@wipcomputer/memory-crystal 0.7.34-alpha.1 → 0.7.34-alpha.3

package/dist/installer.js

@@ -1,29 +1,724 @@
-import {
-  deployBackupScript,
-  deployCaptureScript,
-  getAgentId,
-  installCron,
-  ldmPaths,
-  loadAgentConfig,
-  saveAgentConfig,
-  scaffoldLdm
-} from "./chunk-DFQ72B7M.js";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
-// src/installer.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, copyFileSync, readdirSync, statSync } from "fs";
+// src/ldm.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, readdirSync } from "fs";
 import { join, dirname } from "path";
 import { execSync } from "child_process";
 import { fileURLToPath } from "url";
-var HOME = process.env.HOME || "";
-var LDM_ROOT = join(HOME, ".ldm");
-var OC_ROOT = join(HOME, ".openclaw");
-var CC_SETTINGS = join(HOME, ".claude", "settings.json");
-var CC_MCP = join(HOME, ".claude", ".mcp.json");
-var OC_MCP = join(OC_ROOT, ".mcp.json");
+function loadAgentConfig(id) {
+  const cfgPath = join(LDM_ROOT, "agents", id, "config.json");
+  try {
+    if (existsSync(cfgPath)) return JSON.parse(readFileSync(cfgPath, "utf-8"));
+  } catch {
+  }
+  return null;
+}
+function saveAgentConfig(id, config) {
+  const dir = join(LDM_ROOT, "agents", id);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, "config.json"), JSON.stringify(config, null, 2) + "\n");
+}
+function getAgentId(harnessHint) {
+  if (process.env.CRYSTAL_AGENT_ID) return process.env.CRYSTAL_AGENT_ID;
+  const agentsDir = join(LDM_ROOT, "agents");
+  if (existsSync(agentsDir)) {
+    try {
+      for (const d of readdirSync(agentsDir)) {
+        const cfg = loadAgentConfig(d);
+        if (!cfg || !cfg.agentId) continue;
+        if (!harnessHint) return cfg.agentId;
+        if (harnessHint === "claude-code" && cfg.harness === "claude-code-cli") return cfg.agentId;
+        if (harnessHint === "openclaw" && cfg.harness === "openclaw") return cfg.agentId;
+      }
+    } catch {
+    }
+  }
+  return harnessHint === "openclaw" ? "oc-lesa-mini" : "cc-mini";
+}
+function ldmPaths(agentId) {
+  const id = agentId || getAgentId();
+  const agentRoot = join(LDM_ROOT, "agents", id);
+  return {
+    root: LDM_ROOT,
+    bin: join(LDM_ROOT, "bin"),
+    secrets: join(LDM_ROOT, "secrets"),
+    state: join(LDM_ROOT, "state"),
+    config: join(LDM_ROOT, "config.json"),
+    crystalDb: join(LDM_ROOT, "memory", "crystal.db"),
+    crystalLance: join(LDM_ROOT, "memory", "lance"),
+    agentRoot,
+    transcripts: join(agentRoot, "memory", "transcripts"),
+    sessions: join(agentRoot, "memory", "sessions"),
+    daily: join(agentRoot, "memory", "daily"),
+    journals: join(agentRoot, "memory", "journals"),
+    workspace: join(agentRoot, "memory", "workspace")
+  };
+}
+function loadConfig() {
+  const configPath = join(LDM_ROOT, "config.json");
+  try {
+    if (existsSync(configPath)) {
+      return JSON.parse(readFileSync(configPath, "utf-8"));
+    }
+  } catch {
+  }
+  return null;
+}
+function saveConfig(config) {
+  const configPath = join(LDM_ROOT, "config.json");
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+function scaffoldLdm(agentId) {
+  const paths = ldmPaths(agentId);
+  mkdirSync(join(paths.root, "memory"), { recursive: true });
+  mkdirSync(paths.crystalLance, { recursive: true });
+  mkdirSync(paths.bin, { recursive: true });
+  mkdirSync(paths.secrets, { recursive: true, mode: 448 });
+  mkdirSync(paths.state, { recursive: true });
+  mkdirSync(paths.transcripts, { recursive: true });
+  mkdirSync(paths.sessions, { recursive: true });
+  mkdirSync(paths.daily, { recursive: true });
+  mkdirSync(paths.journals, { recursive: true });
+  mkdirSync(paths.workspace, { recursive: true });
+  const id = agentId || getAgentId();
+  let config = loadConfig();
+  if (!config) {
+    config = {
+      version: "1.0.0",
+      agents: [id],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  } else {
+    if (!config.agents.includes(id)) {
+      config.agents.push(id);
+    }
+    config.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  }
+  saveConfig(config);
+  return paths;
+}
+function deployCaptureScript() {
+  const paths = ldmPaths();
+  mkdirSync(paths.bin, { recursive: true });
+  const thisDir = dirname(fileURLToPath(import.meta.url));
+  let scriptSrc = join(thisDir, "crystal-capture.sh");
+  if (!existsSync(scriptSrc)) {
+    scriptSrc = join(thisDir, "..", "scripts", "crystal-capture.sh");
+  }
+  const scriptDest = join(paths.bin, "crystal-capture.sh");
+  if (!existsSync(scriptSrc)) {
+    throw new Error(`crystal-capture.sh not found at ${scriptSrc}`);
+  }
+  copyFileSync(scriptSrc, scriptDest);
+  chmodSync(scriptDest, 493);
+  return scriptDest;
+}
+function isCrystalCaptureLine(line) {
+  return line === CRON_TAG || line.includes("crystal-capture.sh") && line.startsWith("*");
+}
+function installCron() {
+  mkdirSync(join(HOME, ".ldm", "logs"), { recursive: true });
+  let existing = "";
+  try {
+    existing = execSync("crontab -l 2>/dev/null", { encoding: "utf8" });
+  } catch {
+  }
+  const lines = existing.split("\n").filter((line) => !isCrystalCaptureLine(line));
+  lines.push(CRON_TAG);
+  lines.push(CRON_ENTRY);
+  const newCrontab = lines.filter((l, i, arr) => !(l === "" && i === arr.length - 1)).join("\n") + "\n";
+  execSync("crontab -", { input: newCrontab, encoding: "utf8" });
+}
+function deployBackupScript() {
+  const paths = ldmPaths();
+  mkdirSync(paths.bin, { recursive: true });
+  const thisDir = dirname(fileURLToPath(import.meta.url));
+  let scriptSrc = join(thisDir, "ldm-backup.sh");
+  if (!existsSync(scriptSrc)) {
+    scriptSrc = join(thisDir, "..", "scripts", "ldm-backup.sh");
+  }
+  const scriptDest = join(paths.bin, "ldm-backup.sh");
+  if (!existsSync(scriptSrc)) {
+    throw new Error(`ldm-backup.sh not found at ${scriptSrc}`);
+  }
+  copyFileSync(scriptSrc, scriptDest);
+  chmodSync(scriptDest, 493);
