@xdarkicex/openclaw-memory-libravdb 1.6.25 → 1.6.27

package/dist/index.js

@@ -5162,7 +5162,7 @@ var require_create_descriptor_set = __commonJS({
           return `enum ${this.typeName}`;
         },
         getComments() {
-          const path5 = this.parent ? [
+          const path6 = this.parent ? [
             ...this.parent.getComments().sourcePath,
             FieldNumber.DescriptorProto_EnumType,
             this.parent.proto.enumType.indexOf(this.proto)
@@ -5170,7 +5170,7 @@ var require_create_descriptor_set = __commonJS({
             FieldNumber.FileDescriptorProto_EnumType,
             this.file.proto.enumType.indexOf(this.proto)
           ];
-          return findComments(file.proto.sourceCodeInfo, path5);
+          return findComments(file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a2, _b2;
@@ -5201,12 +5201,12 @@ var require_create_descriptor_set = __commonJS({
             return str;
           },
           getComments() {
-            const path5 = [
+            const path6 = [
               ...this.parent.getComments().sourcePath,
               FieldNumber.EnumDescriptorProto_Value,
               this.parent.proto.value.indexOf(this.proto)
             ];
-            return findComments(file.proto.sourceCodeInfo, path5);
+            return findComments(file.proto.sourceCodeInfo, path6);
           },
           getFeatures() {
             var _a3;
@@ -5237,7 +5237,7 @@ var require_create_descriptor_set = __commonJS({
           return `message ${this.typeName}`;
         },
         getComments() {
-          const path5 = this.parent ? [
+          const path6 = this.parent ? [
             ...this.parent.getComments().sourcePath,
             FieldNumber.DescriptorProto_NestedType,
             this.parent.proto.nestedType.indexOf(this.proto)
@@ -5245,7 +5245,7 @@ var require_create_descriptor_set = __commonJS({
             FieldNumber.FileDescriptorProto_MessageType,
             this.file.proto.messageType.indexOf(this.proto)
           ];
-          return findComments(file.proto.sourceCodeInfo, path5);
+          return findComments(file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a2, _b2;
@@ -5280,11 +5280,11 @@ var require_create_descriptor_set = __commonJS({
           return `service ${this.typeName}`;
         },
         getComments() {
-          const path5 = [
+          const path6 = [
             FieldNumber.FileDescriptorProto_Service,
             this.file.proto.service.indexOf(this.proto)
           ];
-          return findComments(file.proto.sourceCodeInfo, path5);
+          return findComments(file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a2;
@@ -5344,12 +5344,12 @@ var require_create_descriptor_set = __commonJS({
           return `rpc ${parent.typeName}.${name}`;
         },
         getComments() {
-          const path5 = [
+          const path6 = [
             ...this.parent.getComments().sourcePath,
             FieldNumber.ServiceDescriptorProto_Method,
             this.parent.proto.method.indexOf(this.proto)
           ];
-          return findComments(parent.file.proto.sourceCodeInfo, path5);
+          return findComments(parent.file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a2;
@@ -5370,12 +5370,12 @@ var require_create_descriptor_set = __commonJS({
           return `oneof ${parent.typeName}.${this.name}`;
         },
         getComments() {
-          const path5 = [
+          const path6 = [
             ...this.parent.getComments().sourcePath,
             FieldNumber.DescriptorProto_OneofDecl,
             this.parent.proto.oneofDecl.indexOf(this.proto)
           ];
-          return findComments(parent.file.proto.sourceCodeInfo, path5);
+          return findComments(parent.file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a;
@@ -5411,12 +5411,12 @@ var require_create_descriptor_set = __commonJS({
           return `field ${this.parent.typeName}.${this.name}`;
         },
         getComments() {
-          const path5 = [
+          const path6 = [
             ...this.parent.getComments().sourcePath,
             FieldNumber.DescriptorProto_Field,
             this.parent.proto.field.indexOf(this.proto)
           ];
-          return findComments(file.proto.sourceCodeInfo, path5);
+          return findComments(file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a2;
@@ -5493,7 +5493,7 @@ var require_create_descriptor_set = __commonJS({
           return `extension ${this.typeName}`;
         },
         getComments() {
-          const path5 = this.parent ? [
+          const path6 = this.parent ? [
             ...this.parent.getComments().sourcePath,
             FieldNumber.DescriptorProto_Extension,
             this.parent.proto.extension.indexOf(proto)
@@ -5501,7 +5501,7 @@ var require_create_descriptor_set = __commonJS({
             FieldNumber.FileDescriptorProto_Extension,
             this.file.proto.extension.indexOf(proto)
           ];
-          return findComments(file.proto.sourceCodeInfo, path5);
+          return findComments(file.proto.sourceCodeInfo, path6);
         },
         getFeatures() {
           var _a;
@@ -8624,14 +8624,14 @@ var require_util = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`;
-        let path5 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path6 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin.endsWith("/")) {
           origin = origin.substring(0, origin.length - 1);
         }
-        if (path5 && !path5.startsWith("/")) {
-          path5 = `/${path5}`;
+        if (path6 && !path6.startsWith("/")) {
+          path6 = `/${path6}`;
         }
-        url = new URL(origin + path5);
+        url = new URL(origin + path6);
       }
       return url;
     }
@@ -10245,20 +10245,20 @@ var require_parseParams = __commonJS({
 var require_basename = __commonJS({
   "node_modules/.pnpm/@fastify+busboy@2.1.1/node_modules/@fastify/busboy/lib/utils/basename.js"(exports, module) {
     "use strict";
-    module.exports = function basename(path5) {
-      if (typeof path5 !== "string") {
+    module.exports = function basename(path6) {
+      if (typeof path6 !== "string") {
         return "";
       }
-      for (var i = path5.length - 1; i >= 0; --i) {
-        switch (path5.charCodeAt(i)) {
+      for (var i = path6.length - 1; i >= 0; --i) {
+        switch (path6.charCodeAt(i)) {
           case 47:
           // '/'
           case 92:
-            path5 = path5.slice(i + 1);
-            return path5 === ".." || path5 === "." ? "" : path5;
+            path6 = path6.slice(i + 1);
+            return path6 === ".." || path6 === "." ? "" : path6;
         }
       }
-      return path5 === ".." || path5 === "." ? "" : path5;
+      return path6 === ".." || path6 === "." ? "" : path6;
     };
   }
 });
@@ -11262,11 +11262,11 @@ var require_util2 = __commonJS({
     var assert = __require("assert");
     var { isUint8Array } = __require("util/types");
     var supportedHashes = [];
-    var crypto;
+    var crypto2;
     try {
-      crypto = __require("crypto");
+      crypto2 = __require("crypto");
       const possibleRelevantHashes = ["sha256", "sha384", "sha512"];
-      supportedHashes = crypto.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
+      supportedHashes = crypto2.getHashes().filter((hash) => possibleRelevantHashes.includes(hash));
     } catch {
     }
     function responseURL(response) {
@@ -11543,7 +11543,7 @@ var require_util2 = __commonJS({
       }
     }
     function bytesMatch(bytes, metadataList) {
-      if (crypto === void 0) {
+      if (crypto2 === void 0) {
