@wastedcode/memex 0.1.0

package/dist/standalone/memex.mjs

@@ -0,0 +1,2313 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/daemon/db.ts
+import BetterSqlite3 from "better-sqlite3";
+var Database;
+var init_db = __esm({
+  "src/daemon/db.ts"() {
+    "use strict";
+    Database = class {
+      db;
+      constructor(dbPath) {
+        this.db = new BetterSqlite3(dbPath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.pragma("foreign_keys = ON");
+      }
+      // ── Schema ───────────────────────────────────────────────────────────────
+      initialize() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS wikis (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        owner_uid INTEGER NOT NULL,
+        default_model TEXT NOT NULL DEFAULT 'sonnet',
+        created_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS queue_jobs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        wiki_id TEXT NOT NULL REFERENCES wikis(id) ON DELETE CASCADE,
+        type TEXT NOT NULL,
+        payload TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'pending',
+        retry_count INTEGER NOT NULL DEFAULT 0,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        started_at TEXT,
+        completed_at TEXT,
+        result TEXT
+      );
+
+      CREATE TABLE IF NOT EXISTS audit_log (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        wiki_id TEXT NOT NULL REFERENCES wikis(id) ON DELETE CASCADE,
+        action TEXT NOT NULL,
+        detail TEXT,
+        created_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_queue_wiki_status
+        ON queue_jobs(wiki_id, status);
+      CREATE INDEX IF NOT EXISTS idx_audit_wiki
+        ON audit_log(wiki_id);
+      CREATE INDEX IF NOT EXISTS idx_audit_created
+        ON audit_log(created_at);
+    `);
+      }
+      close() {
+        this.db.close();
+      }
+      // ── Wikis ───────────────────────────────────────────────────────────────
+      createWiki(id, name, ownerUid) {
+        const stmt = this.db.prepare(`
+      INSERT INTO wikis (id, name, owner_uid) VALUES (?, ?, ?)
+      RETURNING *
+    `);
+        return stmt.get(id, name, ownerUid);
+      }
+      getWiki(id) {
+        return this.db.prepare("SELECT * FROM wikis WHERE id = ?").get(id);
+      }
+      listWikis(ownerUid) {
+        if (ownerUid !== void 0) {
+          return this.db.prepare("SELECT * FROM wikis WHERE owner_uid = ? ORDER BY created_at").all(ownerUid);
+        }
+        return this.db.prepare("SELECT * FROM wikis ORDER BY created_at").all();
+      }
+      chownWiki(id, newOwnerUid) {
+        const stmt = this.db.prepare(
+          "UPDATE wikis SET owner_uid = ? WHERE id = ? RETURNING *"
+        );
+        return stmt.get(newOwnerUid, id);
+      }
+      updateWiki(id, config) {
+        const sets = [];
+        const values = [];
+        if (config.name !== void 0) {
+          sets.push("name = ?");
+          values.push(config.name);
+        }
+        if (config.default_model !== void 0) {
+          sets.push("default_model = ?");
+          values.push(config.default_model);
+        }
+        if (sets.length === 0) {
+          return this.getWiki(id);
+        }
+        values.push(id);
+        const stmt = this.db.prepare(
+          `UPDATE wikis SET ${sets.join(", ")} WHERE id = ? RETURNING *`
+        );
+        return stmt.get(...values);
+      }
+      deleteWiki(id) {
+        this.db.prepare("DELETE FROM wikis WHERE id = ?").run(id);
+      }
+      // ── Jobs ─────────────────────────────────────────────────────────────────
+      createJob(wikiId, type, payload) {
+        const stmt = this.db.prepare(`
+      INSERT INTO queue_jobs (wiki_id, type, payload)
+      VALUES (?, ?, ?)
+      RETURNING *
+    `);
+        return stmt.get(wikiId, type, JSON.stringify(payload));
+      }
+      getJob(jobId) {
+        return this.db.prepare("SELECT * FROM queue_jobs WHERE id = ?").get(jobId);
+      }
+      listJobs(wikiId, opts) {
+        let sql = "SELECT * FROM queue_jobs WHERE wiki_id = ?";
+        const params = [wikiId];
+        if (opts?.status) {
+          sql += " AND status = ?";
+          params.push(opts.status);
+        }
+        sql += " ORDER BY id DESC";
+        if (opts?.limit) {
+          sql += " LIMIT ?";
+          params.push(opts.limit);
+        }
+        return this.db.prepare(sql).all(...params);
+      }
+      /**
+       * Atomically claim the next pending job for a wiki.
+       * Sets status to 'running' and records started_at.
+       */
+      claimNextJob(wikiId) {
+        const stmt = this.db.prepare(`
+      UPDATE queue_jobs
+      SET status = 'running', started_at = datetime('now')
+      WHERE id = (
+        SELECT id FROM queue_jobs
+        WHERE wiki_id = ? AND status = 'pending'
+        ORDER BY id ASC
+        LIMIT 1
+      )
+      RETURNING *
+    `);
+        return stmt.get(wikiId);
+      }
+      completeJob(jobId, result) {
+        this.db.prepare(`
+      UPDATE queue_jobs
+      SET status = 'completed', completed_at = datetime('now'), result = ?
+      WHERE id = ?
+    `).run(JSON.stringify(result), jobId);
+      }
+      failJob(jobId, error) {
+        this.db.prepare(`
+      UPDATE queue_jobs
+      SET status = 'failed', completed_at = datetime('now'), result = ?
+      WHERE id = ?
+    `).run(JSON.stringify({ success: false, error }), jobId);
+      }
+      getPendingJobCount(wikiId) {
+        const row = this.db.prepare(
+          "SELECT COUNT(*) as count FROM queue_jobs WHERE wiki_id = ? AND status IN ('pending', 'running')"
+        ).get(wikiId);
+        return row.count;
+      }
+      /**
+       * On daemon startup: reset jobs that were 'running' when the process died.
+       * They get re-queued as 'pending'.
+       */
+      resetStaleJobs() {
+        const info = this.db.prepare(`
+      UPDATE queue_jobs
+      SET status = 'pending', retry_count = retry_count + 1
+      WHERE status = 'running'
+    `).run();
+        return info.changes;
+      }
+      /** Get wiki IDs that have pending jobs (for startup drain). */
+      wikisWithPendingJobs() {
+        const rows = this.db.prepare(
+          "SELECT DISTINCT wiki_id FROM queue_jobs WHERE status = 'pending'"
+        ).all();
+        return rows.map((r) => r.wiki_id);
+      }
+      // ── Audit ────────────────────────────────────────────────────────────────
+      logAudit(wikiId, action, detail) {
+        this.db.prepare(
+          "INSERT INTO audit_log (wiki_id, action, detail) VALUES (?, ?, ?)"
+        ).run(wikiId, action, detail ?? null);
+      }
+      getAuditLog(wikiId, limit = 50) {
+        return this.db.prepare(
+          "SELECT * FROM audit_log WHERE wiki_id = ? ORDER BY id DESC LIMIT ?"
+        ).all(wikiId, limit);
+      }
+    };
+  }
+});
+
+// src/lib/errors.ts
+var MemexError, WikiNotFoundError, WikiExistsError, JobNotFoundError, CapabilityError, NoCredentialsError, ForbiddenError, ValidationError, DaemonNotRunningError;
+var init_errors = __esm({
+  "src/lib/errors.ts"() {
+    "use strict";
+    MemexError = class extends Error {
+      constructor(message, code, statusCode = 500) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.name = "MemexError";
+      }
+      code;
+      statusCode;
+    };
+    WikiNotFoundError = class extends MemexError {
+      constructor(wikiId) {
+        super(`Wiki '${wikiId}' not found`, "WIKI_NOT_FOUND", 404);
+      }
+    };
+    WikiExistsError = class extends MemexError {
+      constructor(wikiId) {
+        super(`Wiki '${wikiId}' already exists`, "WIKI_EXISTS", 409);
+      }
+    };
+    JobNotFoundError = class extends MemexError {
+      constructor(jobId) {
+        super(`Job #${jobId} not found`, "JOB_NOT_FOUND", 404);
+      }
+    };
+    CapabilityError = class extends MemexError {
+      constructor() {
+        super(
+          "CAP_SYS_ADMIN is required for mount namespace isolation.\nOptions:\n  1. Run the daemon as root: sudo memex serve\n  2. Use systemd with AmbientCapabilities=CAP_SYS_ADMIN\n  3. Grant capability: sudo setcap cap_sys_admin+ep $(which node)",
+          "NO_CAP_SYS_ADMIN",
+          500
+        );
+      }
+    };
+    NoCredentialsError = class extends MemexError {
+      constructor(wikiId) {
+        super(
+          `No credentials configured for wiki '${wikiId}'.
+Set credentials with:
+  memex login ${wikiId}          (OAuth)
+  memex config ${wikiId} --set-key  (API key)`,
+          "NO_CREDENTIALS",
+          400
+        );
+      }
+    };
+    ForbiddenError = class extends MemexError {
+      constructor(wikiId) {
+        super(`Access denied to wiki '${wikiId}'`, "FORBIDDEN", 403);
+      }
+    };
+    ValidationError = class extends MemexError {
+      constructor(message) {
+        super(message, "VALIDATION_ERROR", 400);
+      }
+    };
+    DaemonNotRunningError = class extends MemexError {
+      constructor() {
+        super(
+          "Cannot connect to memex daemon.\nStart it with: memex serve",
+          "DAEMON_NOT_RUNNING",
+          502
+        );
+      }
+    };
+  }
+});
+
+// src/lib/constants.ts
+var DATA_DIR, RUN_DIR, SOCKET_PATH, DB_PATH, WIKIS_DIR, NS_DIR, WORKSPACE_MOUNT, JOB_LIMITS, SIGTERM_GRACE_MS, AUTO_LINT_INTERVAL, JOB_POLL_INTERVAL_MS, DEFAULT_MODEL, BASE_ALLOWED_TOOLS, ALLOWED_TOOLS_WHITELIST, WIKI_ID_PATTERN;
+var init_constants = __esm({
+  "src/lib/constants.ts"() {
+    "use strict";
+    DATA_DIR = process.env["MEMEX_DATA_DIR"] ?? "/var/lib/memex";
+    RUN_DIR = process.env["MEMEX_RUN_DIR"] ?? "/run/memex";
+    SOCKET_PATH = process.env["MEMEX_SOCKET_PATH"] ?? `${RUN_DIR}/memex.sock`;
+    DB_PATH = `${DATA_DIR}/memex.db`;
+    WIKIS_DIR = `${DATA_DIR}/wikis`;
+    NS_DIR = `${RUN_DIR}/ns`;
+    WORKSPACE_MOUNT = "/workspace";
+    JOB_LIMITS = {
+      ingest: { timeout_ms: 5 * 6e4, max_turns: 25 },
+      query: { timeout_ms: 2 * 6e4, max_turns: 15 },
+      lint: { timeout_ms: 10 * 6e4, max_turns: 30 }
+    };
+    SIGTERM_GRACE_MS = 5e3;
+    AUTO_LINT_INTERVAL = 10;
+    JOB_POLL_INTERVAL_MS = 500;
+    DEFAULT_MODEL = "sonnet";
+    BASE_ALLOWED_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep"];
+    ALLOWED_TOOLS_WHITELIST = /* @__PURE__ */ new Set([
+      "Read",
+      "Write",
+      "Edit",
+      "Glob",
+      "Grep",
+      "NotebookEdit",
+      "WebFetch",
+      "WebSearch"
+    ]);
+    WIKI_ID_PATTERN = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
+  }
+});
+
+// src/daemon/namespace.ts
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+function shellEscape(s) {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+var NamespaceManager;
+var init_namespace = __esm({
+  "src/daemon/namespace.ts"() {
+    "use strict";
+    init_errors();
+    init_constants();
+    NamespaceManager = class {
+      constructor(wikisDir = WIKIS_DIR) {
+        this.wikisDir = wikisDir;
+      }
+      wikisDir;
+      /**
+       * Verify that we have CAP_SYS_ADMIN by attempting a trivial namespace operation.