+  return scriptDest;
+}
+function resolveStatePath(filename) {
+  const paths = ldmPaths();
+  const ldmPath = join(paths.state, filename);
+  if (existsSync(ldmPath)) return ldmPath;
+  const legacyPath = join(LEGACY_OC_DIR, "memory", filename);
+  if (existsSync(legacyPath)) return legacyPath;
+  return ldmPath;
+}
+function stateWritePath(filename) {
+  const paths = ldmPaths();
+  const dir = paths.state;
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return join(dir, filename);
+}
+function resolveSecretPath(filename) {
+  const paths = ldmPaths();
+  const ldmPath = join(paths.secrets, filename);
+  if (existsSync(ldmPath)) return ldmPath;
+  const legacyPath = join(LEGACY_OC_DIR, "secrets", filename);
+  if (existsSync(legacyPath)) return legacyPath;
+  return ldmPath;
+}
+var HOME, LDM_ROOT, CRON_TAG, CRON_ENTRY, LEGACY_OC_DIR;
+var init_ldm = __esm({
+  "src/ldm.ts"() {
+    "use strict";
+    HOME = process.env.HOME || "";
+    LDM_ROOT = join(HOME, ".ldm");
+    CRON_TAG = "# crystal-capture";
+    CRON_ENTRY = "* * * * * ~/.ldm/bin/crystal-capture.sh >> ~/.ldm/logs/crystal-capture.log 2>&1";
+    LEGACY_OC_DIR = join(HOME, ".openclaw");
+  }
+});
+
+// src/mlx-setup.ts
+var mlx_setup_exports = {};
+__export(mlx_setup_exports, {
+  MLX_CONFIG: () => MLX_CONFIG,
+  canRunMlx: () => canRunMlx,
+  createLaunchAgent: () => createLaunchAgent,
+  detectPlatform: () => detectPlatform,
+  doctorCheck: () => doctorCheck,
+  installMlxLm: () => installMlxLm,
+  isMlxLmInstalled: () => isMlxLmInstalled,
+  isServerRunning: () => isServerRunning,
+  setupMlx: () => setupMlx,
+  startServer: () => startServer,
+  stopServer: () => stopServer,
+  verifyServer: () => verifyServer
+});
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { join as join2 } from "path";
+import { homedir } from "os";
+function detectPlatform() {
+  const platform = process.platform;
+  const arch = process.arch;
+  if (platform === "darwin") {
+    return arch === "arm64" ? "apple-silicon" : "intel-mac";
+  }
+  if (platform === "linux") return "linux";
+  return "other";
+}
+function canRunMlx() {
+  return detectPlatform() === "apple-silicon";
+}
+function findPython() {
+  const candidates = ["python3", "/opt/homebrew/bin/python3", "/usr/local/bin/python3"];
+  for (const cmd of candidates) {
+    try {
+      const version = execSync2(`${cmd} --version 2>&1`, { encoding: "utf-8", timeout: 5e3 }).trim();
+      const match = version.match(/Python (\d+)\.(\d+)/);
+      if (match && parseInt(match[1]) >= 3 && parseInt(match[2]) >= 10) {
+        const realPath = execSync2(`which ${cmd} 2>/dev/null`, { encoding: "utf-8", timeout: 3e3 }).trim();
+        return realPath || cmd;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function findInstaller() {
+  try {
+    execSync2("uv --version 2>/dev/null", { encoding: "utf-8", timeout: 3e3 });
+    return "uv";
+  } catch {
+  }
+  try {
+    execSync2("pip3 --version 2>/dev/null", { encoding: "utf-8", timeout: 3e3 });
+    return "pip3";
+  } catch {
+  }
+  return null;
+}
+function isMlxLmInstalled() {
+  try {
+    execSync2('python3 -c "import mlx_lm" 2>/dev/null', { timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installMlxLm(steps) {
+  const installer = findInstaller();
+  if (!installer) {
+    steps.push("No pip3 or uv found. Cannot install mlx-lm.");
+    return false;
+  }
+  const cmd = installer === "uv" ? "uv pip install mlx-lm" : "pip3 install mlx-lm";
+  steps.push(`Installing mlx-lm via ${installer}...`);
+  try {
+    execSync2(cmd, { encoding: "utf-8", timeout: 12e4, stdio: "pipe" });
+    steps.push("mlx-lm installed successfully.");
+    return true;
+  } catch (err) {
+    if (installer === "pip3") {
+      try {
+        execSync2("pip3 install --user mlx-lm", { encoding: "utf-8", timeout: 12e4, stdio: "pipe" });
+        steps.push("mlx-lm installed (--user) successfully.");
+        return true;
+      } catch {
+      }
+    }
+    steps.push(`mlx-lm install failed: ${err.message.slice(0, 200)}`);
+    return false;
+  }
+}
+function isServerRunning() {
+  try {
+    const state = loadState();
+    const port = state?.port || MLX_PORT;
+    execSync2(`curl -s -o /dev/null -w "%{http_code}" http://localhost:${port}/v1/models`, {
+      encoding: "utf-8",
+      timeout: 3e3
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createLaunchAgent(pythonPath, steps) {
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${MLX_PLIST_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${pythonPath}</string>
+    <string>-m</string>
+    <string>mlx_lm.server</string>
+    <string>--model</string>
+    <string>${MLX_MODEL}</string>
+    <string>--port</string>
+    <string>${MLX_PORT}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${MLX_LOG_PATH}</string>
+  <key>StandardErrorPath</key>
+  <string>${MLX_LOG_PATH}</string>
+</dict>
+</plist>`;
+  try {
+    writeFileSync2(MLX_PLIST_PATH, plist);
+    execSync2(`launchctl load "${MLX_PLIST_PATH}" 2>/dev/null`, { timeout: 5e3 });
+    steps.push(`LaunchAgent installed at ${MLX_PLIST_PATH}`);
+    steps.push(`MLX server will start on port ${MLX_PORT}`);
+    return true;
+  } catch (err) {
+    steps.push(`LaunchAgent install failed: ${err.message}`);
+    return false;
+  }
+}
+function startServer(steps) {
+  try {
+    execSync2(`launchctl kickstart -kp gui/$(id -u)/${MLX_PLIST_LABEL} 2>/dev/null`, { timeout: 1e4 });
+    steps.push("MLX server started.");
+    return true;
+  } catch {
+    steps.push("MLX server start failed. Check /tmp/mlx-server.log");
+    return false;
+  }
+}
+function stopServer() {
+  try {
+    execSync2(`launchctl unload "${MLX_PLIST_PATH}" 2>/dev/null`, { timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function loadState() {
+  try {
+    if (existsSync2(MLX_STATE_FILE)) {
+      return JSON.parse(readFileSync2(MLX_STATE_FILE, "utf-8"));
+    }
+  } catch {