         return true;
       }
       const parsedMetadata = parseMetadata(metadataList);
@@ -11558,7 +11558,7 @@ var require_util2 = __commonJS({
       for (const item of metadata) {
         const algorithm = item.algo;
         const expectedValue = item.hash;
-        let actualValue = crypto.createHash(algorithm).update(bytes).digest("base64");
+        let actualValue = crypto2.createHash(algorithm).update(bytes).digest("base64");
         if (actualValue[actualValue.length - 1] === "=") {
           if (actualValue[actualValue.length - 2] === "=") {
             actualValue = actualValue.slice(0, -2);
@@ -12904,8 +12904,8 @@ var require_body = __commonJS({
     var { parseMIMEType, serializeAMimeType } = require_dataURL();
     var random;
     try {
-      const crypto = __require("node:crypto");
-      random = (max) => crypto.randomInt(0, max);
+      const crypto2 = __require("node:crypto");
+      random = (max) => crypto2.randomInt(0, max);
     } catch {
       random = (max) => Math.floor(Math.random(max));
     }
@@ -13288,7 +13288,7 @@ var require_request = __commonJS({
     }
     var Request = class _Request {
       constructor(origin, {
-        path: path5,
+        path: path6,
         method,
         body,
         headers,
@@ -13302,11 +13302,11 @@ var require_request = __commonJS({
         throwOnError,
         expectContinue
       }, handler) {
-        if (typeof path5 !== "string") {
+        if (typeof path6 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path5[0] !== "/" && !(path5.startsWith("http://") || path5.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path6[0] !== "/" && !(path6.startsWith("http://") || path6.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.exec(path5) !== null) {
+        } else if (invalidPathRegex.exec(path6) !== null) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -13369,7 +13369,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? util.buildURL(path5, query) : path5;
+        this.path = query ? util.buildURL(path6, query) : path6;
         this.origin = origin;
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
         this.blocking = blocking == null ? false : blocking;
@@ -14377,9 +14377,9 @@ var require_RedirectHandler = __commonJS({
           return this.handler.onHeaders(statusCode, headers, resume, statusText);
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path5 = search ? `${pathname}${search}` : pathname;
+        const path6 = search ? `${pathname}${search}` : pathname;
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path5;
+        this.opts.path = path6;
         this.opts.origin = origin;
         this.opts.maxRedirections = 0;
         this.opts.query = null;
@@ -15619,7 +15619,7 @@ var require_client = __commonJS({
         writeH2(client, client[kHTTP2Session], request3);
         return;
       }
-      const { body, method, path: path5, host, upgrade, headers, blocking, reset } = request3;
+      const { body, method, path: path6, host, upgrade, headers, blocking, reset } = request3;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -15669,7 +15669,7 @@ var require_client = __commonJS({
       if (blocking) {
         socket[kBlocking] = true;
       }
-      let header = `${method} ${path5} HTTP/1.1\r
+      let header = `${method} ${path6} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -15732,7 +15732,7 @@ upgrade: ${upgrade}\r
       return true;
     }
     function writeH2(client, session, request3) {
-      const { body, method, path: path5, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3;
+      const { body, method, path: path6, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3;
       let headers;
       if (typeof reqHeaders === "string") headers = Request[kHTTP2CopyHeaders](reqHeaders.trim());
       else headers = reqHeaders;
@@ -15775,7 +15775,7 @@ upgrade: ${upgrade}\r
         });
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path5;
+      headers[HTTP2_HEADER_PATH] = path6;
       headers[HTTP2_HEADER_SCHEME] = "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -18015,20 +18015,20 @@ var require_mock_utils = __commonJS({
       }
       return true;
     }
-    function safeUrl(path5) {
-      if (typeof path5 !== "string") {
-        return path5;
+    function safeUrl(path6) {
+      if (typeof path6 !== "string") {
+        return path6;
       }
-      const pathSegments = path5.split("?");
+      const pathSegments = path6.split("?");
       if (pathSegments.length !== 2) {
-        return path5;
+        return path6;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path5, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path5);
+    function matchKey(mockDispatch2, { path: path6, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path6);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18046,7 +18046,7 @@ var require_mock_utils = __commonJS({
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? buildURL(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path5 }) => matchValue(safeUrl(path5), resolvedPath));
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path6 }) => matchValue(safeUrl(path6), resolvedPath));
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
       }
@@ -18083,9 +18083,9 @@ var require_mock_utils = __commonJS({
       }
     }
     function buildKey(opts) {
-      const { path: path5, method, body, headers, query } = opts;
+      const { path: path6, method, body, headers, query } = opts;
       return {
-        path: path5,
+        path: path6,
         method,
         body,
         headers,
@@ -18534,10 +18534,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path5, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path6, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path5,
+            Path: path6,
             "Status code": statusCode,
             Persistent: persist ? "\u2705" : "\u274C",
             Invocations: timesInvoked,
@@ -23157,8 +23157,8 @@ var require_util6 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path5) {
-      for (const char of path5) {
+    function validateCookiePath(path6) {
+      for (const char of path6) {
         const code = char.charCodeAt(0);
         if (code < 33 || char === ";") {
           throw new Error("Invalid cookie path");
@@ -23955,9 +23955,9 @@ var require_connection = __commonJS({
     channels.open = diagnosticsChannel.channel("undici:websocket:open");
     channels.close = diagnosticsChannel.channel("undici:websocket:close");
     channels.socketError = diagnosticsChannel.channel("undici:websocket:socket_error");
-    var crypto;
+    var crypto2;
     try {
-      crypto = __require("crypto");
+      crypto2 = __require("crypto");
     } catch {
     }
     function establishWebSocketConnection(url, protocols, ws, onEstablish, options) {
@@ -23976,7 +23976,7 @@ var require_connection = __commonJS({
         const headersList = new Headers2(options.headers)[kHeadersList];
         request3.headersList = headersList;
       }
-      const keyValue = crypto.randomBytes(16).toString("base64");
+      const keyValue = crypto2.randomBytes(16).toString("base64");
       request3.headersList.append("sec-websocket-key", keyValue);
       request3.headersList.append("sec-websocket-version", "13");
       for (const protocol of protocols) {
@@ -24005,7 +24005,7 @@ var require_connection = __commonJS({
             return;
           }
           const secWSAccept = response.headersList.get("Sec-WebSocket-Accept");
-          const digest = crypto.createHash("sha1").update(keyValue + uid).digest("base64");