+       */
+      checkCapabilities() {
+        try {
+          execFileSync("unshare", ["-m", "--", "true"], { stdio: "pipe" });
+        } catch {
+          throw new CapabilityError();
+        }
+      }
+      /**
+       * Ensure the /workspace mount target exists on the host.
+       */
+      ensureDirectories() {
+        mkdirSync(WORKSPACE_MOUNT, { recursive: true });
+      }
+      /**
+       * Verify a wiki's directory exists.
+       */
+      validateWiki(wikiId) {
+        const wikiDir = join(this.wikisDir, wikiId);
+        if (!existsSync(wikiDir)) {
+          throw new Error(`Wiki directory does not exist: ${wikiDir}`);
+        }
+      }
+      /**
+       * Build the command + args to run a command inside a fresh mount namespace
+       * with the wiki's directory bind-mounted to /workspace.
+       *
+       * Returns [command, ...args] to pass to spawn().
+       * The caller appends their actual command (e.g. claude -p ...) to innerArgs.
+       */
+      wrapCommand(wikiId, innerCommand) {
+        const wikiDir = join(this.wikisDir, wikiId);
+        const script = [
+          `mount --bind ${shellEscape(wikiDir)} ${shellEscape(WORKSPACE_MOUNT)}`,
+          `mount -o remount,nosuid,nodev ${shellEscape(WORKSPACE_MOUNT)}`,
+          `cd ${shellEscape(WORKSPACE_MOUNT)}`,
+          `exec ${innerCommand.map(shellEscape).join(" ")}`
+        ].join(" && ");
+        return {
+          command: "unshare",
+          args: ["-m", "--propagation", "private", "--", "sh", "-c", script]
+        };
+      }
+    };
+  }
+});
+
+// src/daemon/scaffold.ts
+import { mkdirSync as mkdirSync2, writeFileSync, rmSync, readFileSync, existsSync as existsSync2 } from "node:fs";
+import { join as join2, basename } from "node:path";
+function sanitizeFilename(name) {
+  return name.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+var DEFAULT_CLAUDE_MD, DEFAULT_SCHEMA_MD, DEFAULT_INDEX_MD, DEFAULT_LOG_MD, WikiScaffold;
+var init_scaffold = __esm({
+  "src/daemon/scaffold.ts"() {
+    "use strict";
+    init_constants();
+    DEFAULT_CLAUDE_MD = `# Wiki Agent \u2014 Conventions
+
+This file is auto-discovered by Claude Code and extends the base system prompt.
+Use it to define wiki-specific conventions, domain vocabulary, and wiki structure.
+
+The base system prompt handles core wiki behavior (index, schema, connections, log).
+This file is for YOUR customizations on top of that.
+
+## Domain
+
+_(Describe what this knowledge base is about)_
+
+## Conventions
+
+_(Add wiki-specific filing rules, vocabulary, categories, and preferences here)_
+
+## Things to ignore
+
+_(Topics, patterns, or noise that should be skipped during ingestion)_
+`;
+    DEFAULT_SCHEMA_MD = `# Schema
+
+This file documents the conventions for this knowledge base.
+It will be created and maintained by the wiki agent as content is ingested.
+
+_(This is a new knowledge base. The schema will be populated on first ingest.)_
+`;
+    DEFAULT_INDEX_MD = `# Index
+
+One-line summary of every wiki page, organized by category.
+A reader should understand the shape of the knowledge base from this file alone.
+
+_(No pages yet. The index will be populated as content is ingested.)_
+`;
+    DEFAULT_LOG_MD = `# Activity Log
+
+Chronological record of knowledge base activity.
+
+---
+`;
+    WikiScaffold = class {
+      constructor(wikisDir = WIKIS_DIR) {
+        this.wikisDir = wikisDir;
+      }
+      wikisDir;
+      /**
+       * Create the full directory structure and default files for a new wiki.
+       */
+      create(wikiId) {
+        const base = this.wikiDir(wikiId);
+        mkdirSync2(join2(base, ".claude"), { recursive: true, mode: 448 });
+        mkdirSync2(join2(base, ".tools"), { recursive: true });
+        mkdirSync2(join2(base, "wiki", "raw"), { recursive: true });
+        writeFileSync(join2(base, ".claude.md"), DEFAULT_CLAUDE_MD);
+        writeFileSync(join2(base, "wiki", "_schema.md"), DEFAULT_SCHEMA_MD);
+        writeFileSync(join2(base, "wiki", "_index.md"), DEFAULT_INDEX_MD);
+        writeFileSync(join2(base, "wiki", "_log.md"), DEFAULT_LOG_MD);
+      }
+      /**
+       * Remove a wiki's directory tree.
+       */
+      destroy(wikiId, keepData = false) {
+        if (keepData) return;
+        const dir = this.wikiDir(wikiId);
+        if (existsSync2(dir)) {
+          rmSync(dir, { recursive: true, force: true });
+        }
+      }
+      /**
+       * Get the host filesystem path for a wiki's root directory.
+       */
+      wikiDir(wikiId) {
+        return join2(this.wikisDir, wikiId);
+      }
+      /**
+       * Write a file into the wiki's wiki/raw/ directory.
+       * Prefixes with a timestamp to avoid collisions.
+       * Returns the stored filename (relative to wiki/raw/).
+       */
+      writeRawFile(wikiId, filename, content) {
+        const rawDir = join2(this.wikiDir(wikiId), "wiki", "raw");
+        mkdirSync2(rawDir, { recursive: true });
+        const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "");
+        const stored = `${ts}-${sanitizeFilename(basename(filename))}`;
+        writeFileSync(join2(rawDir, stored), content);
+        return stored;
+      }
+      /**
+       * Read the wiki's .claude.md content.
+       */
+      readClaudeMd(wikiId) {
+        const p = join2(this.wikiDir(wikiId), ".claude.md");
+        if (!existsSync2(p)) return "";
+        return readFileSync(p, "utf-8");
+      }
+      /**
+       * Write the allowed-tools.txt file for a wiki.
+       */
+      writeAllowedTools(wikiId, tools) {
+        const toolsDir = join2(this.wikiDir(wikiId), ".tools");
+        mkdirSync2(toolsDir, { recursive: true });
+        const content = tools.length > 0 ? tools.join("\n") + "\n" : "";
+        writeFileSync(join2(toolsDir, "allowed-tools.txt"), content);
+      }
+      /**
+       * Read the current allowed-tools.txt for a wiki.
+       */
+      readAllowedTools(wikiId) {
+        const p = join2(this.wikiDir(wikiId), ".tools", "allowed-tools.txt");
+        if (!existsSync2(p)) return [];
+        return readFileSync(p, "utf-8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#"));
+      }
+      /**
+       * Check if a wiki directory exists on disk.
+       */
+      exists(wikiId) {
+        return existsSync2(this.wikiDir(wikiId));
+      }
+    };
+  }
+});
+
+// src/daemon/auth.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+var AuthManager;
+var init_auth = __esm({
+  "src/daemon/auth.ts"() {
+    "use strict";
+    init_constants();
+    init_errors();
+    AuthManager = class {
+      constructor(wikisDir = WIKIS_DIR, globalApiKey) {
+        this.wikisDir = wikisDir;
+        this.globalApiKey = globalApiKey;
+      }
+      wikisDir;
+      globalApiKey;
+      /**
+       * Resolve credentials for a wiki, returning environment variables
+       * to set on the claude child process.
+       *
+       * Priority:
+       *   1. Per-wiki API key file (.claude/api-key)
+       *   2. Per-wiki OAuth credentials (.claude/.credentials.json exists)
+       *   3. Global ANTHROPIC_API_KEY from daemon environment
+       */
+      resolveCredentials(wikiId) {
+        const claudeDir = this.configDir(wikiId);
+        const apiKeyPath = join3(claudeDir, "api-key");
+        if (existsSync3(apiKeyPath)) {
+          const key = readFileSync2(apiKeyPath, "utf-8").trim();
+          if (key) {
+            return {
+              ANTHROPIC_API_KEY: key,
+              CLAUDE_CONFIG_DIR: claudeDir
+            };
+          }
+        }
+        const credsPath = join3(claudeDir, ".credentials.json");
+        if (existsSync3(credsPath)) {
+          return {
+            CLAUDE_CONFIG_DIR: claudeDir
+          };
+        }
+        if (this.globalApiKey) {
+          return {
+            ANTHROPIC_API_KEY: this.globalApiKey,
+            CLAUDE_CONFIG_DIR: claudeDir
+          };
+        }
+        throw new NoCredentialsError(wikiId);
+      }
+      /**
+       * Store an API key for a wiki.