+  }
+  return null;
+}
+function saveState(state) {
+  const dir = join2(HOME2, ".ldm", "state");
+  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(MLX_STATE_FILE, JSON.stringify(state, null, 2) + "\n");
+}
+async function verifyServer(steps) {
+  const state = loadState();
+  const port = state?.port || MLX_PORT;
+  for (let i = 0; i < 15; i++) {
+    try {
+      const resp = await fetch(`http://localhost:${port}/v1/models`, {
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (resp.ok) {
+        const data = await resp.json();
+        const model = data?.data?.[0]?.id || "unknown";
+        steps.push(`MLX server verified: ${model} on port ${port}`);
+        return true;
+      }
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  steps.push("MLX server did not respond within 30 seconds. Check /tmp/mlx-server.log");
+  return false;
+}
+async function setupMlx(options) {
+  const steps = [];
+  const platform = detectPlatform();
+  if (platform !== "apple-silicon") {
+    steps.push(`Platform: ${platform}. MLX requires Apple Silicon. Skipping.`);
+    return { ok: false, steps };
+  }
+  steps.push("Platform: Apple Silicon detected.");
+  const pythonPath = findPython();
+  if (!pythonPath) {
+    steps.push("Python 3.10+ not found. Install via: brew install python3");
+    return { ok: false, steps };
+  }
+  steps.push(`Python: ${pythonPath}`);
+  if (!isMlxLmInstalled()) {
+    if (!options?.yes) {
+      steps.push("mlx-lm not installed. Run with --yes to auto-install, or: pip3 install mlx-lm");
+      return { ok: false, steps };
+    }
+    const installed = installMlxLm(steps);
+    if (!installed) return { ok: false, steps };
+  } else {
+    steps.push("mlx-lm: already installed.");
+  }
+  if (!existsSync2(MLX_PLIST_PATH)) {
+    const created = createLaunchAgent(pythonPath, steps);
+    if (!created) return { ok: false, steps };
+  } else {
+    steps.push("LaunchAgent: already installed.");
+  }
+  saveState({
+    installed: true,
+    port: MLX_PORT,
+    model: MLX_MODEL,
+    pythonPath,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (!isServerRunning()) {
+    startServer(steps);
+    steps.push(`Waiting for model to load (~1.5 GB on first run)...`);
+    const verified = await verifyServer(steps);
+    if (!verified) {
+      steps.push("Server started but not yet responding. It may still be downloading the model.");
+      steps.push(`Check: tail -f ${MLX_LOG_PATH}`);
+    }
+  } else {
+    steps.push(`MLX server: already running on port ${MLX_PORT}`);
+  }
+  return { ok: true, steps };
+}
+function doctorCheck() {
+  const platform = detectPlatform();
+  if (platform !== "apple-silicon") {
+    return { status: "skip", detail: `${platform} (MLX requires Apple Silicon)` };
+  }
+  const state = loadState();
+  if (!state || !state.installed) {
+    return {
+      status: "warn",
+      detail: "not installed",
+      fix: "crystal init (will offer MLX setup)"
+    };
+  }
+  if (isServerRunning()) {
+    return { status: "ok", detail: `running on port ${state.port} (${state.model})` };
+  }
+  if (existsSync2(MLX_PLIST_PATH)) {
+    return {
+      status: "warn",
+      detail: "installed but not running",
+      fix: `launchctl kickstart -kp gui/$(id -u)/${MLX_PLIST_LABEL}`
+    };
+  }
+  return {
+    status: "warn",
+    detail: "installed but LaunchAgent missing",
+    fix: "crystal init (will recreate LaunchAgent)"
+  };
+}
+var HOME2, MLX_PORT, MLX_MODEL, MLX_STATE_FILE, MLX_PLIST_LABEL, MLX_PLIST_PATH, MLX_LOG_PATH, MLX_CONFIG;
+var init_mlx_setup = __esm({
+  "src/mlx-setup.ts"() {
+    "use strict";
+    HOME2 = homedir();
+    MLX_PORT = 18791;
+    MLX_MODEL = "mlx-community/Qwen2.5-3B-Instruct-4bit";
+    MLX_STATE_FILE = join2(HOME2, ".ldm", "state", "mlx-server.json");
+    MLX_PLIST_LABEL = "ai.ldm.mlx-server";
+    MLX_PLIST_PATH = join2(HOME2, "Library", "LaunchAgents", `${MLX_PLIST_LABEL}.plist`);
+    MLX_LOG_PATH = "/tmp/mlx-server.log";
+    MLX_CONFIG = {
+      port: MLX_PORT,
+      model: MLX_MODEL,
+      plistPath: MLX_PLIST_PATH,
+      logPath: MLX_LOG_PATH,
+      stateFile: MLX_STATE_FILE
+    };
+  }
+});
+
+// src/role.ts
+var role_exports = {};
+__export(role_exports, {
+  demoteToNode: () => demoteToNode,
+  detectRole: () => detectRole,
+  loadRoleState: () => loadRoleState,
+  promoteToCore: () => promoteToCore
+});
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+function loadRoleState() {
+  try {
+    const path = resolveStatePath(STATE_FILE);
+    if (existsSync3(path)) {
+      return JSON.parse(readFileSync3(path, "utf-8"));
+    }
+  } catch {
+  }
+  return null;
+}
+function saveRoleState(state) {
+  const writePath = stateWritePath(STATE_FILE);
+  writeFileSync3(writePath, JSON.stringify(state, null, 2) + "\n");
+}
+function hasLocalEmbeddingProvider() {
+  if (process.env.OPENAI_API_KEY) return true;
+  if (process.env.GOOGLE_API_KEY && process.env.CRYSTAL_EMBEDDING_PROVIDER === "google") return true;
+  if (process.env.CRYSTAL_EMBEDDING_PROVIDER === "ollama") return true;
+  return false;
+}
+function hasRelayKey() {
+  const keyPath = resolveSecretPath("crystal-relay-key");
+  return existsSync3(keyPath);
+}
+function detectRole() {
+  const agentId = getAgentId();
+  const paths = ldmPaths(agentId);
+  const relayUrl = process.env.CRYSTAL_RELAY_URL || null;
+  const relayToken = !!process.env.CRYSTAL_RELAY_TOKEN;
+  const relayKeyExists = hasRelayKey();
+  const localEmbeddings = hasLocalEmbeddingProvider();
+  const localDb = existsSync3(paths.crystalDb);
+  const state = loadRoleState();
+  if (state && state.override) {
+    return {
+      role: state.role,
+      source: "state-file",
+      relayUrl,
+      relayToken,
+      relayKeyExists,
+      agentId,
+      hasLocalEmbeddings: localEmbeddings,
+      hasLocalDb: localDb
+    };
+  }
+  let role = "core";
+  if ((relayUrl || relayKeyExists) && !localEmbeddings) {