+          const digest = crypto2.createHash("sha1").update(keyValue + uid).digest("base64");
           if (secWSAccept !== digest) {
             failWebsocketConnection(ws, "Incorrect hash received in Sec-WebSocket-Accept header.");
             return;
@@ -24085,9 +24085,9 @@ var require_frame = __commonJS({
   "node_modules/.pnpm/undici@5.29.0/node_modules/undici/lib/websocket/frame.js"(exports, module) {
     "use strict";
     var { maxUnsigned16Bit } = require_constants5();
-    var crypto;
+    var crypto2;
     try {
-      crypto = __require("crypto");
+      crypto2 = __require("crypto");
     } catch {
     }
     var WebsocketFrameSend = class {
@@ -24096,7 +24096,7 @@ var require_frame = __commonJS({
        */
       constructor(data) {
         this.frameData = data;
-        this.maskKey = crypto.randomBytes(4);
+        this.maskKey = crypto2.randomBytes(4);
       }
       createFrame(opcode) {
         const bodyLength = this.frameData?.byteLength ?? 0;
@@ -24838,11 +24838,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path5 = opts.path;
+          let path6 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path5 = `/${path5}`;
+            path6 = `/${path6}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path5);
+          url = new URL(util.parseOrigin(url).origin + path6);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -25030,7 +25030,7 @@ function deriveIdentityParts() {
 function deriveAutoId(parts) {
   return `${parts.username}@${parts.host}#${parts.homeHash}`;
 }
-function writeIdentityFile(path5, userId, parts) {
+function writeIdentityFile(path6, userId, parts) {
   const identity = {
     userId,
     derivedFrom: {
@@ -25041,15 +25041,15 @@ function writeIdentityFile(path5, userId, parts) {
     },
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  const dir = dirname(path5);
+  const dir = dirname(path6);
   mkdirSync(dir, { recursive: true });
-  const tmp = `${path5}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const tmp = `${path6}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n", { mode: 384 });
-  renameSync(tmp, path5);
+  renameSync(tmp, path6);
   if (process.platform === "win32") {
     try {
       execSync(
-        `icacls "${path5}" /inheritance:r /grant:r "%USERNAME%:(R,W)"`,
+        `icacls "${path6}" /inheritance:r /grant:r "%USERNAME%:(R,W)"`,
         { stdio: "ignore", timeout: 5e3 }
       );
     } catch {
@@ -25104,6 +25104,16 @@ function resolveIdentity(params) {
   }
   return { userId: autoId, source: "auto" };
 }
+function resolveTenantKey(cfg) {
+  const explicit = cfg.tenantId?.trim();
+  if (explicit) return explicit;
+  const envId = process.env.LIBRAVDB_AGENT_ID?.trim();
+  if (envId) return envId;
+  return resolveIdentity({
+    configUserId: cfg.userId,
+    identityPath: cfg.identityPath
+  }).userId;
+}
 
 // src/format-error.ts
 function formatError(error2) {
@@ -25849,18 +25859,22 @@ function createMemorySearchManager(getClient, cfg, defaults, initialStatus) {
         k
       }) : await searchResolvedCollections(client, cfg, userId, sessionId, queryText, k);
       const filteredResults = minScore === void 0 ? result.results : result.results.filter((item) => item.score >= minScore);
-      const legacyResults = filteredResults.map((item) => ({
-        ...item,
-        content: item.text
-      }));
+      const legacyResults = filteredResults.map((item) => {
+        const meta = parseMetadataJson(item);
+        return {
+          ...item,
+          content: item.text || (typeof meta.text === "string" ? meta.text : "")
+        };
+      });
       if (legacyCall) {
         return { results: legacyResults };
       }
       const memoryResults = filteredResults.map((item) => {
         const meta = parseMetadataJson(item);
         const collection = typeof meta.collection === "string" ? meta.collection : "memory";
+        const effectiveText = item.text || (typeof meta.text === "string" ? meta.text : "") || "";
         const relPath = encodeSearchResultPath(collection, item.id);
-        returnedSearchPaths.set(relPath, item.text);
+        returnedSearchPaths.set(relPath, effectiveText);
         return toMemorySearchResult(item);
       });
       return memoryResults;
@@ -25962,12 +25976,13 @@ function parseMetadataJson(item) {
 function toMemorySearchResult(item) {
   const meta = parseMetadataJson(item);
   const collection = typeof meta.collection === "string" ? meta.collection : "memory";
+  const effectiveText = item.text || (typeof meta.text === "string" ? meta.text : "") || "";
   return {
     path: encodeSearchResultPath(collection, item.id),
     startLine: 1,
-    endLine: Math.max(1, item.text.split("\n").length),
+    endLine: Math.max(1, effectiveText.split("\n").length),
     score: item.score,
-    snippet: item.text,
+    snippet: effectiveText,
     source: collection.startsWith("session:") || collection.startsWith("session_") ? "sessions" : "memory",
     citation: `${collection}:${item.id}`
   };
@@ -26514,6 +26529,131 @@ function resolveCliMemoryOperationScope(opts) {
   };
 }
 
+// src/context-engine.ts
+import { randomUUID } from "node:crypto";
+
+// src/manifest.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+import * as crypto from "crypto";
+import * as os2 from "os";
+var TurnManifestStore = class {
+  manifestDir;
+  constructor() {
+    this.manifestDir = path2.join(os2.homedir(), ".openclaw", "libravdb-manifests");
+    if (!fs2.existsSync(this.manifestDir)) {
+      fs2.mkdirSync(this.manifestDir, { recursive: true });
+    }
+  }
+  getManifestPath(sessionId) {
+    const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, "_");
+    return path2.join(this.manifestDir, `${safe}.manifest.json`);
+  }
+  hashString(data) {
+    return crypto.createHash("sha256").update(data).digest("hex");
+  }
+  createEmpty(sessionId) {
+    return {
+      sessionId,
+      version: 0,
+      turns: [],
+      tailHash: "0000000000000000000000000000000000000000000000000000000000000000"
+    };
+  }
+  load(sessionId, logger) {
+    const filePath = this.getManifestPath(sessionId);
+    if (!fs2.existsSync(filePath)) {
+      return this.createEmpty(sessionId);
+    }
+    try {
+      const raw = fs2.readFileSync(filePath, "utf8");
+      const manifest = JSON.parse(raw);
+      if (!this.verifyChain(manifest)) {
+        logger?.warn?.(`[LibraVDB] Manifest chain broken for session ${sessionId}. Forcing re-sync.`);
+        return this.createEmpty(sessionId);
+      }
+      return manifest;
+    } catch (e) {
+      logger?.error?.(`[LibraVDB] Failed to read manifest for ${sessionId}:`, e);
+      return this.createEmpty(sessionId);
+    }
+  }
+  save(manifest) {
+    const filePath = this.getManifestPath(manifest.sessionId);
+    const tempPath = `${filePath}.${process.pid}.tmp`;
+    fs2.writeFileSync(tempPath, JSON.stringify(manifest, null, 2), "utf8");
+    fs2.renameSync(tempPath, filePath);
+  }
+  verifyChain(manifest) {
+    let currentHash = "0000000000000000000000000000000000000000000000000000000000000000";
+    for (const turn of manifest.turns) {
+      const expectedHash = this.hashString(`${turn.index}${turn.role}${turn.contentHash}${currentHash}`);
+      if (turn.turnHash !== expectedHash) {
+        return false;
+      }
+      currentHash = expectedHash;
+    }
+    return manifest.tailHash === currentHash;
+  }
+  /**
+   * Finds the overlap point between incoming messages and our stored history.
+   * Returns the index into incomingMessages where new (un-ACKed) messages begin.
+   * Returns 0 if no overlap (full re-sync).