+       */
+      setApiKey(wikiId, key) {
+        const claudeDir = this.configDir(wikiId);
+        mkdirSync3(claudeDir, { recursive: true, mode: 448 });
+        const apiKeyPath = join3(claudeDir, "api-key");
+        writeFileSync2(apiKeyPath, key.trim(), { mode: 384 });
+      }
+      /**
+       * Get the CLAUDE_CONFIG_DIR path for a wiki.
+       */
+      configDir(wikiId) {
+        return join3(this.wikisDir, wikiId, ".claude");
+      }
+      /**
+       * Store OAuth credentials for a wiki by copying .credentials.json content.
+       */
+      setCredentials(wikiId, credentialsJson) {
+        const claudeDir = this.configDir(wikiId);
+        mkdirSync3(claudeDir, { recursive: true, mode: 448 });
+        const credsPath = join3(claudeDir, ".credentials.json");
+        writeFileSync2(credsPath, credentialsJson, { mode: 384 });
+      }
+      /**
+       * Check if a wiki has valid credentials (any method).
+       */
+      hasCredentials(wikiId) {
+        const claudeDir = this.configDir(wikiId);
+        const apiKeyPath = join3(claudeDir, "api-key");
+        const credsPath = join3(claudeDir, ".credentials.json");
+        return existsSync3(apiKeyPath) || existsSync3(credsPath) || !!this.globalApiKey;
+      }
+    };
+  }
+});
+
+// src/lib/prompts/ingest.ts
+function buildIngestPrompt(payload) {
+  const fileList = payload.files.map((f) => `- raw/${f}`).join("\n");
+  return `New source documents have been added to the knowledge base.
+
+Source files to process:
+${fileList}
+
+Integrate these into the wiki:
+
+1. Read each source file listed above.
+2. Read _schema.md for current conventions (create it if it doesn't exist \u2014 this is a new knowledge base).
+3. Read _index.md to see what's already filed.
+4. Search existing wiki pages for related content (grep for names, topics, themes).
+5. For each source document:
+   a. Extract key facts, concepts, entities, and relationships.
+   b. Determine which existing pages should be updated and which new pages should be created.
+   c. Create or update wiki pages with the extracted information.
+   d. Maintain bidirectional links \u2014 if you link A\u2192B, update B\u2192A too.
+   e. Update _index.md with current summaries for all affected pages.
+6. Append a dated ingest entry to _log.md summarizing what was ingested and what pages were affected.
+
+Rules:
+- NEVER modify files in raw/ \u2014 they are immutable sources
+- Prefer updating existing pages over creating duplicates
+- If a source contradicts existing wiki content, UPDATE the existing page \u2014 resolve or flag the contradiction
+- Keep pages focused \u2014 one topic per page
+- Use descriptive kebab-case paths: themes/pricing-feedback.md, customers/acme-corp.md
+- Every page must have a ## Related section with labeled, bidirectional links
+- The "reason" for each change should articulate what it ADDS to the knowledge base \u2014 not mechanics
+
+After completing all file operations, output ONLY valid JSON (no markdown fences, no explanation):
+{
+  "summary": "one-line human summary of what you filed",
+  "operations": [
+    {"action": "create|update", "path": "relative/path.md", "reason": "what this adds to the knowledge base"}
+  ]
+}`;
+}
+var init_ingest = __esm({
+  "src/lib/prompts/ingest.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/prompts/query.ts
+function buildQueryPrompt(payload) {
+  let prompt = `You are the voice of a living knowledge base. Answer the user's question by searching the wiki files in this directory.
+
+Question: ${payload.question}
+
+RULES:
+1. ONLY reference information that exists in the wiki files. Never use training data for facts.
+2. Always cite the specific file path when referencing information (e.g. \`themes/pricing.md\`).
+3. If the wiki has no relevant information, say so clearly: "The knowledge base doesn't have information on that topic yet."
+4. If you notice contradictions between pages, mention them.
+5. If coverage is thin on a topic, note it: "Coverage on X is thin \u2014 only one source."
+6. If your answer synthesizes multiple pages into new insight, mention it could be saved to the wiki as a new page.
+7. Keep responses concise and specific. Cite evidence, don't summarize generically.
+
+To answer:
+- Read _index.md to understand what's in the knowledge base
+- Search for relevant files using grep and glob
+- Read the files that seem relevant
+- Synthesize an answer grounded in what you found
+
+Provide your answer as plain markdown. Be concise but thorough.`;
+  if (payload.history && payload.history.length > 0) {
+    prompt += "\n\nConversation so far:\n";
+    for (const turn of payload.history) {
+      prompt += `${turn}
+
+`;
+    }
+    prompt += "Answer the last message.";
+  }
+  return prompt;
+}
+var init_query = __esm({
+  "src/lib/prompts/query.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/prompts/lint.ts
+function buildLintPrompt() {
+  const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  return `Perform a thorough health check on this knowledge base. Today is ${date}.
+
+Read all wiki files (glob **/*.md, excluding raw/) and check for:
+
+1. **Contradictions** \u2014 pages making conflicting claims about the same entity or fact
+2. **Stale claims** \u2014 date-stamped statements that may no longer be current
+3. **Orphan pages** \u2014 pages with no inbound links from other pages' ## Related sections
+4. **Missing pages** \u2014 concepts mentioned across multiple pages that deserve their own page
+5. **Duplicate pages** \u2014 topics covered by two pages that should be merged
+6. **Missing cross-references** \u2014 pages discussing entities with their own pages but not linking
+7. **Index accuracy** \u2014 _index.md entries that don't match file content, or missing entries
+8. **Schema drift** \u2014 actual patterns that don't match _schema.md conventions
+
+For issues you're CONFIDENT about, fix them directly:
+- Add missing cross-references and ## Related links (bidirectional)
+- Correct _index.md entries
+- Add ## Related sections to pages that lack them
+- Fix schema drift in _schema.md
+
+For issues requiring human judgment (contradictions, merges, stale facts), note them in your report but do NOT change the files.
+
+Do NOT rewrite pages for style \u2014 only fix semantic issues.
+
+After making fixes, append a lint entry to _log.md.
+
+Output a markdown health check report:
+
+# Knowledge Base Health Check \u2014 ${date}
+
+## Contradictions
+(numbered list with specific pages and quotes)
+
+## Stale Claims
+(numbered list with page, claim, and age)
+
+## Orphan Pages
+(list with page path and suggested connections)
+
+## Missing Cross-References
+(specific A\u2192B links that should exist)
+
+## Auto-Fixes Applied
+(list of changes you made directly)
+
+## Flagged for Review
+(issues needing human judgment)
+
+## Statistics
+- Total pages: N
+- Pages with ## Related: N
+- Orphan pages: N`;
+}
+var init_lint = __esm({
+  "src/lib/prompts/lint.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/prompts/wiki.ts
+function getWikiSystemPrompt() {
+  return `You are the curator of a living knowledge base. Your job is not just to file information \u2014 it's to build and maintain a persistent, compounding artifact where every conversation makes the whole richer.
+
+Think of yourself as the curator of a wiki, not a filing clerk. When you process a source, you're not just extracting facts \u2014 you're integrating new understanding into an evolving body of knowledge. The connections between documents are as valuable as the documents themselves.
+
+On every call, think about:
+1. What does this source add to what we already know?
+2. Does it confirm, extend, or contradict existing understanding?
+3. Which existing pages need to know about this? Which pages does this need to know about?
+4. Are there patterns emerging that deserve their own page?
+5. Should any conventions or filing rules be updated based on what we've learned?
+
+IMPORTANT: You are operating in a sandboxed wiki directory. Only read and write files within this directory using relative paths. Do not use absolute paths. Do not attempt to access files outside this directory.
+
+## Directory structure
+
+- \`_schema.md\` \u2014 Filing conventions, categories, domain vocabulary, filing heuristics. YOUR institutional memory.
+- \`_index.md\` \u2014 One-line summary of every wiki page, organized by category. The table of contents.
+- \`_log.md\` \u2014 Chronological activity log. You maintain this.
+- \`raw/\` \u2014 Immutable source documents. NEVER modify or delete these files.
+- Everything else \u2014 Wiki pages organized by entity and topic.
+
+## Your responsibilities
+
+### 1. Schema (_schema.md)
+You own the schema. Update it when you establish or refine conventions \u2014 new categories, naming patterns, domain vocabulary, filing heuristics, things to ignore.
+
+On the FIRST call for a new knowledge base (no _schema.md exists), CREATE it with the conventions you establish. Suggested starting categories (adapt to what fits):
+- customers/ \u2014 profiles and feedback per person or company
+- themes/ \u2014 cross-cutting topics
+- products/ \u2014 organized by product area
+- research/ \u2014 deep dives and analyses
+- reference/ \u2014 factual reference material
+
+### 2. Index (_index.md)
+ALWAYS keep _index.md current. Every wiki page gets a one-line summary: what it contains, how many connections, what matters most. Organize by category. A reader should understand the shape of the entire knowledge base by reading only the index.
+
+Format:
+\`\`\`
+## category
+- path/to/file.md \u2014 One-line semantic summary [N connections]
+\`\`\`
+
+### 3. Connections (## Related)
+Every wiki page you create or update MUST have a \`## Related\` section at the bottom with labeled, bidirectional links:
+
+\`\`\`
+## Related
+- **Topic:** [themes/pricing.md](themes/pricing.md) \u2014 related pricing analysis
+- **Entity:** [customers/acme.md](customers/acme.md) \u2014 mentioned in their feedback
+- **Contradicts:** [research/market-size.md](research/market-size.md) \u2014 conflicting data point
+\`\`\`
+
+Connection labels should be domain-appropriate: Topic, Entity, Source, Contradicts, See also, etc.
+
+CRITICAL: If you add a link from A to B, you MUST also update B to link back to A. Both sides of every connection. Always.
+
+### 4. Activity log (_log.md)
+After completing any operation, append an entry to _log.md:
+
+\`\`\`
+## [YYYY-MM-DD HH:MM] type | source
+Summary of what happened
+- Detail 1
+- Detail 2
+\`\`\`
+
+Types: ingest, lint, query. If _log.md doesn't exist, create it with a header.
+
+### 5. Contradictions
+When new information conflicts with an existing page, UPDATE the existing page \u2014 resolve the contradiction or flag it clearly. Never file contradictory claims in separate pages without acknowledging the conflict.
+
+### 6. Look up before writing
+ALWAYS read existing files before creating new ones. Search with grep and glob. Prefer updating existing pages over creating duplicates. The knowledge base should grow deeper, not just wider.
