decision.loser_components)
         return null;
     try {
-        const result = getWasm().buildFeedbackFromDecision(JSON.stringify(decision), action, Math.floor(nowUnixSeconds));
-        if (result === 'null')
+        const feedbackJson = getWasm().buildFeedbackFromDecision(JSON.stringify(decision), action, Math.floor(nowUnixSeconds));
+        if (feedbackJson === 'null')
             return null;
-        return JSON.parse(result);
+        return JSON.parse(feedbackJson);
     }
     catch {
         // Fallback: local implementation if WASM fails.

package/dist/{digest-sync.js → digest/digest-sync.js}

@@ -11,7 +11,7 @@
  * distinctive blind-index marker `DIGEST_TRAPDOOR`.
  */
 import { createRequire } from 'node:module';
-import { DIGEST_CLAIM_CAP, DIGEST_TRAPDOOR, buildDigestClaim, extractDigestFromClaim, hoursSince, isDigestStale, shouldRecompile, } from './claims-helper.js';
+import { DIGEST_CLAIM_CAP, DIGEST_TRAPDOOR, buildDigestClaim, extractDigestFromClaim, hoursSince, isDigestStale, shouldRecompile, } from '../extraction/claims-helper.js';
 const requireWasm = createRequire(import.meta.url);
 let _wasm = null;
 function getWasm() {
@@ -76,9 +76,29 @@ export function tryBeginRecompile() {
 export function endRecompile() {
     _recompileInProgress = false;
 }
+/**
+ * Signature of the claim set that drove the last *scheduled* recompile —
+ * the recency probe's `maxCreatedAt` at the moment we called `recompileFn`.
+ * `null` means "no attempt yet", which is distinct from any real timestamp
+ * (including 0 for an empty vault), so the very first attempt is never
+ * mistaken for a repeat.
+ *
+ * Issue #455: a recompile's on-chain write (digest store + previous-digest
+ * tombstone) isn't visible to `loadLatestDigest` until the subgraph indexes
+ * it (can take ~20s). Every `before_agent_start` call in that window still
+ * sees the OLD digest against the SAME unchanged set of active claims, so
+ * `evaluateDigestState` keeps reporting stale+recompile and would fire a
+ * second (third, fourth…) UserOp for content that produces an identical
+ * digest. Tracking the signature we already acted on lets us skip those
+ * repeats while still recompiling the instant a genuinely newer claim
+ * (or a tombstone/supersession, which also bumps the recency probe's
+ * `maxCreatedAt`) shows up.
+ */
+let _lastRecompileSignature = null;
 /** Test-only helper to reset module state between cases. */
 export function __resetDigestSyncState() {
     _recompileInProgress = false;
+    _lastRecompileSignature = null;
 }
 // ---------------------------------------------------------------------------
 // Pure staleness + guard evaluation
@@ -351,7 +371,17 @@ export async function maybeInjectDigest(input) {
         hoursSinceCompilation: hoursSince(compiledAt, nowMs),
     });
     if (state.stale && state.recompile && !isRecompileInProgress()) {
-        recompileFn(loaded.claimId);
+        // Coalesce: only fire if the claim set feeding the digest has actually
+        // moved since the last recompile we scheduled. Otherwise we're re-firing
+        // for the same content while the previous write is still propagating
+        // through subgraph indexing — see `_lastRecompileSignature` above.
+        if (probe.maxCreatedAt !== _lastRecompileSignature) {
+            _lastRecompileSignature = probe.maxCreatedAt;
+            recompileFn(loaded.claimId);
+        }
+        else {
+            logger.info('Digest: skip recompile — claim set unchanged');
+        }
     }
     const promptText = typeof loaded.digest.prompt_text === 'string' ? loaded.digest.prompt_text : null;
     return {

package/dist/{download-ux.js → embedding/download-ux.js}

@@ -13,7 +13,7 @@
  * Env read is centralized in entry.ts (env-reading seam, Task 1.3 of the
  * OpenClaw native integration plan, 2026-06-21).
  */
-import { envNumber } from './entry.js';
+import { envNumber } from '../entry.js';
 const DEFAULT_DOWNLOAD_TIMEOUT_MS = 600_000;
 const KEEPALIVE_INTERVAL_MS = 60_000;
 const MAX_DOWNLOAD_ATTEMPTS = 3;

package/dist/{reranker.js → embedding/reranker.js}

@@ -21,12 +21,16 @@
  * Compute cosine similarity between two vectors.
  *
  * Returns dot(a, b) / (||a|| * ||b||).
- * Returns 0 if either vector has zero magnitude (avoids division by zero).
+ * Returns 0 if either vector has zero magnitude (avoids division by zero),
+ * or if the vectors differ in length — matching the authoritative core impl
+ * `cosine_similarity_f32` (rust/totalreclaw-core), which rejects mismatched
+ * dimensions rather than truncating to the shorter length. Keeping this local
+ * fallback byte-for-byte with core preserves cross-runtime rerank parity.
  */
 export function cosineSimilarity(a, b) {
-    if (a.length === 0 || b.length === 0)
+    if (a.length !== b.length || a.length === 0)
         return 0;
-    const len = Math.min(a.length, b.length);
+    const len = a.length;
     let dot = 0;
     let normA = 0;
     let normB = 0;
@@ -204,10 +208,15 @@ const SOURCE_WEIGHTS = {
 };
 const LEGACY_FALLBACK_WEIGHT = 0.85;
 export function getSourceWeight(source) {
+    // Missing source → legacy fallback (0.85), matching core's None path.
     if (!source)
         return LEGACY_FALLBACK_WEIGHT;
     const w = SOURCE_WEIGHTS[source.toLowerCase()];
-    return w ?? 0.85; // unknown source → moderate penalty
+    // An unknown NON-EMPTY source string mirrors core's
+    // `MemorySource::from_str_lossy`, whose catch-all arm maps any unrecognized
+    // token to `user-inferred` (rust/totalreclaw-core/src/claims.rs) — so an
+    // unknown string weighs the same as user-inferred, NOT the legacy fallback.
+    return w ?? SOURCE_WEIGHTS['user-inferred'];
 }
 // ---------------------------------------------------------------------------
 // Recency Scoring