+   */
+  findOverlapIndex(manifest, incomingMessages) {
+    if (manifest.turns.length === 0) {
+      return 0;
+    }
+    const known = /* @__PURE__ */ new Map();
+    for (const turn of manifest.turns) {
+      known.set(turn.contentHash, turn.index);
+    }
+    for (let i = incomingMessages.length - 1; i >= 0; i--) {
+      const contentHash = this.hashString(incomingMessages[i].content);
+      if (known.has(contentHash)) {
+        return i + 1;
+      }
+    }
+    return 0;
+  }
+  appendACKedMessages(manifest, newMessages, startingIndex) {
+    let currentHash = manifest.tailHash;
+    const newTurns = [];
+    for (let i = 0; i < newMessages.length; i++) {
+      const msg = newMessages[i];
+      const absoluteIndex = startingIndex + i;
+      const contentHash = this.hashString(msg.content);
+      currentHash = this.hashString(`${absoluteIndex}${msg.role}${contentHash}${currentHash}`);
+      newTurns.push({
+        index: absoluteIndex,
+        role: msg.role,
+        contentHash,
+        turnHash: currentHash,
+        ingestedAt: Date.now()
+      });
+    }
+    return {
+      sessionId: manifest.sessionId,
+      version: manifest.version + 1,
+      turns: [...manifest.turns, ...newTurns],
+      tailHash: currentHash
+    };
+  }
+  /**
+   * Determines the absolute starting index for a set of new messages.
+   * If we have stored turns, the next message's index is last_turn.index + 1.
+   * If the manifest is empty, we infer from OpenClaw's prePromptMessageCount signal
+   * (caller must provide this as a hint when available).
+   */
+  deriveStartingIndex(manifest, prePromptMessageCountHint) {
+    if (manifest.turns.length > 0) {
+      return manifest.turns[manifest.turns.length - 1].index + 1;
+    }
+    return typeof prePromptMessageCountHint === "number" && prePromptMessageCountHint >= 0 ? prePromptMessageCountHint : 0;
+  }
+};
+var manifestStore = new TurnManifestStore();
+
 // src/context-engine.ts
 var APPROX_CHARS_PER_TOKEN = 4;
 var PROMPT_AUTHORITY_PREASSEMBLY_MAY_OVERFLOW = "preassembly_may_overflow";
@@ -26843,7 +26983,7 @@ function normalizeKernelMessage(message) {
   return {
     role: message.role,
     content: normalizeKernelContent(message.content),
-    ...typeof message.id === "string" ? { id: message.id } : {}
+    id: message.id || randomUUID()
   };
 }
 function normalizeKernelMessages(messages) {
@@ -26897,9 +27037,9 @@ function extractExactRecallFactText(text, token) {
 function escapeMemoryFactText(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;").replaceAll("\r", "&#13;").replaceAll("\n", "&#10;").replaceAll("	", "&#9;");
 }
-var TOOL_CALL_BRACKET_RE = /\[tool:([^\]]+)\]/gi;
-var TOOL_CALL_JSON_RE = /\{\s*"name"\s*:\s*"([^"]+)"[^}]*\}/g;
-var TOOL_RESULT_ANNOTATION_RE = /\[tool:[^\]]+\](?:\s*[^{\[]*)?/g;
+var TOOL_CALL_BRACKET_RE = /\[tool:([^\]]+)\](?:\s*(?:\{[\s\S]*?\}|\[[\s\S]*?\]|".*?"))?/gi;
+var TOOL_CALL_JSON_RE = /\{\s*"name"\s*:\s*"([^"]+)"[\s\S]*?\}/g;
+var TOOL_RESULT_ANNOTATION_RE = /\[tool:[^\]]+\][^\n]*/g;
 function sanitizeToolCallPatterns(text) {
   let sanitized = text;
   sanitized = sanitized.replace(TOOL_CALL_BRACKET_RE, (_match, toolName) => {
@@ -27094,7 +27234,7 @@ function normalizeAssembleResult(result, sourceMessages) {
       if (isRealTranscript) {
         messages.push({
           role: message.role === "user" ? "user" : "assistant",
-          content,
+          content: sanitizeToolCallPatterns(content),
           ...typeof message.id === "string" ? { id: message.id } : {}
         });
       } else {
@@ -27121,6 +27261,18 @@ ${extractedMemoryItems.join("\n")}
     ...result.debug != null ? { debug: result.debug } : {}
   };
 }
+function extractCursorFromResult(result) {
+  if (result && typeof result === "object" && "cursor" in result) {
+    const cursor = result.cursor;
+    if (cursor && typeof cursor === "object") {
+      const c = cursor;
+      if (typeof c.lastProcessedIndex === "number" && typeof c.sessionVersion === "number" && typeof c.manifestTailHash === "string") {
+        return c;
+      }
+    }
+  }
+  return void 0;
+}
 function buildContextEngineFactory(runtime, cfg, logger = console) {
   const predictiveContextCache = /* @__PURE__ */ new Map();
   const PREDICTIVE_CACHE_MAX_SIZE = 100;
@@ -27526,12 +27678,20 @@ function buildContextEngineFactory(runtime, cfg, logger = console) {
         userIdOverride: args.userId,
         sessionKey: args.sessionKey
       });
+      const manifest = manifestStore.load(sessionId, logger);
       const afterTurnMessages = selectAfterTurnMessages(args.messages, args.prePromptMessageCount, logger);
       const messages = normalizeKernelMessages(afterTurnMessages);
-      const ingestMessages = boundAfterTurnMessagesForIngest(messages, logger, sessionId);
-      const msgCount = messages.length;
+      const overlapIndex = manifestStore.findOverlapIndex(manifest, messages);
+      const newMessages = messages.slice(overlapIndex);
+      const ingestMessages = boundAfterTurnMessagesForIngest(newMessages, logger, sessionId);
+      const startIndex = manifestStore.deriveStartingIndex(manifest, args.prePromptMessageCount);
+      const cursor = {
+        lastProcessedIndex: startIndex > 0 ? startIndex - 1 : 0,
+        sessionVersion: manifest.version,
+        manifestTailHash: manifest.tailHash
+      };
       logger.info?.(
-        `LibraVDB afterTurn sessionId=${sessionId} userId=${userId} messageCount=${msgCount} totalMessages=${args.messages.length} prePromptMessageCount=${args.prePromptMessageCount ?? "unknown"} heartbeat=${args.isHeartbeat ?? false}`
+        `LibraVDB afterTurn sessionId=${sessionId} userId=${userId} messageCount=${messages.length} newMessages=${newMessages.length} overlapIndex=${overlapIndex} startIndex=${startIndex} prePromptMessageCount=${args.prePromptMessageCount ?? "unknown"} heartbeat=${args.isHeartbeat ?? false}`
       );
       try {
         const client = await runtime.getClient();
@@ -27543,8 +27703,38 @@ function buildContextEngineFactory(runtime, cfg, logger = console) {
           sessionKey: args.sessionKey,
           userId,
           messages: ingestMessages,
-          isHeartbeat: args.isHeartbeat
+          prePromptMessageCount: args.prePromptMessageCount,
+          isHeartbeat: args.isHeartbeat,
+          cursor
         });
+        const daemonCursor = extractCursorFromResult(result);
+        if (daemonCursor) {