+
+### 7. Source references
+Each wiki page should reference its raw sources: \`*Source: [raw/filename.md](raw/filename.md)*\`
+
+### 8. Ongoing tuning
+As you process more sources, notice patterns:
+- Are certain categories getting too broad? Split them.
+- Are there clusters of related pages that need a synthesis page?
+- Is the schema still serving the content well? Evolve it.
+- Are naming conventions consistent? Fix drift.
+
+Update _schema.md to reflect what you learn.
+
+## Page format
+- Organize by entity and topic, not by date
+- kebab-case for all file paths
+- Self-contained and readable with no other context
+- Preserve key quotes verbatim with attribution and date
+- Include source references`;
+}
+var init_wiki = __esm({
+  "src/lib/prompts/wiki.ts"() {
+    "use strict";
+  }
+});
+
+// src/daemon/runner.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
+function filterEnv(env) {
+  const safe = {};
+  const keep = ["PATH", "LANG", "LC_ALL", "TERM", "NODE_ENV"];
+  for (const key of keep) {
+    if (env[key]) safe[key] = env[key];
+  }
+  return safe;
+}
+var ClaudeRunner;
+var init_runner = __esm({
+  "src/daemon/runner.ts"() {
+    "use strict";
+    init_constants();
+    init_ingest();
+    init_query();
+    init_lint();
+    init_wiki();
+    ClaudeRunner = class {
+      constructor(namespace, auth, db, wikisDir) {
+        this.namespace = namespace;
+        this.auth = auth;
+        this.db = db;
+        this.wikisDir = wikisDir;
+      }
+      namespace;
+      auth;
+      db;
+      wikisDir;
+      active = /* @__PURE__ */ new Map();
+      async run(job) {
+        const startTime = Date.now();
+        const wikiId = job.wiki_id;
+        const wiki = this.db.getWiki(wikiId);
+        const model = wiki?.default_model ?? DEFAULT_MODEL;
+        const limits = JOB_LIMITS[job.type];
+        const prompt = this.buildPrompt(job);
+        const credEnv = this.auth.resolveCredentials(wikiId);
+        const tools = this.resolveTools(wikiId);
+        const claudeArgs = this.buildClaudeArgs(prompt, model, limits.max_turns, tools, wikiId);
+        const wrapped = this.namespace.wrapCommand(wikiId, claudeArgs);
+        const env = {
+          ...filterEnv(process.env),
+          ...credEnv,
+          HOME: WORKSPACE_MOUNT
+        };
+        if (credEnv["CLAUDE_CONFIG_DIR"]) {
+          env["CLAUDE_CONFIG_DIR"] = `${WORKSPACE_MOUNT}/.claude`;
+        }
+        return new Promise((resolve) => {
+          const child = spawn(wrapped.command, wrapped.args, {
+            env,
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          child.stdin.end();
+          this.active.set(job.id, child);
+          const stdout = [];
+          const stderr = [];
+          child.stdout.on("data", (chunk) => stdout.push(chunk));
+          child.stderr.on("data", (chunk) => stderr.push(chunk));
+          const timeout = setTimeout(() => {
+            console.warn(`[runner] Job #${job.id} timed out after ${limits.timeout_ms}ms, sending SIGTERM`);
+            child.kill("SIGTERM");
+            setTimeout(() => {
+              if (!child.killed) {
+                console.warn(`[runner] Job #${job.id} did not exit after SIGTERM grace period, sending SIGKILL`);
+                child.kill("SIGKILL");
+              }
+            }, SIGTERM_GRACE_MS);
+          }, limits.timeout_ms);
+          child.on("close", (code) => {
+            clearTimeout(timeout);
+            this.active.delete(job.id);
+            const duration_ms = Date.now() - startTime;
+            const rawOut = Buffer.concat(stdout).toString("utf-8");
+            const rawErr = Buffer.concat(stderr).toString("utf-8");
+            let output = rawOut;
+            try {
+              const envelope = JSON.parse(rawOut);
+              const text = envelope.result ?? "";
+              try {
+                output = JSON.stringify(JSON.parse(text));
+              } catch {
+                output = text.trim() || rawOut;
+              }
+            } catch {
+            }
+            if (rawErr) {
+              console.error(`[runner] Job #${job.id} stderr: ${rawErr.slice(0, 500)}`);
+            }
+            const finalOutput = code === 0 ? output : [output, rawErr].filter(Boolean).join("\n").trim() || `claude exited with code ${code}`;
+            resolve({
+              success: code === 0,
+              output: finalOutput,
+              exit_code: code ?? 1,
+              duration_ms
+            });
+          });
+        });
+      }
+      /**
+       * Kill an active job's process. Used during graceful shutdown.
+       */
+      kill(jobId) {
+        const child = this.active.get(jobId);
+        if (child) {
+          child.kill("SIGTERM");
+          setTimeout(() => {
+            if (!child.killed) child.kill("SIGKILL");
+          }, SIGTERM_GRACE_MS);
+        }
+      }
+      /**
+       * Kill all active processes. Used during daemon shutdown.
+       */
+      killAll() {
+        for (const [jobId] of this.active) {
+          this.kill(jobId);
+        }
+      }
+      get activeCount() {
+        return this.active.size;
+      }
+      // ── Private ────────────────────────────────────────────────────────────
+      buildPrompt(job) {
+        const payload = JSON.parse(job.payload);
+        switch (job.type) {
+          case "ingest":
+            return buildIngestPrompt(payload);
+          case "query":
+            return buildQueryPrompt(payload);
+          case "lint":
+            return buildLintPrompt();
+          default:
+            return `Unknown job type: ${job.type}`;
+        }
+      }
+      resolveTools(wikiId) {
+        const tools = [...BASE_ALLOWED_TOOLS];
+        const allowedPath = join4(this.wikisDir, wikiId, ".tools", "allowed-tools.txt");
+        if (existsSync4(allowedPath)) {
+          const extra = readFileSync3(allowedPath, "utf-8").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && ALLOWED_TOOLS_WHITELIST.has(l));
+          tools.push(...extra);
+        }
+        return [...new Set(tools)];
+      }
+      buildClaudeArgs(prompt, model, maxTurns, tools, wikiId) {
+        const toolStr = tools.join(",");
+        const args = [
+          "claude",
+          "-p",
+          prompt,
+          "--model",
+          model,
+          "--max-turns",
+          String(maxTurns),
+          "--output-format",
+          "json",
+          "--tools",
+          toolStr,
+          // restrict which tools EXIST (hard boundary)
+          "--allowedTools",
+          toolStr
+          // pre-approve those tools (no interactive prompts)
+        ];
+        const systemPrompt = getWikiSystemPrompt();
+        args.push("--append-system-prompt", systemPrompt);
+        const mcpPath = join4(this.wikisDir, wikiId, ".tools", "mcp.json");
+        if (existsSync4(mcpPath)) {
+          args.push("--mcp-config", `${WORKSPACE_MOUNT}/.tools/mcp.json`);
+        }
+        return args;
+      }
+    };
+  }
+});
+
+// src/daemon/queue.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var QueueManager;
+var init_queue = __esm({
+  "src/daemon/queue.ts"() {
+    "use strict";
+    init_constants();
+    QueueManager = class {
+      constructor(db, runner, autoLintInterval = AUTO_LINT_INTERVAL) {
+        this.db = db;
+        this.runner = runner;
+        this.autoLintInterval = autoLintInterval;
+      }
+      db;
+      runner;
+      autoLintInterval;
+      wikis = /* @__PURE__ */ new Map();
+      shuttingDown = false;
+      /**
+       * Start draining queues. Called on daemon startup.
+       * Kicks off drain loops for all wikis with pending jobs.
+       */
+      start() {
+        const wikisWithWork = this.db.wikisWithPendingJobs();
+        for (const wikiId of wikisWithWork) {
+          this.notify(wikiId);
+        }
+        console.log(`[queue] Started. ${wikisWithWork.length} wiki(s) have pending work.`);
+      }
+      /**
+       * Signal that a wiki has new work to process.
+       * If the wiki isn't already draining, starts a drain loop.
+       */
+      notify(wikiId) {
+        if (this.shuttingDown) return;
+        let state = this.wikis.get(wikiId);
+        if (!state) {
+          state = { active: false, pending: false, ingestCount: 0 };
+          this.wikis.set(wikiId, state);
+        }
+        if (state.active) {
+          state.pending = true;
+        } else {
+          this.drainWiki(wikiId, state);
+        }
+      }
+      /**
+       * Graceful shutdown. Waits for active jobs to finish.