+    role = "node";
+  } else if ((relayUrl || relayKeyExists) && localEmbeddings) {
+    role = "core";
+  }
+  return {
+    role,
+    source: "auto-detected",
+    relayUrl,
+    relayToken,
+    relayKeyExists,
+    agentId,
+    hasLocalEmbeddings: localEmbeddings,
+    hasLocalDb: localDb
+  };
+}
+function promoteToCore() {
+  saveRoleState({
+    role: "core",
+    override: true,
+    agentId: getAgentId(),
+    setAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function demoteToNode(relayUrl) {
+  saveRoleState({
+    role: "node",
+    override: true,
+    relayUrl,
+    agentId: getAgentId(),
+    setAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+var STATE_FILE;
+var init_role = __esm({
+  "src/role.ts"() {
+    "use strict";
+    init_ldm();
+    STATE_FILE = "crystal-role.json";
+  }
+});
+
+// src/crypto.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
+import { createHash } from "crypto";
+function loadRelayKey() {
+  if (!existsSync4(KEY_PATH)) {
+    throw new Error(
+      `Relay key not found at ${KEY_PATH}
+Generate one: mkdir -p ~/.ldm/secrets && openssl rand -base64 32 > ~/.ldm/secrets/crystal-relay-key && chmod 600 ~/.ldm/secrets/crystal-relay-key
+Or run: crystal pair`
+    );
+  }
+  const raw = readFileSync4(KEY_PATH, "utf-8").trim();
+  const key = Buffer.from(raw, "base64");
+  if (key.length !== 32) {
+    throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
+  }
+  return key;
+}
+function generateRelayKey() {
+  return randomBytes(32);
+}
+function encodePairingString(key) {
+  if (key.length !== 32) throw new Error("Key must be 32 bytes");
+  return `mc1:${key.toString("base64")}`;
+}
+function decodePairingString(str) {
+  const trimmed = str.trim();
+  if (!trimmed.startsWith("mc1:")) {
+    throw new Error("Invalid pairing string (expected mc1: prefix)");
+  }
+  const key = Buffer.from(trimmed.slice(4), "base64");
+  if (key.length !== 32) {
+    throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
+  }
+  return key;
+}
+var KEY_PATH, RELAY_KEY_PATH;
+var init_crypto = __esm({
+  "src/crypto.ts"() {
+    "use strict";
+    init_ldm();
+    KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || resolveSecretPath("crystal-relay-key");
+    RELAY_KEY_PATH = KEY_PATH;
+  }
+});
+
+// src/pair.ts
+var pair_exports = {};
+__export(pair_exports, {
+  pairReceive: () => pairReceive,
+  pairShow: () => pairShow
+});
+import { existsSync as existsSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4, chmodSync as chmodSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+import qrcode from "qrcode-terminal";
+function generateQR(text) {
+  return new Promise((resolve) => {
+    qrcode.generate(text, { small: true }, (code) => {
+      resolve(code);
+    });
+  });
+}
+function saveKey(key) {
+  const dir = dirname2(RELAY_KEY_PATH);
+  if (!existsSync5(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  writeFileSync4(RELAY_KEY_PATH, key.toString("base64") + "\n", { mode: 384 });
+  try {
+    chmodSync2(RELAY_KEY_PATH, 384);
+  } catch {
+  }
+}
+async function pairShow() {
+  let key;
+  try {
+    key = loadRelayKey();
+    console.log("Relay key found.\n");
+  } catch {
+    console.log("No relay key found. Generating one...");
+    key = generateRelayKey();
+    saveKey(key);
+    console.log(`Key saved to ${RELAY_KEY_PATH}
+`);
+  }
+  const pairingString = encodePairingString(key);
+  console.log("Scan this QR code from your other device:\n");
+  const qr = await generateQR(pairingString);
+  console.log(qr);
+  console.log("Or copy this pairing code:\n");
+  console.log(`  ${pairingString}
+`);
+  console.log("On the other device, run:");
+  console.log(`  crystal pair --code ${pairingString}
+`);
+}
+function pairReceive(code) {
+  const key = decodePairingString(code);
+  if (existsSync5(RELAY_KEY_PATH)) {
+    try {
+      const existing = loadRelayKey();
+      if (existing.equals(key)) {
+        console.log("This device already has the same key. Nothing to do.");
+        return;
+      }
+      console.log("Replacing existing relay key with new key from pairing code.");
+    } catch {
+    }
+  }
+  saveKey(key);
+  console.log(`Key received and saved to ${RELAY_KEY_PATH}`);
+  console.log("Relay encryption is now active on this device.");
+}
+var init_pair = __esm({
+  "src/pair.ts"() {
+    "use strict";
+    init_crypto();
+  }
+});
+
+// src/installer.ts
+init_ldm();
+import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, cpSync, copyFileSync as copyFileSync2, readdirSync as readdirSync2, statSync } from "fs";
+import { join as join3, dirname as dirname3 } from "path";
+import { execSync as execSync3 } from "child_process";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var HOME3 = process.env.HOME || "";
+var LDM_ROOT2 = join3(HOME3, ".ldm");
+var OC_ROOT = join3(HOME3, ".openclaw");
+var CC_SETTINGS = join3(HOME3, ".claude", "settings.json");
+var CC_MCP = join3(HOME3, ".claude", ".mcp.json");
+var OC_MCP = join3(OC_ROOT, ".mcp.json");
 function readVersion(pkgPath) {
   try {
-    if (existsSync(pkgPath)) {
-      const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    if (existsSync6(pkgPath)) {
+      const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
       return pkg.version || null;
     }
   } catch {
@@ -31,20 +726,20 @@ function readVersion(pkgPath) {
   return null;
 }
 function getRepoRoot() {
-  const thisDir = dirname(fileURLToPath(import.meta.url));
+  const thisDir = dirname3(fileURLToPath2(import.meta.url));
   let dir = thisDir;
   for (let i = 0; i < 5; i++) {
-    const pkgPath = join(dir, "package.json");
-    if (existsSync(pkgPath)) {
+    const pkgPath = join3(dir, "package.json");
+    if (existsSync6(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync5(pkgPath, "utf-8"));
         if (pkg.name === "@wipcomputer/memory-crystal") return dir;
       } catch {