+          if (!daemonCursor.manifestTailHash) {
+            logger.warn?.(
+              `[LibraVDB] Daemon reported cursor gap for session ${sessionId}. Resetting manifest for full re-sync next turn.`
+            );
+            manifestStore.save(manifestStore.createEmpty(sessionId));
+          } else if (ingestMessages.length > 0) {
+            const confirmedIndex = daemonCursor.lastProcessedIndex;
+            const ackCount = Math.max(0, confirmedIndex - startIndex + 1);
+            if (ackCount > 0) {
+              const ackedMessages = ingestMessages.slice(0, ackCount);
+              const updatedManifest = manifestStore.appendACKedMessages(
+                manifest,
+                ackedMessages,
+                startIndex
+              );
+              manifestStore.save(updatedManifest);
+            }
+          }
+        } else if (ingestMessages.length > 0) {
+          const updatedManifest = manifestStore.appendACKedMessages(
+            manifest,
+            ingestMessages,
+            startIndex
+          );
+          manifestStore.save(updatedManifest);
+        }
         await performAfterTurnPredictiveCompaction({
           sessionId,
           messages,
@@ -27637,16 +27827,16 @@ function isRecord(value) {
 }
 
 // src/markdown-ingest.ts
-import fs2 from "node:fs";
+import fs3 from "node:fs";
 import fsp2 from "node:fs/promises";
-import os2 from "node:os";
-import path2 from "node:path";
+import os3 from "node:os";
+import path3 from "node:path";
 
 // node_modules/.pnpm/@bufbuild+protobuf@1.7.2/node_modules/@bufbuild/protobuf/dist/proxy/index.js
 var proxy_exports = {};
 __reExport(proxy_exports, __toESM(require_cjs(), 1));
 
-// node_modules/.pnpm/@xdarkicex+libravdb-contracts@2.0.8/node_modules/@xdarkicex/libravdb-contracts/gen/js/libravdb/ipc/v1/rpc_pb.js
+// node_modules/.pnpm/@xdarkicex+libravdb-contracts@2.0.12/node_modules/@xdarkicex/libravdb-contracts/gen/js/libravdb/ipc/v1/rpc_pb.js
 var IngestMode;
 (function(IngestMode2) {
   IngestMode2[IngestMode2["REPLACE"] = 0] = "REPLACE";
@@ -28415,6 +28605,61 @@ var KernelMessage = class _KernelMessage extends proxy_exports.Message {
     return proxy_exports.proto3.util.equals(_KernelMessage, a, b);
   }
 };
+var SessionSyncCursor = class _SessionSyncCursor extends proxy_exports.Message {
+  /**
+   * @generated from field: int64 last_processed_index = 1;
+   */
+  lastProcessedIndex = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: int64 session_version = 2;
+   */
+  sessionVersion = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: string manifest_tail_hash = 3;
+   */
+  manifestTailHash = "";
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.SessionSyncCursor";
+  static fields = proxy_exports.proto3.util.newFieldList(() => [
+    {
+      no: 1,
+      name: "last_processed_index",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 2,
+      name: "session_version",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 3,
+      name: "manifest_tail_hash",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    }
+  ]);
+  static fromBinary(bytes, options) {
+    return new _SessionSyncCursor().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _SessionSyncCursor().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _SessionSyncCursor().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_SessionSyncCursor, a, b);
+  }
+};
 var AssembleContextInternalResponse = class _AssembleContextInternalResponse extends proxy_exports.Message {
   /**
    * @generated from field: repeated libravdb.ipc.v1.KernelMessage messages = 1;
@@ -30976,6 +31221,10 @@ var MemoryStatusResponse = class _MemoryStatusResponse extends proxy_exports.Mes
    * @generated from field: string embedding_profile = 8;
    */
   embeddingProfile = "";
+  /**
+   * @generated from field: string embedding_backend = 9;
+   */
+  embeddingBackend = "";
   constructor(data) {
     super();
     proxy_exports.proto3.util.initPartial(data, this);
@@ -31038,6 +31287,13 @@ var MemoryStatusResponse = class _MemoryStatusResponse extends proxy_exports.Mes
       kind: "scalar",
       T: 9
       /* ScalarType.STRING */
+    },
+    {
+      no: 9,
+      name: "embedding_backend",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
     }
   ]);
   static fromBinary(bytes, options) {
@@ -31418,6 +31674,10 @@ var AfterTurnKernelRequest = class _AfterTurnKernelRequest extends proxy_exports
    * @generated from field: bool is_heartbeat = 6;
    */
   isHeartbeat = false;
+  /**
+   * @generated from field: libravdb.ipc.v1.SessionSyncCursor cursor = 7;
+   */
+  cursor;
   constructor(data) {
     super();
     proxy_exports.proto3.util.initPartial(data, this);
@@ -31460,7 +31720,8 @@ var AfterTurnKernelRequest = class _AfterTurnKernelRequest extends proxy_exports
       kind: "scalar",
       T: 8
       /* ScalarType.BOOL */
-    }
+    },
+    { no: 7, name: "cursor", kind: "message", T: SessionSyncCursor }
   ]);
   static fromBinary(bytes, options) {
     return new _AfterTurnKernelRequest().fromBinary(bytes, options);
@@ -31484,6 +31745,10 @@ var AfterTurnKernelResponse = class _AfterTurnKernelResponse extends proxy_expor
    * @generated from field: repeated libravdb.ipc.v1.PredictedContext predictions = 2;
    */
   predictions = [];
+  /**
+   * @generated from field: libravdb.ipc.v1.SessionSyncCursor cursor = 3;
+   */
+  cursor;
   constructor(data) {
     super();
     proxy_exports.proto3.util.initPartial(data, this);
@@ -31498,7 +31763,8 @@ var AfterTurnKernelResponse = class _AfterTurnKernelResponse extends proxy_expor
       T: 8
       /* ScalarType.BOOL */
     },
-    { no: 2, name: "predictions", kind: "message", T: PredictedContext, repeated: true }
+    { no: 2, name: "predictions", kind: "message", T: PredictedContext, repeated: true },
+    { no: 3, name: "cursor", kind: "message", T: SessionSyncCursor }
   ]);
   static fromBinary(bytes, options) {
     return new _AfterTurnKernelResponse().fromBinary(bytes, options);
@@ -31839,6 +32105,375 @@ var CognitiveMetricsRequest = class _CognitiveMetricsRequest extends proxy_expor
     return proxy_exports.proto3.util.equals(_CognitiveMetricsRequest, a, b);
   }
 };
+var TenantStatus = class _TenantStatus extends proxy_exports.Message {
+  /**
+   * @generated from field: string tenant_key = 1;
+   */
+  tenantKey = "";
+  /**
+   * "active", "idle"
+   *
+   * @generated from field: string status = 2;
+   */