+       */
+      async stop() {
+        this.shuttingDown = true;
+        console.log("[queue] Shutting down...");
+        const maxWait = 3e4;
+        const start = Date.now();
+        while (this.runner.activeCount > 0 && Date.now() - start < maxWait) {
+          await sleep(500);
+        }
+        if (this.runner.activeCount > 0) {
+          console.warn(`[queue] ${this.runner.activeCount} job(s) still active after ${maxWait}ms, killing`);
+          this.runner.killAll();
+        }
+        console.log("[queue] Shutdown complete.");
+      }
+      // ── Private ────────────────────────────────────────────────────────────
+      async drainWiki(wikiId, state) {
+        state.active = true;
+        state.pending = false;
+        try {
+          while (!this.shuttingDown) {
+            const job = this.db.claimNextJob(wikiId);
+            if (!job) break;
+            console.log(`[queue] Running job #${job.id} (${job.type}) for wiki '${wikiId}'`);
+            try {
+              const result = await this.runner.run(job);
+              if (result.success) {
+                this.db.completeJob(job.id, result);
+                this.db.logAudit(wikiId, `job.${job.type}.completed`, `job #${job.id} (${result.duration_ms}ms)`);
+                console.log(`[queue] Job #${job.id} completed in ${result.duration_ms}ms`);
+              } else {
+                this.db.failJob(job.id, result.output);
+                this.db.logAudit(wikiId, `job.${job.type}.failed`, `job #${job.id}: ${result.output.slice(0, 200)}`);
+                console.error(`[queue] Job #${job.id} failed (exit ${result.exit_code})`);
+              }
+              if (job.type === "ingest" && result.success) {
+                state.ingestCount++;
+                if (this.autoLintInterval > 0 && state.ingestCount >= this.autoLintInterval) {
+                  state.ingestCount = 0;
+                  this.scheduleAutoLint(wikiId);
+                }
+              }
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              this.db.failJob(job.id, msg);
+              this.db.logAudit(wikiId, `job.${job.type}.error`, `job #${job.id}: ${msg}`);
+              console.error(`[queue] Job #${job.id} error: ${msg}`);
+            }
+          }
+        } finally {
+          state.active = false;
+          if (state.pending && !this.shuttingDown) {
+            this.drainWiki(wikiId, state);
+          }
+        }
+      }
+      scheduleAutoLint(wikiId) {
+        const pendingLints = this.db.listJobs(wikiId, { status: "pending" }).filter((j) => j.type === "lint");
+        if (pendingLints.length > 0) {
+          console.log(`[queue] Skipping auto-lint for '${wikiId}' \u2014 lint already pending`);
+          return;
+        }
+        console.log(`[queue] Scheduling auto-lint for '${wikiId}' after ${this.autoLintInterval} ingests`);
+        this.db.createJob(wikiId, "lint", {});
+      }
+    };
+  }
+});
+
+// src/daemon/routes.ts
+function isValidJobType(type) {
+  return type === "ingest" || type === "query" || type === "lint";
+}
+function requireBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new ValidationError("Request body must be a JSON object");
+  }
+  return body;
+}
+var RouteHandler;
+var init_routes = __esm({
+  "src/daemon/routes.ts"() {
+    "use strict";
+    init_constants();
+    init_errors();
+    RouteHandler = class {
+      constructor(db, scaffold, namespace, queue, auth) {
+        this.db = db;
+        this.scaffold = scaffold;
+        this.namespace = namespace;
+        this.queue = queue;
+        this.auth = auth;
+        this.routes = [
+          { method: "POST", pattern: /^\/wikis$/, handler: this.createWiki.bind(this) },
+          { method: "GET", pattern: /^\/wikis$/, handler: this.listWikis.bind(this) },
+          { method: "GET", pattern: /^\/wikis\/(?<id>[^/]+)$/, handler: this.getWiki.bind(this) },
+          { method: "DELETE", pattern: /^\/wikis\/(?<id>[^/]+)$/, handler: this.destroyWiki.bind(this) },
+          { method: "PUT", pattern: /^\/wikis\/(?<id>[^/]+)\/config$/, handler: this.updateConfig.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/chown$/, handler: this.chownWiki.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/api-key$/, handler: this.setApiKey.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/credentials$/, handler: this.setCredentials.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/jobs$/, handler: this.submitJob.bind(this) },
+          { method: "GET", pattern: /^\/wikis\/(?<id>[^/]+)\/jobs\/(?<jobId>\d+)$/, handler: this.getJob.bind(this) },
+          { method: "GET", pattern: /^\/wikis\/(?<id>[^/]+)\/jobs$/, handler: this.listJobs.bind(this) },
+          { method: "GET", pattern: /^\/wikis\/(?<id>[^/]+)\/logs$/, handler: this.getAuditLog.bind(this) },
+          { method: "POST", pattern: /^\/wikis\/(?<id>[^/]+)\/ingest-file$/, handler: this.receiveFile.bind(this) }
+        ];
+      }
+      db;
+      scaffold;
+      namespace;
+      queue;
+      auth;
+      routes;
+      async handle(method, path, body, ctx) {
+        for (const route of this.routes) {
+          if (route.method !== method) continue;
+          const match = path.match(route.pattern);
+          if (match) {
+            return route.handler(match.groups ?? {}, body, ctx);
+          }
+        }
+        return { status: 404, body: { ok: false, error: "Not found" } };
+      }
+      // ── Wiki CRUD ───────────────────────────────────────────────────────────
+      async createWiki(params, body, ctx) {
+        const b = requireBody(body);
+        const id = b.id;
+        const name = b.name;
+        if (!id || !WIKI_ID_PATTERN.test(id)) {
+          throw new ValidationError(
+            `Invalid wiki ID '${id}'. Must be 3-64 chars, lowercase alphanumeric and hyphens, cannot start or end with a hyphen.`
+          );
+        }
+        if (this.db.getWiki(id)) {
+          throw new WikiExistsError(id);
+        }
+        const wiki = this.db.createWiki(id, name ?? id, ctx.callerUid);
+        this.scaffold.create(id);
+        this.namespace.validateWiki(id);
+        this.db.logAudit(id, "wiki.created");
+        return { status: 201, body: { ok: true, data: wiki } };
+      }
+      async listWikis(params, body, ctx) {
+        const wikis = this.db.listWikis(ctx.callerUid);
+        return { status: 200, body: { ok: true, data: wikis } };
+      }
+      async getWiki(params, body, ctx) {
+        const wiki = this.requireWiki(params["id"], ctx.callerUid);
+        const pendingJobs = this.db.getPendingJobCount(wiki.id);
+        return {
+          status: 200,
+          body: { ok: true, data: { ...wiki, pending_jobs: pendingJobs } }
+        };
+      }
+      async destroyWiki(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const keepData = body && typeof body === "object" && "keepData" in body ? Boolean(body.keepData) : false;
+        this.scaffold.destroy(wikiId, keepData);
+        this.db.deleteWiki(wikiId);
+        return { status: 200, body: { ok: true } };
+      }
+      async chownWiki(params, body, ctx) {
+        const wikiId = params["id"];
+        const wiki = this.db.getWiki(wikiId);
+        if (!wiki) throw new WikiNotFoundError(wikiId);
+        if (ctx.callerUid !== 0 && wiki.owner_uid !== ctx.callerUid) {
+          throw new ForbiddenError(wikiId);
+        }
+        const b = requireBody(body);
+        const newOwnerUid = b.uid;
+        if (newOwnerUid === void 0 || typeof newOwnerUid !== "number" || !Number.isInteger(newOwnerUid) || newOwnerUid < 0) {
+          throw new ValidationError("uid (non-negative integer) is required");
+        }
+        const updated = this.db.chownWiki(wikiId, newOwnerUid);
+        this.db.logAudit(wikiId, "wiki.chown", `uid ${ctx.callerUid} \u2192 ${newOwnerUid}`);
+        return { status: 200, body: { ok: true, data: updated } };
+      }
+      async updateConfig(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const config = requireBody(body);
+        if (config.allowed_tools !== void 0) {
+          if (!Array.isArray(config.allowed_tools)) {
+            throw new ValidationError("allowed_tools must be an array of tool names");
+          }
+          const invalid = config.allowed_tools.filter((t) => !ALLOWED_TOOLS_WHITELIST.has(t));
+          if (invalid.length > 0) {
+            const allowed = [...ALLOWED_TOOLS_WHITELIST].filter((t) => !BASE_ALLOWED_TOOLS.includes(t));
+            throw new ValidationError(
+              `Invalid tools: ${invalid.join(", ")}. Allowed extras: ${allowed.join(", ")}`
+            );
+          }
+          this.scaffold.writeAllowedTools(wikiId, config.allowed_tools);
+          this.db.logAudit(wikiId, "wiki.allowed_tools_updated", JSON.stringify(config.allowed_tools));
+        }
+        const { allowed_tools: _, ...dbConfig } = config;
+        if (Object.keys(dbConfig).length > 0) {
+          const wiki2 = this.db.updateWiki(wikiId, dbConfig);
+          this.db.logAudit(wikiId, "wiki.config_updated", JSON.stringify(dbConfig));
+          return { status: 200, body: { ok: true, data: wiki2 } };
+        }
+        const wiki = this.db.getWiki(wikiId);
+        return { status: 200, body: { ok: true, data: wiki } };
+      }
+      // ── Auth ─────────────────────────────────────────────────────────────────
+      async setApiKey(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const b = requireBody(body);
+        const key = b.key;
+        if (!key || typeof key !== "string") {
+          throw new ValidationError("API key is required");
+        }
+        this.auth.setApiKey(wikiId, key);
+        this.db.logAudit(wikiId, "wiki.api_key_set");
+        return { status: 200, body: { ok: true } };
+      }
+      async setCredentials(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const b = requireBody(body);
+        const credentials = b.credentials;
+        if (!credentials || typeof credentials !== "string") {
+          throw new ValidationError("credentials (JSON string) is required");
+        }
+        try {
+          JSON.parse(credentials);
+        } catch {
+          throw new ValidationError("credentials must be valid JSON");
+        }
+        this.auth.setCredentials(wikiId, credentials);
+        this.db.logAudit(wikiId, "wiki.credentials_set");
+        return { status: 200, body: { ok: true } };
+      }
+      // ── Jobs ─────────────────────────────────────────────────────────────────
+      async submitJob(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const b = requireBody(body);
+        const type = b.type;
+        const payload = b.payload;
+        if (!type || !isValidJobType(type)) {
+          throw new ValidationError(`Invalid job type '${type}'. Must be one of: ingest, query, lint`);
+        }
+        const job = this.db.createJob(wikiId, type, payload ?? {});
+        this.queue.notify(wikiId);
+        this.db.logAudit(wikiId, `job.${type}.submitted`, `job #${job.id}`);
+        if (ctx.wait) {
+          const result = await this.waitForJob(job.id);
+          return { status: 200, body: { ok: true, data: result } };