       }
     }
-    dir = dirname(dir);
+    dir = dirname3(dir);
   }
-  return dirname(thisDir);
+  return dirname3(thisDir);
 }
 function semverCompare(a, b) {
   const pa = a.split(".").map(Number);
@@ -59,7 +754,7 @@ function getLatestNpmVersion() {
   const names = ["@wipcomputer/memory-crystal", "memory-crystal"];
   for (const name of names) {
     try {
-      const v = execSync(`npm view ${name} version 2>/dev/null`, { encoding: "utf-8", timeout: 1e4 }).trim();
+      const v = execSync3(`npm view ${name} version 2>/dev/null`, { encoding: "utf-8", timeout: 1e4 }).trim();
       if (v) return v;
     } catch {
     }
@@ -67,19 +762,19 @@ function getLatestNpmVersion() {
   return null;
 }
 function detectInstallState() {
-  const ldmExtDir = join(LDM_ROOT, "extensions", "memory-crystal");
-  const ocExtDir = join(OC_ROOT, "extensions", "memory-crystal");
+  const ldmExtDir = join3(LDM_ROOT2, "extensions", "memory-crystal");
+  const ocExtDir = join3(OC_ROOT, "extensions", "memory-crystal");
   const paths = ldmPaths();
-  const installedVersion = readVersion(join(ldmExtDir, "package.json"));
+  const installedVersion = readVersion(join3(ldmExtDir, "package.json"));
   const repoRoot = getRepoRoot();
-  let repoVersion = readVersion(join(repoRoot, "package.json")) || "0.0.0";
+  let repoVersion = readVersion(join3(repoRoot, "package.json")) || "0.0.0";
   const npmVersion = getLatestNpmVersion();
   if (npmVersion && semverCompare(npmVersion, repoVersion) > 0) repoVersion = npmVersion;
-  const ccHookDeployed = existsSync(join(ldmExtDir, "dist", "cc-hook.js"));
+  const ccHookDeployed = existsSync6(join3(ldmExtDir, "dist", "cc-hook.js"));
   let ccHookConfigured = false;
   try {
-    if (existsSync(CC_SETTINGS)) {
-      const settings = JSON.parse(readFileSync(CC_SETTINGS, "utf-8"));
+    if (existsSync6(CC_SETTINGS)) {
+      const settings = JSON.parse(readFileSync5(CC_SETTINGS, "utf-8"));
       const stopHooks = settings?.hooks?.Stop;
       if (Array.isArray(stopHooks)) {
         ccHookConfigured = stopHooks.some((entry) => {
@@ -92,10 +787,10 @@ function detectInstallState() {
   } catch {
   }
   let mcpRegistered = false;
-  for (const mcpPath of [CC_MCP, OC_MCP, join(process.cwd(), ".mcp.json")]) {
+  for (const mcpPath of [CC_MCP, OC_MCP, join3(process.cwd(), ".mcp.json")]) {
     try {
-      if (existsSync(mcpPath)) {
-        const config = JSON.parse(readFileSync(mcpPath, "utf-8"));
+      if (existsSync6(mcpPath)) {
+        const config = JSON.parse(readFileSync5(mcpPath, "utf-8"));
         if (config?.mcpServers?.["memory-crystal"]) {
           mcpRegistered = true;
           break;
@@ -106,24 +801,24 @@ function detectInstallState() {
   }
   if (!mcpRegistered) {
     try {
-      execSync("claude mcp get memory-crystal 2>/dev/null", { encoding: "utf-8", timeout: 5e3, stdio: "pipe" });
+      execSync3("claude mcp get memory-crystal 2>/dev/null", { encoding: "utf-8", timeout: 5e3, stdio: "pipe" });
       mcpRegistered = true;
     } catch {
     }
   }
-  const ocDetected = existsSync(join(OC_ROOT, "openclaw.json"));
-  const ocPluginDeployed = existsSync(join(ocExtDir, "dist", "openclaw.js"));
+  const ocDetected = existsSync6(join3(OC_ROOT, "openclaw.json"));
+  const ocPluginDeployed = existsSync6(join3(ocExtDir, "dist", "openclaw.js"));
   let cronInstalled = false;
   try {
-    const crontab = execSync("crontab -l 2>/dev/null", { encoding: "utf-8" });
+    const crontab = execSync3("crontab -l 2>/dev/null", { encoding: "utf-8" });
     cronInstalled = crontab.includes("crystal-capture");
   } catch {
   }
   const role = "core";
-  const relayKeyExists = existsSync(join(LDM_ROOT, "secrets", "crystal-relay-key"));
+  const relayKeyExists = existsSync6(join3(LDM_ROOT2, "secrets", "crystal-relay-key"));
   return {
-    ldmExists: existsSync(LDM_ROOT),
-    crystalDbExists: existsSync(paths.crystalDb),
+    ldmExists: existsSync6(LDM_ROOT2),
+    crystalDbExists: existsSync6(paths.crystalDb),
     ccHookDeployed,
     ccHookConfigured,
     mcpRegistered,
@@ -139,42 +834,42 @@ function detectInstallState() {
 }
 function deployToLdm() {
   const repoRoot = getRepoRoot();
-  const sourceDir = join(repoRoot, "dist");
-  const extDir = join(LDM_ROOT, "extensions", "memory-crystal");
-  const destDist = join(extDir, "dist");
-  if (!existsSync(sourceDir)) {
+  const sourceDir = join3(repoRoot, "dist");
+  const extDir = join3(LDM_ROOT2, "extensions", "memory-crystal");
+  const destDist = join3(extDir, "dist");
+  if (!existsSync6(sourceDir)) {
     throw new Error(`dist/ not found at ${sourceDir}. Run "npm run build" first.`);
   }
-  mkdirSync(destDist, { recursive: true });
-  const distFiles = readdirSync(sourceDir);
+  mkdirSync5(destDist, { recursive: true });
+  const distFiles = readdirSync2(sourceDir);
   for (const file of distFiles) {
-    const srcPath = join(sourceDir, file);
-    const destPath = join(destDist, file);
+    const srcPath = join3(sourceDir, file);
+    const destPath = join3(destDist, file);
     const stat = statSync(srcPath);
     if (stat.isFile()) {
-      copyFileSync(srcPath, destPath);
+      copyFileSync2(srcPath, destPath);
     } else if (stat.isDirectory()) {
       cpSync(srcPath, destPath, { recursive: true });
     }
   }
-  copyFileSync(join(repoRoot, "package.json"), join(extDir, "package.json"));
-  const pluginJson = join(repoRoot, "openclaw.plugin.json");
-  if (existsSync(pluginJson)) {
-    copyFileSync(pluginJson, join(extDir, "openclaw.plugin.json"));
+  copyFileSync2(join3(repoRoot, "package.json"), join3(extDir, "package.json"));
+  const pluginJson = join3(repoRoot, "openclaw.plugin.json");
+  if (existsSync6(pluginJson)) {
+    copyFileSync2(pluginJson, join3(extDir, "openclaw.plugin.json"));
   }
-  const skillsDir = join(repoRoot, "skills");
-  if (existsSync(skillsDir)) {
-    cpSync(skillsDir, join(extDir, "skills"), { recursive: true });