+  status = "";
+  /**
+   * @generated from field: int64 size_bytes = 3;
+   */
+  sizeBytes = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: int64 last_active_ms = 4;
+   */
+  lastActiveMs = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: int32 open_sessions = 5;
+   */
+  openSessions = 0;
+  /**
+   * @generated from field: bool unregistered = 6;
+   */
+  unregistered = false;
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.TenantStatus";
+  static fields = proxy_exports.proto3.util.newFieldList(() => [
+    {
+      no: 1,
+      name: "tenant_key",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 2,
+      name: "status",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 3,
+      name: "size_bytes",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 4,
+      name: "last_active_ms",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 5,
+      name: "open_sessions",
+      kind: "scalar",
+      T: 5
+      /* ScalarType.INT32 */
+    },
+    {
+      no: 6,
+      name: "unregistered",
+      kind: "scalar",
+      T: 8
+      /* ScalarType.BOOL */
+    }
+  ]);
+  static fromBinary(bytes, options) {
+    return new _TenantStatus().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _TenantStatus().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _TenantStatus().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_TenantStatus, a, b);
+  }
+};
+var DaemonStatusRequest = class _DaemonStatusRequest extends proxy_exports.Message {
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.DaemonStatusRequest";
+  static fields = proxy_exports.proto3.util.newFieldList(() => []);
+  static fromBinary(bytes, options) {
+    return new _DaemonStatusRequest().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _DaemonStatusRequest().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _DaemonStatusRequest().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_DaemonStatusRequest, a, b);
+  }
+};
+var DaemonStatusResponse = class _DaemonStatusResponse extends proxy_exports.Message {
+  /**
+   * @generated from field: bool ok = 1;
+   */
+  ok = false;
+  /**
+   * @generated from field: string version = 2;
+   */
+  version = "";
+  /**
+   * @generated from field: string uptime = 3;
+   */
+  uptime = "";
+  /**
+   * @generated from field: string backend = 4;
+   */
+  backend = "";
+  /**
+   * @generated from field: int64 global_db_size = 5;
+   */
+  globalDbSize = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: bool global_db_healthy = 6;
+   */
+  globalDbHealthy = false;
+  /**
+   * @generated from field: repeated libravdb.ipc.v1.TenantStatus tenants = 7;
+   */
+  tenants = [];
+  /**
+   * @generated from field: int64 cache_size = 8;
+   */
+  cacheSize = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: int64 cache_max_size = 9;
+   */
+  cacheMaxSize = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: int32 cache_entries = 10;
+   */
+  cacheEntries = 0;
+  /**
+   * @generated from field: double cache_hit_rate = 11;
+   */
+  cacheHitRate = 0;
+  /**
+   * @generated from field: int64 cache_savings = 12;
+   */
+  cacheSavings = proxy_exports.protoInt64.zero;
+  /**
+   * @generated from field: string tenant_mode = 13;
+   */
+  tenantMode = "";
+  /**
+   * @generated from field: int32 max_open_tenants = 14;
+   */
+  maxOpenTenants = 0;
+  /**
+   * @generated from field: int32 current_open_tenants = 15;
+   */
+  currentOpenTenants = 0;
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.DaemonStatusResponse";
+  static fields = proxy_exports.proto3.util.newFieldList(() => [
+    {
+      no: 1,
+      name: "ok",
+      kind: "scalar",
+      T: 8
+      /* ScalarType.BOOL */
+    },
+    {
+      no: 2,
+      name: "version",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 3,
+      name: "uptime",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 4,
+      name: "backend",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 5,
+      name: "global_db_size",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 6,
+      name: "global_db_healthy",
+      kind: "scalar",
+      T: 8
+      /* ScalarType.BOOL */
+    },
+    { no: 7, name: "tenants", kind: "message", T: TenantStatus, repeated: true },
+    {
+      no: 8,
+      name: "cache_size",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 9,
+      name: "cache_max_size",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 10,
+      name: "cache_entries",
+      kind: "scalar",
+      T: 5
+      /* ScalarType.INT32 */
+    },
+    {
+      no: 11,
+      name: "cache_hit_rate",
+      kind: "scalar",
+      T: 1
+      /* ScalarType.DOUBLE */
+    },
+    {
+      no: 12,
+      name: "cache_savings",
+      kind: "scalar",
+      T: 3
+      /* ScalarType.INT64 */
+    },
+    {
+      no: 13,
+      name: "tenant_mode",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    },
+    {
+      no: 14,
+      name: "max_open_tenants",
+      kind: "scalar",
+      T: 5
+      /* ScalarType.INT32 */
+    },
+    {
+      no: 15,
+      name: "current_open_tenants",
+      kind: "scalar",
+      T: 5
+      /* ScalarType.INT32 */
+    }
+  ]);
+  static fromBinary(bytes, options) {
+    return new _DaemonStatusResponse().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _DaemonStatusResponse().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _DaemonStatusResponse().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_DaemonStatusResponse, a, b);
+  }
+};
+var EvictTenantRequest = class _EvictTenantRequest extends proxy_exports.Message {
+  /**
+   * @generated from field: string tenant_key = 1;
+   */
+  tenantKey = "";
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.EvictTenantRequest";
+  static fields = proxy_exports.proto3.util.newFieldList(() => [
+    {
+      no: 1,
+      name: "tenant_key",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    }
+  ]);
+  static fromBinary(bytes, options) {
+    return new _EvictTenantRequest().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _EvictTenantRequest().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _EvictTenantRequest().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_EvictTenantRequest, a, b);
+  }
+};
+var EvictTenantResponse = class _EvictTenantResponse extends proxy_exports.Message {
+  /**
+   * @generated from field: bool ok = 1;
+   */
+  ok = false;
+  /**
+   * @generated from field: string message = 2;