+        }
+        return { status: 202, body: { ok: true, data: job } };
+      }
+      async getJob(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const jobId = Number(params["jobId"]);
+        const job = this.db.getJob(jobId);
+        if (!job || job.wiki_id !== wikiId) throw new JobNotFoundError(jobId);
+        return { status: 200, body: { ok: true, data: job } };
+      }
+      async listJobs(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const jobs = this.db.listJobs(wikiId, { limit: 50 });
+        return { status: 200, body: { ok: true, data: jobs } };
+      }
+      // ── Audit ────────────────────────────────────────────────────────────────
+      async getAuditLog(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const log = this.db.getAuditLog(wikiId);
+        return { status: 200, body: { ok: true, data: log } };
+      }
+      // ── File upload ──────────────────────────────────────────────────────────
+      async receiveFile(params, body, ctx) {
+        const wikiId = params["id"];
+        this.requireWiki(wikiId, ctx.callerUid);
+        const b = requireBody(body);
+        const filename = b.filename;
+        const content = b.content;
+        if (!filename || typeof filename !== "string" || !content || typeof content !== "string") {
+          throw new ValidationError("filename (string) and content (base64 string) are required");
+        }
+        const buffer = Buffer.from(content, "base64");
+        const stored = this.scaffold.writeRawFile(wikiId, filename, buffer);
+        return { status: 201, body: { ok: true, data: { filename: stored } } };
+      }
+      // ── Helpers ──────────────────────────────────────────────────────────────
+      requireWiki(wikiId, callerUid) {
+        const wiki = this.db.getWiki(wikiId);
+        if (!wiki) throw new WikiNotFoundError(wikiId);
+        if (wiki.owner_uid !== callerUid) throw new ForbiddenError(wikiId);
+        return wiki;
+      }
+      waitForJob(jobId, timeoutMs = 10 * 6e4) {
+        return new Promise((resolve, reject) => {
+          const deadline = Date.now() + timeoutMs;
+          const check = () => {
+            const job = this.db.getJob(jobId);
+            if (!job || job.status === "completed" || job.status === "failed") {
+              resolve(job);
+            } else if (Date.now() > deadline) {
+              resolve(job);
+            } else {
+              setTimeout(check, JOB_POLL_INTERVAL_MS);
+            }
+          };
+          check();
+        });
+      }
+    };
+  }
+});
+
+// src/daemon/peercred.ts
+import { createRequire } from "node:module";
+function getPeerCred(socket) {
+  const handle = socket._handle;
+  if (!handle || typeof handle.fd !== "number" || handle.fd < 0) {
+    throw new Error("Cannot get file descriptor from socket");
+  }
+  return addon.getPeerCred(handle.fd);
+}
+var require2, addon;
+var init_peercred = __esm({
+  "src/daemon/peercred.ts"() {
+    "use strict";
+    require2 = createRequire(import.meta.url);
+    addon = require2("../../build/Release/peercred.node");
+  }
+});
+
+// src/daemon/server.ts
+import { createServer } from "node:http";
+import { existsSync as existsSync5, unlinkSync, chmodSync } from "node:fs";
+function sendJson(res, status, body) {
+  const json = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Content-Length": Buffer.byteLength(json)
+  });
+  res.end(json);
+}
+async function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let totalSize = 0;
+    req.on("data", (chunk) => {
+      totalSize += chunk.length;
+      if (totalSize > MAX_BODY_BYTES) {
+        req.destroy();
+        reject(new Error(`Request body exceeds ${MAX_BODY_BYTES} bytes`));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf-8");
+      if (!raw) {
+        resolve(void 0);
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+var DaemonServer, MAX_BODY_BYTES;
+var init_server = __esm({
+  "src/daemon/server.ts"() {
+    "use strict";
+    init_peercred();
+    DaemonServer = class {
+      constructor(socketPath, routes) {
+        this.socketPath = socketPath;
+        this.routes = routes;
+        this.server = createServer((req, res) => {
+          this.handleRequest(req, res).catch((err) => {
+            console.error("[server] Unhandled error:", err);
+            if (!res.headersSent) {
+              sendJson(res, 500, { ok: false, error: "Internal server error" });
+            }
+          });
+        });
+        this.server.on("connection", (socket) => {
+          try {
+            const cred = getPeerCred(socket);
+            this.socketUids.set(socket, cred.uid);
+          } catch (err) {
+            console.error("[server] Failed to get peer credentials:", err);
+            socket.destroy();
+          }
+        });
+      }
+      socketPath;
+      routes;
+      server;
+      socketUids = /* @__PURE__ */ new WeakMap();
+      async start() {
+        if (existsSync5(this.socketPath)) {
+          unlinkSync(this.socketPath);
+        }
+        return new Promise((resolve, reject) => {
+          this.server.on("error", reject);
+          this.server.listen(this.socketPath, () => {
+            chmodSync(this.socketPath, 438);
+            console.log(`[server] Listening on ${this.socketPath}`);
+            resolve();
+          });
+        });
+      }
+      async stop() {
+        return new Promise((resolve) => {
+          this.server.close(() => {
+            if (existsSync5(this.socketPath)) {
+              try {
+                unlinkSync(this.socketPath);
+              } catch {
+              }
+            }
+            resolve();
+          });
+        });
+      }
+      async handleRequest(req, res) {
+        const method = (req.method ?? "GET").toUpperCase();
+        const url = req.url ?? "/";
+        let body = void 0;
+        if (method === "POST" || method === "PUT") {
+          body = await readBody(req);
+        }
+        const urlObj = new URL(url, "http://localhost");
+        const wait = urlObj.searchParams.get("wait") === "true";
+        const socket = req.socket;
+        const callerUid = this.socketUids.get(socket);
+        if (callerUid === void 0) {
+          sendJson(res, 500, { ok: false, error: "Could not determine caller identity" });
+          return;
+        }
+        try {
+          const result = await this.routes.handle(method, urlObj.pathname, body, {
+            wait,
+            res,
+            // pass response for streaming login output
+            callerUid
+          });
+          if (res.writableEnded) return;
+          sendJson(res, result.status, result.body);
+        } catch (err) {
+          if (res.writableEnded) return;
+          if (err && typeof err === "object" && "statusCode" in err) {
+            const memexErr = err;
+            sendJson(res, memexErr.statusCode, {
+              ok: false,
+              error: memexErr.message
+            });
+          } else {
+            console.error("[server] Error handling request:", err);
+            sendJson(res, 500, { ok: false, error: "Internal server error" });
+          }
+        }
+      }
+    };
+    MAX_BODY_BYTES = 100 * 1024 * 1024;
+  }
+});
+
+// src/daemon.ts
+var daemon_exports = {};
+__export(daemon_exports, {
+  startDaemon: () => startDaemon
+});
+import { mkdirSync as mkdirSync4 } from "node:fs";
+async function startDaemon() {
+  console.log("[memex] Starting daemon...");
+  for (const dir of [DATA_DIR, WIKIS_DIR, RUN_DIR]) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  const db = new Database(DB_PATH);
+  db.initialize();
+  const staleCount = db.resetStaleJobs();
+  if (staleCount > 0) {
+    console.log(`[memex] Reset ${staleCount} stale job(s) from previous run`);
+  }
+  const namespace = new NamespaceManager(WIKIS_DIR);
+  namespace.checkCapabilities();
+  namespace.ensureDirectories();
+  const scaffold = new WikiScaffold(WIKIS_DIR);
+  const auth = new AuthManager(WIKIS_DIR, process.env["ANTHROPIC_API_KEY"]);
+  const runner = new ClaudeRunner(namespace, auth, db, WIKIS_DIR);
+  const queue = new QueueManager(db, runner, AUTO_LINT_INTERVAL);
+  const routes = new RouteHandler(db, scaffold, namespace, queue, auth);
+  const server = new DaemonServer(SOCKET_PATH, routes);
+  await server.start();
+  queue.start();
+  const wikiCount = db.listWikis().length;
+  console.log(`[memex] Daemon ready (PID ${process.pid})`);
+  console.log(`[memex] Socket: ${SOCKET_PATH}`);
+  console.log(`[memex] Data:   ${DATA_DIR}`);
+  console.log(`[memex] Wikis:  ${wikiCount}`);
+  const shutdown = async (signal) => {
+    console.log(`
+[memex] Received ${signal}, shutting down...`);
+    await queue.stop();
+    await server.stop();
+    db.close();
+    console.log("[memex] Shutdown complete.");
+    process.exit(0);
+  };
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  process.on("SIGINT", () => shutdown("SIGINT"));
+}
+var init_daemon = __esm({
+  "src/daemon.ts"() {
+    "use strict";
+    init_db();
+    init_namespace();
+    init_scaffold();
+    init_auth();
+    init_runner();
+    init_queue();
+    init_routes();
+    init_server();
+    init_constants();
+  }
+});
+
+// src/index.ts
+import { Command as Command13 } from "commander";
+
+// src/cli/commands/serve.ts
+import { Command } from "commander";
+var serveCommand = new Command("serve").description("Start the memex daemon").action(async () => {
+  try {
+    const { startDaemon: startDaemon2 } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
+    await startDaemon2();
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+});
+
+// src/cli/commands/create.ts
+import { Command as Command2 } from "commander";
+
+// src/cli/client.ts
+init_constants();
+init_errors();
+import { request as httpRequest } from "node:http";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { basename as basename2 } from "node:path";
+var MemexClient = class {
+  constructor(socketPath = SOCKET_PATH) {
+    this.socketPath = socketPath;
+  }
+  socketPath;
+  // ── Generic request ────────────────────────────────────────────────────
+  async request(method, path, body) {
+    return new Promise((resolve, reject) => {
+      const opts = {
+        socketPath: this.socketPath,
+        method,
+        path,
+        headers: { "Content-Type": "application/json" }
+      };
+      const req = httpRequest(opts, (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => {
+          const raw = Buffer.concat(chunks).toString("utf-8");
+          try {
+            resolve(JSON.parse(raw));
+          } catch {
+            resolve({ ok: false, error: raw });
+          }
+        });
+      });
+      req.on("error", (err) => {
+        if (err.code === "ECONNREFUSED" || err.code === "ENOENT") {
+          reject(new DaemonNotRunningError());
+        } else {
+          reject(err);
+        }
+      });
+      if (body !== void 0) {
+        req.write(JSON.stringify(body));
+      }
+      req.end();
+    });
+  }
+  /**
+   * Make a request and stream the raw response body chunks.
+   * Used for login flow where we stream CLI output.