+  const skillsDir = join3(repoRoot, "skills");
+  if (existsSync6(skillsDir)) {
+    cpSync(skillsDir, join3(extDir, "skills"), { recursive: true });
   }
-  const version = readVersion(join(extDir, "package.json")) || "unknown";
+  const version = readVersion(join3(extDir, "package.json")) || "unknown";
   return { extensionDir: extDir, version };
 }
 function installLdmDeps() {
-  const extDir = join(LDM_ROOT, "extensions", "memory-crystal");
-  if (!existsSync(join(extDir, "package.json"))) {
+  const extDir = join3(LDM_ROOT2, "extensions", "memory-crystal");
+  if (!existsSync6(join3(extDir, "package.json"))) {
     throw new Error("package.json not found in LDM extension dir. Deploy first.");
   }
-  execSync("npm install --omit=dev", {
+  execSync3("npm install --omit=dev", {
     cwd: extDir,
     encoding: "utf-8",
     stdio: "pipe",
@@ -183,42 +878,42 @@ function installLdmDeps() {
 }
 function deployToOpenClaw() {
   const repoRoot = getRepoRoot();
-  const sourceDir = join(repoRoot, "dist");
-  const extDir = join(OC_ROOT, "extensions", "memory-crystal");
-  const destDist = join(extDir, "dist");
-  if (!existsSync(sourceDir)) {
+  const sourceDir = join3(repoRoot, "dist");
+  const extDir = join3(OC_ROOT, "extensions", "memory-crystal");
+  const destDist = join3(extDir, "dist");
+  if (!existsSync6(sourceDir)) {
     throw new Error(`dist/ not found at ${sourceDir}. Run "npm run build" first.`);
   }
-  mkdirSync(destDist, { recursive: true });
-  const distFiles = readdirSync(sourceDir);
+  mkdirSync5(destDist, { recursive: true });
+  const distFiles = readdirSync2(sourceDir);
   for (const file of distFiles) {
-    const srcPath = join(sourceDir, file);
-    const destPath = join(destDist, file);
+    const srcPath = join3(sourceDir, file);
+    const destPath = join3(destDist, file);
     const stat = statSync(srcPath);
     if (stat.isFile()) {
-      copyFileSync(srcPath, destPath);
+      copyFileSync2(srcPath, destPath);
     } else if (stat.isDirectory()) {
       cpSync(srcPath, destPath, { recursive: true });
     }
   }
-  copyFileSync(join(repoRoot, "package.json"), join(extDir, "package.json"));
-  const pluginJson = join(repoRoot, "openclaw.plugin.json");
-  if (existsSync(pluginJson)) {
-    copyFileSync(pluginJson, join(extDir, "openclaw.plugin.json"));
+  copyFileSync2(join3(repoRoot, "package.json"), join3(extDir, "package.json"));
+  const pluginJson = join3(repoRoot, "openclaw.plugin.json");
+  if (existsSync6(pluginJson)) {
+    copyFileSync2(pluginJson, join3(extDir, "openclaw.plugin.json"));
   }
-  const skillsDir = join(repoRoot, "skills");
-  if (existsSync(skillsDir)) {
-    cpSync(skillsDir, join(extDir, "skills"), { recursive: true });
+  const skillsDir = join3(repoRoot, "skills");
+  if (existsSync6(skillsDir)) {
+    cpSync(skillsDir, join3(extDir, "skills"), { recursive: true });
   }
-  const version = readVersion(join(extDir, "package.json")) || "unknown";
+  const version = readVersion(join3(extDir, "package.json")) || "unknown";
   return { extensionDir: extDir, version };
 }
 function installOcDeps() {
-  const extDir = join(OC_ROOT, "extensions", "memory-crystal");
-  if (!existsSync(join(extDir, "package.json"))) {
+  const extDir = join3(OC_ROOT, "extensions", "memory-crystal");
+  if (!existsSync6(join3(extDir, "package.json"))) {
     throw new Error("package.json not found in OC extension dir. Deploy first.");
   }
-  execSync("npm install --omit=dev", {
+  execSync3("npm install --omit=dev", {
     cwd: extDir,
     encoding: "utf-8",
     stdio: "pipe",
@@ -226,11 +921,11 @@ function installOcDeps() {
   });
 }
 function configureCCHook() {
-  const hookCommand = `node ${join(LDM_ROOT, "extensions", "memory-crystal", "dist", "cc-hook.js")}`;
+  const hookCommand = `node ${join3(LDM_ROOT2, "extensions", "memory-crystal", "dist", "cc-hook.js")}`;
   let settings = {};
-  if (existsSync(CC_SETTINGS)) {
+  if (existsSync6(CC_SETTINGS)) {
     try {
-      settings = JSON.parse(readFileSync(CC_SETTINGS, "utf-8"));
+      settings = JSON.parse(readFileSync5(CC_SETTINGS, "utf-8"));
     } catch {
       throw new Error(`~/.claude/settings.json exists but is not valid JSON. Fix it manually before proceeding.`);
     }
@@ -254,14 +949,14 @@ function configureCCHook() {
   } else {
     settings.hooks.Stop.push(hookEntry);
   }
-  mkdirSync(join(HOME, ".claude"), { recursive: true });
-  writeFileSync(CC_SETTINGS, JSON.stringify(settings, null, 2) + "\n");
+  mkdirSync5(join3(HOME3, ".claude"), { recursive: true });
+  writeFileSync5(CC_SETTINGS, JSON.stringify(settings, null, 2) + "\n");
 }
 function registerMCPServer() {
-  const mcpServerPath = join(LDM_ROOT, "extensions", "memory-crystal", "dist", "mcp-server.js");
+  const mcpServerPath = join3(LDM_ROOT2, "extensions", "memory-crystal", "dist", "mcp-server.js");
   const addCmd = `claude mcp add --scope user -e OPENCLAW_HOME=${OC_ROOT} memory-crystal -- node "${mcpServerPath}"`;
   try {
-    execSync(addCmd, {
+    execSync3(addCmd, {
       encoding: "utf-8",
       stdio: "pipe",
       timeout: 15e3
@@ -271,17 +966,17 @@ function registerMCPServer() {
     const output = (err.stderr || "") + (err.stdout || "");
     if (output.includes("already exists")) {
       try {
-        execSync("claude mcp remove memory-crystal --scope user", { encoding: "utf-8", stdio: "pipe", timeout: 1e4 });
-        execSync(addCmd, { encoding: "utf-8", stdio: "pipe", timeout: 15e3 });
+        execSync3("claude mcp remove memory-crystal --scope user", { encoding: "utf-8", stdio: "pipe", timeout: 1e4 });
+        execSync3(addCmd, { encoding: "utf-8", stdio: "pipe", timeout: 15e3 });
       } catch {
       }
       return;
     }
   }
   let config = {};
-  if (existsSync(CC_MCP)) {
+  if (existsSync6(CC_MCP)) {
     try {
-      config = JSON.parse(readFileSync(CC_MCP, "utf-8"));