+   */
+  message = "";
+  constructor(data) {
+    super();
+    proxy_exports.proto3.util.initPartial(data, this);
+  }
+  static runtime = proxy_exports.proto3;
+  static typeName = "libravdb.ipc.v1.EvictTenantResponse";
+  static fields = proxy_exports.proto3.util.newFieldList(() => [
+    {
+      no: 1,
+      name: "ok",
+      kind: "scalar",
+      T: 8
+      /* ScalarType.BOOL */
+    },
+    {
+      no: 2,
+      name: "message",
+      kind: "scalar",
+      T: 9
+      /* ScalarType.STRING */
+    }
+  ]);
+  static fromBinary(bytes, options) {
+    return new _EvictTenantResponse().fromBinary(bytes, options);
+  }
+  static fromJson(jsonValue, options) {
+    return new _EvictTenantResponse().fromJson(jsonValue, options);
+  }
+  static fromJsonString(jsonString, options) {
+    return new _EvictTenantResponse().fromJsonString(jsonString, options);
+  }
+  static equals(a, b) {
+    return proxy_exports.proto3.util.equals(_EvictTenantResponse, a, b);
+  }
+};
 var CognitiveMetricsResponse = class _CognitiveMetricsResponse extends proxy_exports.Message {
   /**
    * @generated from field: int64 total_nodes = 1;
@@ -33130,7 +33765,7 @@ var DirectoryMarkdownSourceAdapter = class {
     this.started = false;
   }
   getRootState(root) {
-    const resolved = path2.resolve(root);
+    const resolved = path3.resolve(root);
     const existing = this.states.get(resolved);
     if (existing) {
       return existing;
@@ -33231,7 +33866,7 @@ var DirectoryMarkdownSourceAdapter = class {
       if (this.stopping) {
         return;
       }
-      const child = path2.join(dir, entry.name);
+      const child = path3.join(dir, entry.name);
       if (entry.isDirectory()) {
         await this.walkDirectory(rootState, child, currentFiles, stats, candidates);
         continue;
@@ -33315,7 +33950,7 @@ var DirectoryMarkdownSourceAdapter = class {
     rootState.scanState.resumeFromPath = null;
   }
   shouldPruneDirectory(root, dir) {
-    const relative = toPosixPath(path2.relative(root, dir));
+    const relative = toPosixPath(path3.relative(root, dir));
     if (!relative || relative === "." || relative.startsWith("..")) {
       return false;
     }
@@ -33353,7 +33988,7 @@ var DirectoryMarkdownSourceAdapter = class {
     if (isOpenClawMemoryFile(filePath)) {
       return true;
     }
-    const relative = toPosixPath(path2.relative(root, filePath));
+    const relative = toPosixPath(path3.relative(root, filePath));
     if (this.excludePatterns.length > 0) {
       for (const pattern of this.excludePatterns) {
         if (matchesGlob(relative, pattern)) {
@@ -33390,7 +34025,7 @@ var DirectoryMarkdownSourceAdapter = class {
   }
   async syncMarkdownFile(rootState, filePath, initialStat) {
     const sourceDoc = filePath;
-    const relativePath = toPosixPath(path2.relative(rootState.root, filePath));
+    const relativePath = toPosixPath(path3.relative(rootState.root, filePath));
     const stat = initialStat ?? await this.safeStatWithCtime(filePath);
     if (!stat) {
       await this.deleteSourceDocument(sourceDoc);
@@ -33628,9 +34263,9 @@ var DirectoryMarkdownSourceAdapter = class {
       if (parsed.ingestVersion !== MARKDOWN_INGEST_VERSION || parsed.hashBackend !== HASH_BACKEND || !parsed.files) {
         return;
       }
-      const configuredRoots = new Set(this.roots.map((root) => path2.resolve(root)));
+      const configuredRoots = new Set(this.roots.map((root) => path3.resolve(root)));
       for (const [sourceDoc, state] of Object.entries(parsed.files)) {
-        if (isValidSnapshotState(sourceDoc, state) && configuredRoots.has(path2.resolve(state.root))) {
+        if (isValidSnapshotState(sourceDoc, state) && configuredRoots.has(path3.resolve(state.root))) {
           this.fileStates.set(sourceDoc, state);
         }
       }
@@ -33650,7 +34285,7 @@ var DirectoryMarkdownSourceAdapter = class {
       files: Object.fromEntries([...this.fileStates.entries()].sort(([left], [right]) => left.localeCompare(right)))
     };
     try {
-      await fsp2.mkdir(path2.dirname(this.snapshotPath), { recursive: true });
+      await fsp2.mkdir(path3.dirname(this.snapshotPath), { recursive: true });
       const tmp = `${this.snapshotPath}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
       await fsp2.writeFile(tmp, `${JSON.stringify(payload, null, 2)}
 `);
@@ -33709,7 +34344,7 @@ function recordSyncResult(stats, result) {
   }
 }
 function toPosixPath(value) {
-  return value.split(path2.sep).join("/");
+  return value.split(path3.sep).join("/");
 }
 function normalizeMarkdownRoots(roots) {
   if (!roots?.length) {
@@ -33721,7 +34356,7 @@ function normalizeMarkdownRoots(roots) {
     if (!trimmed) {
       continue;
     }
-    resolved.add(path2.resolve(trimmed));
+    resolved.add(path3.resolve(trimmed));
   }
   return [...resolved];
 }
@@ -33737,10 +34372,10 @@ function updateFnv1a64(seed, bytes) {
 function resolveMarkdownSnapshotPath(kind, configuredPath) {
   const trimmed = configuredPath?.trim();
   if (trimmed) {
-    return path2.resolve(trimmed);
+    return path3.resolve(trimmed);
   }
-  const stateDir = process.env.OPENCLAW_STATE_DIR?.trim() || path2.join(os2.homedir(), ".openclaw");
-  return path2.join(stateDir, `libravdb-markdown-ingest-${kind}.json`);
+  const stateDir = process.env.OPENCLAW_STATE_DIR?.trim() || path3.join(os3.homedir(), ".openclaw");
+  return path3.join(stateDir, `libravdb-markdown-ingest-${kind}.json`);
 }
 function isMarkdownIngestionEnabled(cfg, roots) {
   return cfg.markdownIngestionEnabled === true && roots.length > 0;
@@ -33753,7 +34388,7 @@ function createRealFsApi2() {
       const s = await fsp2.stat(file);
       return { size: s.size, mtimeMs: s.mtimeMs, ctimeMs: s.ctimeMs };
     },
-    watch: (dir, onChange) => fs2.watch(dir, onChange),
+    watch: (dir, onChange) => fs3.watch(dir, onChange),
     openReadStream: async (file) => {
       const handle = await fsp2.open(file, "r");
       return {
@@ -33921,7 +34556,7 @@ function hasInlineObsidianTag(text) {
   return false;
 }
 function isOpenClawMemoryFile(filePath) {
-  return path2.basename(filePath).toLowerCase() === "memory.md";
+  return path3.basename(filePath).toLowerCase() === "memory.md";
 }
 
 // src/memory-provider.ts
@@ -35731,11 +36366,11 @@ var Http2SessionManager = class {
    * Clients must call notifyResponseByteRead() whenever they successfully read
    * data from the http2.ClientHttp2Stream.