+   */
+  async stream(method, path, body) {
+    return new Promise((resolve, reject) => {
+      const opts = {
+        socketPath: this.socketPath,
+        method,
+        path,
+        headers: { "Content-Type": "application/json" }
+      };
+      const req = httpRequest(opts, (res) => {
+        let responseError = null;
+        res.on("error", (err) => {
+          responseError = err;
+        });
+        const iterable = {
+          [Symbol.asyncIterator]() {
+            return {
+              next() {
+                return new Promise((resolveNext, rejectNext) => {
+                  if (responseError) {
+                    rejectNext(responseError);
+                    return;
+                  }
+                  const onData = (chunk) => {
+                    res.removeListener("end", onEnd);
+                    res.removeListener("error", onError);
+                    resolveNext({ value: chunk.toString("utf-8"), done: false });
+                  };
+                  const onEnd = () => {
+                    res.removeListener("data", onData);
+                    res.removeListener("error", onError);
+                    resolveNext({ value: "", done: true });
+                  };
+                  const onError = (err) => {
+                    res.removeListener("data", onData);
+                    res.removeListener("end", onEnd);
+                    rejectNext(err);
+                  };
+                  res.once("data", onData);
+                  res.once("end", onEnd);
+                  res.once("error", onError);
+                });
+              }
+            };
+          }
+        };
+        resolve(iterable);
+      });
+      req.on("error", (err) => {
+        if (err.code === "ECONNREFUSED" || err.code === "ENOENT") {
+          reject(new DaemonNotRunningError());
+        } else {
+          reject(err);
+        }
+      });
+      if (body !== void 0) {
+        req.write(JSON.stringify(body));
+      }
+      req.end();
+    });
+  }
+  // ── Convenience methods ────────────────────────────────────────────────
+  createWiki(id, name) {
+    return this.request("POST", "/wikis", { id, name });
+  }
+  listWikis() {
+    return this.request("GET", "/wikis");
+  }
+  getWiki(id) {
+    return this.request("GET", `/wikis/${id}`);
+  }
+  destroyWiki(id, keepData = false) {
+    return this.request("DELETE", `/wikis/${id}`, { keepData });
+  }
+  updateConfig(wikiId, config) {
+    return this.request("PUT", `/wikis/${wikiId}/config`, config);
+  }
+  chownWiki(wikiId, uid) {
+    return this.request("POST", `/wikis/${wikiId}/chown`, { uid });
+  }
+  setApiKey(wikiId, key) {
+    return this.request("POST", `/wikis/${wikiId}/api-key`, { key });
+  }
+  setCredentials(wikiId, credentials) {
+    return this.request("POST", `/wikis/${wikiId}/credentials`, { credentials });
+  }
+  submitJob(wikiId, type, payload, wait = false) {
+    const path = `/wikis/${wikiId}/jobs` + (wait ? "?wait=true" : "");
+    return this.request("POST", path, { type, payload });
+  }
+  getJob(wikiId, jobId) {
+    return this.request("GET", `/wikis/${wikiId}/jobs/${jobId}`);
+  }
+  listJobs(wikiId) {
+    return this.request("GET", `/wikis/${wikiId}/jobs`);
+  }
+  getAuditLog(wikiId, limit) {
+    const path = `/wikis/${wikiId}/logs` + (limit ? `?limit=${limit}` : "");
+    return this.request("GET", path);
+  }
+  /**
+   * Upload a local file to the daemon for ingestion into a wiki's raw/ directory.
+   */
+  async uploadFile(wikiId, localPath) {
+    const content = readFileSync4(localPath);
+    const filename = basename2(localPath);
+    return this.request("POST", `/wikis/${wikiId}/ingest-file`, {
+      filename,
+      content: content.toString("base64")
+    });
+  }
+  /**
+   * Submit a job and poll until it completes.
+   */
+  async waitForJob(wikiId, jobId, onPoll) {
+    while (true) {
+      const resp = await this.getJob(wikiId, jobId);
+      if (!resp.ok || !resp.data) {
+        throw new Error(resp.error ?? "Failed to get job status");
+      }
+      const job = resp.data;
+      if (onPoll) onPoll(job);
+      if (job.status === "completed" || job.status === "failed") {
+        return job;
+      }
+      await sleep2(JOB_POLL_INTERVAL_MS);
+    }
+  }
+};
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/cli/commands/create.ts
+var createCommand = new Command2("create").description("Create a new wiki").argument("<wikiId>", "Wiki identifier (lowercase alphanumeric + hyphens, 3-64 chars)").option("--name <name>", "Display name for the wiki").action(async (wikiId, opts) => {
+  const client = new MemexClient();
+  const resp = await client.createWiki(wikiId, opts.name);
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  const wiki = resp.data;
+  console.log(`Created wiki '${wiki.id}' (${wiki.name})`);
+  console.log(`
+Next steps:`);
+  console.log(`  memex login ${wiki.id}           # authenticate with Claude`);
+  console.log(`  memex config ${wiki.id} --edit    # customize wiki agent`);
+  console.log(`  memex ingest ${wiki.id} file.md   # add content`);
+});
+
+// src/cli/commands/destroy.ts
+import { Command as Command3 } from "commander";
+import { createInterface } from "node:readline";
+var destroyCommand = new Command3("destroy").description("Destroy a wiki and its data").argument("<wikiId>", "Wiki to destroy").option("--keep-data", "Keep wiki files on disk (only remove registration)").option("-y, --yes", "Skip confirmation prompt").action(async (wikiId, opts) => {
+  if (!opts.yes) {
+    const confirmed = await confirm(
+      `This will destroy wiki '${wikiId}'${opts.keepData ? " (keeping data)" : " and ALL its data"}. Continue? [y/N] `
+    );
+    if (!confirmed) {
+      console.log("Aborted.");
+      process.exit(0);
+    }
+  }
+  const client = new MemexClient();
+  const resp = await client.destroyWiki(wikiId, opts.keepData ?? false);
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  console.log(`Destroyed wiki '${wikiId}'${opts.keepData ? " (data preserved)" : ""}`);
+});
+function confirm(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+    });
+  });
+}
+
+// src/cli/commands/config.ts
+import { Command as Command4 } from "commander";
+import { createInterface as createInterface2 } from "node:readline";
+import { execFileSync as execFileSync2 } from "node:child_process";
+init_constants();
+import { join as join5 } from "node:path";
+var configCommand = new Command4("config").description("Configure a wiki").argument("<wikiId>", "Wiki to configure").option("--edit", "Open .claude.md in $EDITOR").option("--set-key", "Set the API key for this wiki").option("--model <model>", "Set the default model (e.g., sonnet, opus, haiku)").option("--allowed-tools <tools>", "Set allowed tools (comma-separated, e.g., WebSearch,WebFetch)").option("--list-tools", "Show available tools and current configuration").action(async (wikiId, opts) => {
+  const client = new MemexClient();
+  const wikiResp = await client.getWiki(wikiId);
+  if (!wikiResp.ok) {
+    console.error(`Error: ${wikiResp.error}`);
+    process.exit(1);
+  }
+  if (opts.edit) {
+    const editor = process.env["EDITOR"] || process.env["VISUAL"] || "vi";
+    const claudeMdPath = join5(WIKIS_DIR, wikiId, ".claude.md");
+    try {
+      execFileSync2(editor, [claudeMdPath], { stdio: "inherit" });
+      console.log(`Updated .claude.md for '${wikiId}'`);
+    } catch {
+      console.error(`Failed to open editor. Set $EDITOR environment variable.`);
+      process.exit(1);
+    }
+    return;
+  }
+  if (opts.setKey) {
+    const key = await promptSecret("API key: ");
+    const resp = await client.setApiKey(wikiId, key);
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    console.log(`API key set for '${wikiId}'`);
+    return;
+  }
+  if (opts.listTools) {
+    const extras = [...ALLOWED_TOOLS_WHITELIST].filter((t) => !BASE_ALLOWED_TOOLS.includes(t));
+    console.log(`Base tools (always enabled): ${BASE_ALLOWED_TOOLS.join(", ")}`);
+    console.log(`Available extras: ${extras.join(", ")}`);
+    console.log(`
+To enable extras: memex config ${wikiId} --allowed-tools ${extras.join(",")}`);
+    return;
+  }
+  if (opts.allowedTools !== void 0) {
+    const tools = opts.allowedTools ? opts.allowedTools.split(",").map((t) => t.trim()).filter(Boolean) : [];
+    const resp = await client.updateConfig(wikiId, { allowed_tools: tools });
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    if (tools.length === 0) {
+      console.log(`Allowed tools reset to base set for '${wikiId}'`);
+    } else {
+      console.log(`Allowed tools set for '${wikiId}': ${tools.join(", ")}`);
+    }
+    return;
+  }
+  if (opts.model) {
+    const resp = await client.updateConfig(wikiId, { default_model: opts.model });
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    console.log(`Model set to '${opts.model}' for '${wikiId}'`);
+    return;
+  }
+  const wiki = wikiResp.data;
+  console.log(`Wiki: ${wiki.id}`);
+  console.log(`Name: ${wiki.name}`);
+  console.log(`Model: ${wiki.default_model}`);
+  console.log(`Created: ${wiki.created_at}`);
+  console.log(`
+Config file: ${join5(WIKIS_DIR, wikiId, ".claude.md")}`);
+});
+function promptSecret(prompt) {
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    if (process.stdin.isTTY) {
+      process.stdout.write(prompt);
+      const stdin = process.stdin;
+      stdin.setRawMode(true);
+      stdin.resume();
+      let input = "";
+      const onData = (chunk) => {
+        const char = chunk.toString("utf-8");
+        if (char === "\n" || char === "\r") {
+          stdin.setRawMode(false);
+          stdin.removeListener("data", onData);
+          process.stdout.write("\n");
+          rl.close();
+          resolve(input);
+        } else if (char === "\x7F" || char === "\b") {
+          if (input.length > 0) {
+            input = input.slice(0, -1);
+          }
+        } else if (char === "") {
+          rl.close();
+          process.exit(0);
+        } else {
+          input += char;
+        }
+      };
+      stdin.on("data", onData);
+    } else {
+      rl.question(prompt, (answer) => {
+        rl.close();
+        resolve(answer);
+      });
+    }
+  });
+}
+
+// src/cli/commands/login.ts
+import { Command as Command5 } from "commander";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "node:fs";
+import { join as join6 } from "node:path";
+import { homedir } from "node:os";
+var DEFAULT_CREDS_PATH = join6(homedir(), ".claude", ".credentials.json");
+var loginCommand = new Command5("login").description("Copy Claude credentials into a wiki").argument("<wikiId>", "Wiki to authenticate").option("--credentials <path>", "Path to .credentials.json", DEFAULT_CREDS_PATH).option("--api-key <key>", "Use an API key instead of OAuth credentials").action(async (wikiId, opts) => {
+  const client = new MemexClient();
+  const wikiResp = await client.getWiki(wikiId);
+  if (!wikiResp.ok) {