+      config = JSON.parse(readFileSync5(CC_MCP, "utf-8"));
     } catch {
     }
   }
@@ -291,15 +986,15 @@ function registerMCPServer() {
     args: [mcpServerPath],
     env: { OPENCLAW_HOME: OC_ROOT }
   };
-  mkdirSync(join(HOME, ".claude"), { recursive: true });
-  writeFileSync(CC_MCP, JSON.stringify(config, null, 2) + "\n");
+  mkdirSync5(join3(HOME3, ".claude"), { recursive: true });
+  writeFileSync5(CC_MCP, JSON.stringify(config, null, 2) + "\n");
 }
 function registerOcMCPServer() {
-  const mcpServerPath = join(OC_ROOT, "extensions", "memory-crystal", "dist", "mcp-server.js");
+  const mcpServerPath = join3(OC_ROOT, "extensions", "memory-crystal", "dist", "mcp-server.js");
   let config = {};
-  if (existsSync(OC_MCP)) {
+  if (existsSync6(OC_MCP)) {
     try {
-      config = JSON.parse(readFileSync(OC_MCP, "utf-8"));
+      config = JSON.parse(readFileSync5(OC_MCP, "utf-8"));
     } catch {
     }
   }
@@ -309,21 +1004,21 @@ function registerOcMCPServer() {
     args: [mcpServerPath],
     env: { OPENCLAW_HOME: OC_ROOT }
   };
-  writeFileSync(OC_MCP, JSON.stringify(config, null, 2) + "\n");
+  writeFileSync5(OC_MCP, JSON.stringify(config, null, 2) + "\n");
 }
 function backupCrystalDb() {
   const paths = ldmPaths();
   const dbPath = paths.crystalDb;
-  if (!existsSync(dbPath)) {
+  if (!existsSync6(dbPath)) {
     throw new Error(`crystal.db not found at ${dbPath}`);
   }
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const backupPath = `${dbPath}.pre-update-${timestamp}`;
-  copyFileSync(dbPath, backupPath);
+  copyFileSync2(dbPath, backupPath);
   const walPath = dbPath + "-wal";
   const shmPath = dbPath + "-shm";
-  if (existsSync(walPath)) copyFileSync(walPath, backupPath + "-wal");
-  if (existsSync(shmPath)) copyFileSync(shmPath, backupPath + "-shm");
+  if (existsSync6(walPath)) copyFileSync2(walPath, backupPath + "-wal");
+  if (existsSync6(shmPath)) copyFileSync2(shmPath, backupPath + "-shm");
   const origSize = statSync(dbPath).size;
   const backupSize = statSync(backupPath).size;
   if (backupSize !== origSize) {
@@ -334,7 +1029,7 @@ function backupCrystalDb() {
 async function verifyCrystalDbReadable() {
   const paths = ldmPaths();
   const dbPath = paths.crystalDb;
-  if (!existsSync(dbPath)) return;
+  if (!existsSync6(dbPath)) return;
   const { default: Database } = await import("better-sqlite3");
   const db = new Database(dbPath, { readonly: true });
   try {
@@ -371,7 +1066,7 @@ function formatUpdateSummary(oldVersion, newVersion) {
 }
 function ldmCliAvailable() {
   try {
-    execSync("ldm --version", { stdio: "pipe", timeout: 5e3 });
+    execSync3("ldm --version", { stdio: "pipe", timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -380,8 +1075,8 @@ function ldmCliAvailable() {
 function bootstrapLdmOs(steps) {
   try {
     steps.push("Installing LDM OS infrastructure...");
-    execSync("npm install -g @wipcomputer/wip-ldm-os", { stdio: "pipe", timeout: 12e4 });
-    execSync("ldm --version", { stdio: "pipe", timeout: 5e3 });
+    execSync3("npm install -g @wipcomputer/wip-ldm-os", { stdio: "pipe", timeout: 12e4 });
+    execSync3("ldm --version", { stdio: "pipe", timeout: 5e3 });
     steps.push("LDM OS installed.");
     return true;
   } catch {
@@ -392,7 +1087,7 @@ function bootstrapLdmOs(steps) {
 function runLdmInstall(repoDir) {
   const steps = [];
   try {
-    execSync("ldm init --yes --none", { stdio: "pipe", timeout: 3e4 });
+    execSync3("ldm init --yes --none", { stdio: "pipe", timeout: 3e4 });
     steps.push("LDM initialized via ldm CLI");
   } catch (err) {
     const msg = (err.stderr || err.message || "").toString().trim();
@@ -401,7 +1096,7 @@ function runLdmInstall(repoDir) {
     }
   }
   try {
-    execSync(`ldm install "${repoDir}"`, { stdio: "pipe", timeout: 6e4 });
+    execSync3(`ldm install "${repoDir}"`, { stdio: "pipe", timeout: 6e4 });
     steps.push("Generic deployment handled by ldm install (extensions, MCP, hooks)");
     return { ok: true, steps };
   } catch (err) {
@@ -432,7 +1127,7 @@ async function runInstallOrUpdate(options) {
     if (npmV && semverCompare(npmV, state.installedVersion) > 0) {
       steps.push(`Upgrading v${state.installedVersion} -> v${npmV} via npm...`);
       try {
-        execSync("npm install -g @wipcomputer/memory-crystal 2>&1", { encoding: "utf-8", timeout: 6e4, stdio: "pipe" });
+        execSync3("npm install -g @wipcomputer/memory-crystal 2>&1", { encoding: "utf-8", timeout: 6e4, stdio: "pipe" });
         steps.push(`Installed @wipcomputer/memory-crystal@${npmV}`);
         steps.push("Continuing with updated code...");
       } catch (err) {
@@ -452,10 +1147,10 @@ async function runInstallOrUpdate(options) {
     steps.push(...delegateResult.steps);
     if (delegateResult.ok) {
       ldmDelegated = true;
-      const ldmExtDir = join(LDM_ROOT, "extensions", "memory-crystal");
-      if (existsSync(ldmExtDir)) deployedTo.push(ldmExtDir);
-      const ocExtDir = join(OC_ROOT, "extensions", "memory-crystal");
-      if (existsSync(ocExtDir)) deployedTo.push(ocExtDir);
+      const ldmExtDir = join3(LDM_ROOT2, "extensions", "memory-crystal");
+      if (existsSync6(ldmExtDir)) deployedTo.push(ldmExtDir);
+      const ocExtDir = join3(OC_ROOT, "extensions", "memory-crystal");
+      if (existsSync6(ocExtDir)) deployedTo.push(ocExtDir);
     }
   }
   if (ldmDelegated) {
@@ -520,13 +1215,13 @@ async function runInstallOrUpdate(options) {
     }
   } else if (options.importDb) {
     const importPath = options.importDb;
-    if (!existsSync(importPath)) {
+    if (!existsSync6(importPath)) {
       steps.push(`Import path not found: ${importPath}`);
     } else {
       try {
         const paths = ldmPaths();
-        mkdirSync(join(paths.root, "memory"), { recursive: true });
-        copyFileSync(importPath, paths.crystalDb);
+        mkdirSync5(join3(paths.root, "memory"), { recursive: true });