    */
-  async request(method, path5, headers, options) {
+  async request(method, path6, headers, options) {
     for (; ; ) {
       const ready2 = await this.gotoReady();
       try {
-        const stream = ready2.conn.request(Object.assign(Object.assign({}, headers), { ":method": method, ":path": path5 }), options);
+        const stream = ready2.conn.request(Object.assign(Object.assign({}, headers), { ":method": method, ":path": path6 }), options);
         ready2.registerRequest(stream);
         return stream;
       } catch (e) {
@@ -36373,7 +37008,7 @@ function createGrpcTransport(options) {
   return createTransport(validateNodeTransportOptions(options));
 }
 
-// node_modules/.pnpm/@xdarkicex+libravdb-contracts@2.0.8/node_modules/@xdarkicex/libravdb-contracts/gen/js/libravdb/ipc/v1/rpc_connect.js
+// node_modules/.pnpm/@xdarkicex+libravdb-contracts@2.0.12/node_modules/@xdarkicex/libravdb-contracts/gen/js/libravdb/ipc/v1/rpc_connect.js
 var LibravDB = {
   typeName: "libravdb.ipc.v1.LibravDB",
   methods: {
@@ -36397,6 +37032,24 @@ var LibravDB = {
       O: MemoryStatusResponse,
       kind: proxy_exports.MethodKind.Unary
     },
+    /**
+     * @generated from rpc libravdb.ipc.v1.LibravDB.DaemonStatus
+     */
+    daemonStatus: {
+      name: "DaemonStatus",
+      I: DaemonStatusRequest,
+      O: DaemonStatusResponse,
+      kind: proxy_exports.MethodKind.Unary
+    },
+    /**
+     * @generated from rpc libravdb.ipc.v1.LibravDB.EvictTenant
+     */
+    evictTenant: {
+      name: "EvictTenant",
+      I: EvictTenantRequest,
+      O: EvictTenantResponse,
+      kind: proxy_exports.MethodKind.Unary
+    },
     /**
      * @generated from rpc libravdb.ipc.v1.LibravDB.Flush
      */
@@ -36705,25 +37358,27 @@ var LibravDB = {
 
 // src/libravdb-client.ts
 import { createHmac } from "node:crypto";
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import net from "node:net";
-import os3 from "node:os";
-import path3 from "node:path";
+import os4 from "node:os";
+import path4 from "node:path";
 function resolveClientEndpoint(configuredEndpoint) {
   if (configuredEndpoint && configuredEndpoint !== "auto") return configuredEndpoint;
   if (process.env.LIBRAVDB_GRPC_ENDPOINT) return process.env.LIBRAVDB_GRPC_ENDPOINT;
   if (process.platform === "win32") return "tcp:127.0.0.1:37421";
   const sockName = "libravdb.sock";
   const candidateDirs = [
-    path3.join(os3.homedir(), ".libravdbd", "run"),
+    path4.join(os4.homedir(), ".libravdbd", "run"),
     "/opt/homebrew/var/libravdbd/run",
-    "/usr/local/var/libravdbd/run"
+    "/usr/local/var/libravdbd/run",
+    "/var/run/libravdbd",
+    "/run/libravdbd"
   ];
   for (const dir of candidateDirs) {
-    const fullPath = path3.join(dir, sockName);
-    if (fs3.existsSync(fullPath)) return `unix:${fullPath}`;
+    const fullPath = path4.join(dir, sockName);
+    if (fs4.existsSync(fullPath)) return `unix:${fullPath}`;
   }
-  return `unix:${path3.join(os3.homedir(), ".libravdbd", "run", sockName)}`;
+  return `unix:${path4.join(os4.homedir(), ".libravdbd", "run", sockName)}`;
 }
 function isLegacyJsonRpcHealthResponse(payload) {
   try {
@@ -36850,11 +37505,11 @@ var LibravDBClient = class {
     let clientKey = null;
     let clientCert = null;
     if (!isInsecure && options.tlsCaPath) {
-      rootCerts = fs3.readFileSync(options.tlsCaPath);
+      rootCerts = fs4.readFileSync(options.tlsCaPath);
     }
     if (options.tlsClientCertPath && options.tlsClientKeyPath) {
-      clientCert = fs3.readFileSync(options.tlsClientCertPath);
-      clientKey = fs3.readFileSync(options.tlsClientKeyPath);
+      clientCert = fs4.readFileSync(options.tlsClientCertPath);
+      clientKey = fs4.readFileSync(options.tlsClientKeyPath);
     }
     const rpcMutex = createRpcMutex();
     const self = this;
@@ -36869,6 +37524,15 @@ var LibravDBClient = class {
       bootstrap: () => self.bootstrapHandshake(),
       rpcMutex
     });
+    const interceptors = [];
+    if (options.tenantKey) {
+      const tenantKey = options.tenantKey;
+      interceptors.push((next) => async (req) => {
+        req.header.set("libravdb-tenant-key", tenantKey);
+        return next(req);
+      });
+    }
+    interceptors.push(authInterceptor);
     const transport = createGrpcTransport({
       baseUrl: targetUrl,
       httpVersion: "2",
@@ -36879,7 +37543,7 @@ var LibravDBClient = class {
         ...isInsecure ? { rejectUnauthorized: false } : {}
       },
       defaultTimeoutMs: options.timeoutMs ?? 3e4,
-      interceptors: [authInterceptor]
+      interceptors
     });
     this.client = createPromiseClient(LibravDB, transport);
   }
@@ -37034,7 +37698,7 @@ function loadSecretFromEnv(logger) {
   const secretPath = process.env.LIBRAVDB_AUTH_SECRET_FILE;
   if (secretPath) {
     try {
-      return fs3.readFileSync(secretPath, "utf8").trim() || void 0;
+      return fs4.readFileSync(secretPath, "utf8").trim() || void 0;
     } catch (error2) {
       logger?.warn?.(`LibraVDB: failed to read auth secret file "${secretPath}": ${formatError(error2)}`);
       return void 0;
@@ -37044,9 +37708,13 @@ function loadSecretFromEnv(logger) {
 }
 
 // src/plugin-runtime.ts
-import { existsSync as existsSync2, statSync } from "node:fs";
-import path4 from "node:path";
-var DEFAULT_RPC_TIMEOUT_MS = 3e4;
+import { existsSync as existsSync3, statSync } from "node:fs";
+import path5 from "node:path";
+var DEFAULT_RPC_TIMEOUT_MS = 12e4;
+var ENV_RPC_TIMEOUT_MS = (() => {
+  const raw = Number(process.env.LIBRAVDB_RPC_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 0;
+})();
 var VALID_TLS_MODES = ["auto", "tls", "insecure"];
 var isTlsModeValid = (m) => VALID_TLS_MODES.includes(m);
 function daemonProvisioningHint() {
@@ -37071,7 +37739,7 @@ function validateEmbeddingConfig(cfg) {
       `LibraVDB: embeddingRuntimePath must point to a readable ONNX Runtime library: ${runtimePath}`
     );
   }
-  if (!pathExistsAsDirectory(modelPath) || !pathExistsAsFile(path4.join(modelPath, "embedding.json"))) {
+  if (!pathExistsAsDirectory(modelPath) || !pathExistsAsFile(path5.join(modelPath, "embedding.json"))) {
     throw new Error(
       `LibraVDB: embeddingModelPath must point to a directory containing embedding.json: ${modelPath}`
     );
@@ -37093,11 +37761,12 @@ function createPluginRuntime(cfg, logger = console) {
         validateTlsConfig(cfg, logger);
         client = new LibravDBClient({
           endpoint: cfg.grpcEndpoint || cfg.sidecarPath,
-          timeoutMs: cfg.rpcTimeoutMs ?? DEFAULT_RPC_TIMEOUT_MS,
+          timeoutMs: cfg.rpcTimeoutMs ?? (ENV_RPC_TIMEOUT_MS || DEFAULT_RPC_TIMEOUT_MS),
           tlsCaPath: cfg.grpcEndpointTlsCa,
           tlsMode: cfg.grpcEndpointTlsMode,
           tlsClientCertPath: cfg.grpcEndpointTlsClientCert,
-          tlsClientKeyPath: cfg.grpcEndpointTlsClientKey
+          tlsClientKeyPath: cfg.grpcEndpointTlsClientKey,
+          tenantKey: resolveTenantKey(cfg)
         });
         await client.bootstrapHandshake();
         return client;
@@ -37173,14 +37842,14 @@ function shouldValidateLocalEmbeddingPaths(cfg) {
 }
 function pathExistsAsFile(filePath) {
   try {
-    return existsSync2(filePath) && statSync(filePath).isFile();
+    return existsSync3(filePath) && statSync(filePath).isFile();
   } catch {
     return false;
   }
 }
 function pathExistsAsDirectory(dirPath) {
   try {
-    return existsSync2(dirPath) && statSync(dirPath).isDirectory();
+    return existsSync3(dirPath) && statSync(dirPath).isDirectory();
   } catch {
     return false;
   }