+    console.error(`Error: ${wikiResp.error}`);
+    process.exit(1);
+  }
+  if (opts.apiKey) {
+    const resp2 = await client.setApiKey(wikiId, opts.apiKey);
+    if (!resp2.ok) {
+      console.error(`Error: ${resp2.error}`);
+      process.exit(1);
+    }
+    console.log(`API key stored for wiki '${wikiId}'.`);
+    return;
+  }
+  const credsPath = opts.credentials;
+  if (!existsSync6(credsPath)) {
+    console.error(`Error: Credentials file not found: ${credsPath}`);
+    console.error(`
+Run 'claude auth login' first, or pass --credentials <path>`);
+    process.exit(1);
+  }
+  const credentials = readFileSync5(credsPath, "utf-8");
+  try {
+    JSON.parse(credentials);
+  } catch {
+    console.error(`Error: ${credsPath} is not valid JSON`);
+    process.exit(1);
+  }
+  const resp = await client.setCredentials(wikiId, credentials);
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  console.log(`Credentials copied from ${credsPath} to wiki '${wikiId}'.`);
+});
+
+// src/cli/commands/ingest.ts
+import { Command as Command6 } from "commander";
+import { existsSync as existsSync7 } from "node:fs";
+var ingestCommand = new Command6("ingest").description("Ingest source files into a wiki").argument("<wikiId>", "Target wiki").argument("<files...>", "Files to ingest (pdf, md, html, txt, images, etc.)").option("--async", "Return job ID immediately instead of waiting").action(async (wikiId, files, opts) => {
+  const client = new MemexClient();
+  for (const file of files) {
+    if (!existsSync7(file)) {
+      console.error(`File not found: ${file}`);
+      process.exit(1);
+    }
+  }
+  const storedFiles = [];
+  for (const file of files) {
+    process.stdout.write(`Uploading ${file}...`);
+    const resp = await client.uploadFile(wikiId, file);
+    if (!resp.ok) {
+      console.error(` failed: ${resp.error}`);
+      process.exit(1);
+    }
+    storedFiles.push(resp.data.filename);
+    console.log(` done (${resp.data.filename})`);
+  }
+  const jobResp = await client.submitJob(wikiId, "ingest", { files: storedFiles });
+  if (!jobResp.ok) {
+    console.error(`Error: ${jobResp.error}`);
+    process.exit(1);
+  }
+  const job = jobResp.data;
+  console.log(`
+Ingest job #${job.id} submitted`);
+  if (opts.async) {
+    console.log(`Check status: memex status ${wikiId} ${job.id}`);
+    return;
+  }
+  process.stdout.write("Processing");
+  const result = await client.waitForJob(wikiId, job.id, () => {
+    process.stdout.write(".");
+  });
+  console.log();
+  if (result.status === "completed") {
+    const parsed = safeParseResult(result.result);
+    console.log("\nIngest complete.");
+    if (parsed?.output) {
+      console.log(parsed.output);
+    }
+  } else {
+    console.error("\nIngest failed.");
+    const parsed = safeParseResult(result.result);
+    if (parsed) {
+      console.error(parsed.error ?? parsed.output ?? result.result);
+    }
+    process.exit(1);
+  }
+});
+function safeParseResult(raw) {
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { output: raw };
+  }
+}
+
+// src/cli/commands/query.ts
+import { Command as Command7 } from "commander";
+var queryCommand = new Command7("query").description("Ask a question against a wiki").argument("<wikiId>", "Target wiki").argument("<question>", "Question to ask").option("--async", "Return job ID immediately instead of waiting").action(async (wikiId, question, opts) => {
+  const client = new MemexClient();
+  const jobResp = await client.submitJob(wikiId, "query", { question });
+  if (!jobResp.ok) {
+    console.error(`Error: ${jobResp.error}`);
+    process.exit(1);
+  }
+  const job = jobResp.data;
+  if (opts.async) {
+    console.log(`Query job #${job.id} submitted`);
+    console.log(`Check status: memex status ${wikiId} ${job.id}`);
+    return;
+  }
+  process.stdout.write("Thinking");
+  const result = await client.waitForJob(wikiId, job.id, () => {
+    process.stdout.write(".");
+  });
+  console.log("\n");
+  if (result.status === "completed") {
+    const parsed = safeParseResult2(result.result);
+    console.log(parsed?.output ?? result.result ?? "(no output)");
+  } else {
+    console.error("Query failed.");
+    const parsed = safeParseResult2(result.result);
+    console.error(parsed?.error ?? parsed?.output ?? result.result);
+    process.exit(1);
+  }
+});
+function safeParseResult2(raw) {
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { output: raw };
+  }
+}
+
+// src/cli/commands/lint.ts
+import { Command as Command8 } from "commander";
+var lintCommand = new Command8("lint").description("Run a maintenance health check on a wiki").argument("<wikiId>", "Target wiki").option("--async", "Return job ID immediately instead of waiting").action(async (wikiId, opts) => {
+  const client = new MemexClient();
+  const jobResp = await client.submitJob(wikiId, "lint", {});
+  if (!jobResp.ok) {
+    console.error(`Error: ${jobResp.error}`);
+    process.exit(1);
+  }
+  const job = jobResp.data;
+  if (opts.async) {
+    console.log(`Lint job #${job.id} submitted`);
+    console.log(`Check status: memex status ${wikiId} ${job.id}`);
+    return;
+  }
+  process.stdout.write("Checking wiki health");
+  const result = await client.waitForJob(wikiId, job.id, () => {
+    process.stdout.write(".");
+  });
+  console.log("\n");
+  if (result.status === "completed") {
+    const parsed = safeParseResult3(result.result);
+    console.log(parsed?.output ?? result.result ?? "(no output)");
+  } else {
+    console.error("Lint failed.");
+    const parsed = safeParseResult3(result.result);
+    console.error(parsed?.error ?? parsed?.output ?? result.result);
+    process.exit(1);
+  }
+});
+function safeParseResult3(raw) {
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { output: raw };
+  }
+}
+
+// src/cli/commands/logs.ts
+import { Command as Command9 } from "commander";
+var logsCommand = new Command9("logs").description("View audit log for a wiki").argument("<wikiId>", "Target wiki").option("--tail <n>", "Number of entries to show", "20").action(async (wikiId, opts) => {
+  const client = new MemexClient();
+  const limit = parseInt(opts.tail, 10) || 20;
+  const resp = await client.getAuditLog(wikiId, limit);
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  const entries = resp.data ?? [];
+  if (entries.length === 0) {
+    console.log("No audit log entries.");
+    return;
+  }
+  for (const entry of entries.reverse()) {
+    const detail = entry.detail ? ` \u2014 ${entry.detail}` : "";
+    console.log(`[${entry.created_at}] ${entry.action}${detail}`);
+  }
+});
+
+// src/cli/commands/list.ts
+import { Command as Command10 } from "commander";
+var listCommand = new Command10("list").description("List all wikis").action(async () => {
+  const client = new MemexClient();
+  const resp = await client.listWikis();
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  const wikis = resp.data ?? [];
+  if (wikis.length === 0) {
+    console.log("No wikis. Create one with: memex create <wikiId>");
+    return;
+  }
+  const header = padRow("ID", "NAME", "MODEL", "CREATED");
+  console.log(header);
+  console.log("-".repeat(header.length));
+  for (const wiki of wikis) {
+    console.log(padRow(wiki.id, wiki.name, wiki.default_model, wiki.created_at));
+  }
+});
+function padRow(id, name, model, created) {
+  return `${id.padEnd(24)} ${name.padEnd(24)} ${model.padEnd(10)} ${created}`;
+}
+
+// src/cli/commands/chown.ts
+import { Command as Command11 } from "commander";
+var chownCommand = new Command11("chown").description("Transfer wiki ownership to another user (by UID)").argument("<wikiId>", "Wiki identifier").argument("<uid>", "New owner UID (numeric)").action(async (wikiId, uidStr) => {
+  const uid = Number(uidStr);
+  if (!Number.isInteger(uid) || uid < 0) {
+    console.error(`Error: uid must be a non-negative integer, got '${uidStr}'`);
+    process.exit(1);
+  }
+  const client = new MemexClient();
+  const resp = await client.chownWiki(wikiId, uid);
+  if (!resp.ok) {
+    console.error(`Error: ${resp.error}`);
+    process.exit(1);
+  }
+  const wiki = resp.data;
+  console.log(`Transferred wiki '${wiki.id}' to uid ${wiki.owner_uid}`);
+});
+
+// src/cli/commands/status.ts
+import { Command as Command12 } from "commander";
+var statusCommand = new Command12("status").description("Check job status for a wiki").argument("<wikiId>", "Target wiki").argument("[jobId]", "Specific job ID (omit to list recent jobs)").action(async (wikiId, jobId) => {
+  const client = new MemexClient();
+  if (jobId) {
+    const resp = await client.getJob(wikiId, parseInt(jobId, 10));
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    const job = resp.data;
+    console.log(`Job #${job.id}`);
+    console.log(`  Type:      ${job.type}`);
+    console.log(`  Status:    ${job.status}`);
+    console.log(`  Created:   ${job.created_at}`);
+    if (job.started_at) console.log(`  Started:   ${job.started_at}`);
+    if (job.completed_at) console.log(`  Completed: ${job.completed_at}`);
+    if (job.result) {
+      try {
+        const parsed = JSON.parse(job.result);
+        if (parsed.output) {
+          console.log(`
+Output:
+${parsed.output}`);
+        }
+        if (parsed.error) {
+          console.log(`
+Error:
+${parsed.error}`);
+        }
+        if (parsed.duration_ms) {
+          console.log(`
+Duration: ${parsed.duration_ms}ms`);
+        }
+      } catch {
+        console.log(`
+Result: ${job.result}`);
+      }
+    }
+  } else {
+    const resp = await client.listJobs(wikiId);
+    if (!resp.ok) {
+      console.error(`Error: ${resp.error}`);
+      process.exit(1);
+    }
+    const jobs = resp.data ?? [];
+    if (jobs.length === 0) {
+      console.log(`No jobs for wiki '${wikiId}'.`);
+      return;
+    }
+    const header = padRow2("ID", "TYPE", "STATUS", "CREATED");
+    console.log(header);
+    console.log("-".repeat(header.length));
+    for (const job of jobs) {
+      console.log(padRow2(
+        String(job.id),
+        job.type,
+        job.status,
+        job.created_at
+      ));
+    }
+  }
+});
+function padRow2(id, type, status, created) {
+  return `${id.padEnd(8)} ${type.padEnd(10)} ${status.padEnd(12)} ${created}`;
+}
+
+// src/index.ts
+var program = new Command13();
+program.name("memex").description("Isolated, queued claude -p runtime for persistent knowledge bases").version("0.1.0");
+program.addCommand(serveCommand);
+program.addCommand(createCommand);
+program.addCommand(destroyCommand);
+program.addCommand(configCommand);
+program.addCommand(loginCommand);
+program.addCommand(ingestCommand);
+program.addCommand(queryCommand);
+program.addCommand(lintCommand);
+program.addCommand(logsCommand);
+program.addCommand(listCommand);
+program.addCommand(chownCommand);
+program.addCommand(statusCommand);
+program.parseAsync().catch((err) => {
+  console.error(err.message ?? err);
+  process.exit(1);
+});
+//# sourceMappingURL=memex.mjs.map