+        copyFileSync2(importPath, paths.crystalDb);
         const { default: Database } = await import("better-sqlite3");
         const db = new Database(paths.crystalDb, { readonly: true });
         const row = db.prepare("SELECT COUNT(*) as count FROM chunks").get();
@@ -544,11 +1239,11 @@ async function runInstallOrUpdate(options) {
   }
   if (ldmDelegated) {
     const repoRoot = getRepoRoot();
-    const ldmExtDir = join(LDM_ROOT, "extensions", "memory-crystal");
-    if (existsSync(ldmExtDir)) copyFileSync(join(repoRoot, "package.json"), join(ldmExtDir, "package.json"));
-    const ocExtDir = join(OC_ROOT, "extensions", "memory-crystal");
-    if (existsSync(ocExtDir)) copyFileSync(join(repoRoot, "package.json"), join(ocExtDir, "package.json"));
-    steps.push(`Version synced to v${readVersion(join(repoRoot, "package.json")) || "unknown"}`);
+    const ldmExtDir = join3(LDM_ROOT2, "extensions", "memory-crystal");
+    if (existsSync6(ldmExtDir)) copyFileSync2(join3(repoRoot, "package.json"), join3(ldmExtDir, "package.json"));
+    const ocExtDir = join3(OC_ROOT, "extensions", "memory-crystal");
+    if (existsSync6(ocExtDir)) copyFileSync2(join3(repoRoot, "package.json"), join3(ocExtDir, "package.json"));
+    steps.push(`Version synced to v${readVersion(join3(repoRoot, "package.json")) || "unknown"}`);
   }
   if (!ldmDelegated) {
     const ldmResult = deployToLdm();
@@ -600,11 +1295,11 @@ async function runInstallOrUpdate(options) {
     steps.push(`Backup script failed: ${err.message}`);
   }
   try {
-    const { canRunMlx, isMlxLmInstalled, isServerRunning } = await import("./mlx-setup-XKU67WCT.js");
-    if (canRunMlx()) {
-      if (isServerRunning()) {
+    const { canRunMlx: canRunMlx2, isMlxLmInstalled: isMlxLmInstalled2, isServerRunning: isServerRunning2 } = await Promise.resolve().then(() => (init_mlx_setup(), mlx_setup_exports));
+    if (canRunMlx2()) {
+      if (isServerRunning2()) {
         steps.push("MLX LLM: already running");
-      } else if (isMlxLmInstalled()) {
+      } else if (isMlxLmInstalled2()) {
         steps.push("MLX LLM: installed but not running. Start with: launchctl kickstart -kp gui/$(id -u)/ai.ldm.mlx-server");
       } else {
         steps.push('MLX LLM: Apple Silicon detected. Run "crystal mlx setup" to install local LLM for free, fast, offline search quality.');
@@ -653,16 +1348,16 @@ async function runInstallOrUpdate(options) {
   }
   if (options.role === "core") {
     try {
-      const { promoteToCore } = await import("./role.js");
-      promoteToCore();
+      const { promoteToCore: promoteToCore2 } = await Promise.resolve().then(() => (init_role(), role_exports));
+      promoteToCore2();
       steps.push("Role set to Core");
     } catch (err) {
       steps.push(`Role setup failed: ${err.message}`);
     }
   } else if (options.role === "node") {
     try {
-      const { demoteToNode } = await import("./role.js");
-      demoteToNode();
+      const { demoteToNode: demoteToNode2 } = await Promise.resolve().then(() => (init_role(), role_exports));
+      demoteToNode2();
       steps.push("Role set to Node");
     } catch (err) {
       steps.push(`Role setup failed: ${err.message}`);
@@ -670,24 +1365,24 @@ async function runInstallOrUpdate(options) {
   }
   if (options.pairCode) {
     try {
-      const { pairReceive } = await import("./pair.js");
-      pairReceive(options.pairCode);
+      const { pairReceive: pairReceive2 } = await Promise.resolve().then(() => (init_pair(), pair_exports));
+      pairReceive2(options.pairCode);
       steps.push("Pairing code accepted");
     } catch (err) {
       steps.push(`Pairing failed: ${err.message}`);
     }
   }
   if (options.role === "node" || process.env.CRYSTAL_RELAY_URL) {
-    const secretsDir = join(LDM_ROOT, "secrets");
-    const envPath = join(secretsDir, "crystal-relay.env");
-    if (!existsSync(envPath)) {
+    const secretsDir = join3(LDM_ROOT2, "secrets");
+    const envPath = join3(secretsDir, "crystal-relay.env");
+    if (!existsSync6(envPath)) {
       const relayUrl = "https://memory-crystal-relay.wipcomputer.workers.dev";
       let token = "";
       try {
-        const saTokenPath = join(OC_ROOT, "secrets", "op-sa-token");
-        if (existsSync(saTokenPath)) {
-          const saToken = readFileSync(saTokenPath, "utf8").trim();
-          token = execSync(
+        const saTokenPath = join3(OC_ROOT, "secrets", "op-sa-token");
+        if (existsSync6(saTokenPath)) {
+          const saToken = readFileSync5(saTokenPath, "utf8").trim();
+          token = execSync3(
             `OP_SERVICE_ACCOUNT_TOKEN=${saToken} op item get "Memory Crystal Relay Auth Tokens" --vault "Agent Secrets" --fields label=${agentId}-token --reveal 2>/dev/null`,
             { encoding: "utf8", timeout: 15e3 }
           ).trim();
@@ -704,19 +1399,19 @@ async function runInstallOrUpdate(options) {
         token = token.trim();
       }
       if (token) {
-        mkdirSync(secretsDir, { recursive: true });
-        writeFileSync(envPath, `export CRYSTAL_RELAY_URL=${relayUrl}
+        mkdirSync5(secretsDir, { recursive: true });
+        writeFileSync5(envPath, `export CRYSTAL_RELAY_URL=${relayUrl}
 export CRYSTAL_RELAY_TOKEN=${token}
 export CRYSTAL_AGENT_ID=${agentId}
 `);
         process.env.CRYSTAL_RELAY_URL = relayUrl;
         process.env.CRYSTAL_RELAY_TOKEN = token;
         steps.push("Relay config written to ~/.ldm/secrets/crystal-relay.env");
-        const shellProfile = join(HOME, ".zshrc");
+        const shellProfile = join3(HOME3, ".zshrc");
         const sourceLine = `source ${envPath}`;
         let alreadySourced = false;
         try {
-          alreadySourced = readFileSync(shellProfile, "utf8").includes(sourceLine);
+          alreadySourced = readFileSync5(shellProfile, "utf8").includes(sourceLine);
         } catch {
         }
         if (!alreadySourced && process.stdin.isTTY) {