audrey 1.1.3 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,98 @@
 # Changelog
 
+## 1.2.0 - 2026-08-21
+
+### Grounding — memories are checked against the project, not just aged
+
+Confidence has always answered whether a memory is recent, well-sourced, and
+uncontradicted. Nothing answered whether it is still true. A procedure that
+says to deploy with `npm run deploy:prod` kept full confidence after that
+script was deleted, and every recall raised it further, because retrieval
+counts as reinforcement. Stale memory is worse than absent memory: Guard
+states it with evidence attached, so the agent follows it into a wall.
+
+- When a memory is written, Audrey records the checkable claims in it — repository-relative paths and package script names — but only the ones that resolve at that moment. A claim that never resolved is a guess about someone's typo; a claim that resolved once and no longer does is the world having changed underneath a memory that still asserts it. Only the second kind is stored, which is what makes a later break worth reporting.
+- Anchors are re-checked during the maintenance sweep, on `audrey dream`, on demand via `audrey ground`, and through the `memory_ground` MCP tool. A path or script that comes back clears the broken state, so a reverted delete or a branch switch does not permanently discredit a memory.
+- A broken memory keeps its content and its place in the store. Recall labels it, states plainly what it still refers to, and applies a 0.5 confidence multiplier so it stops leading by default while staying readable and repairable.
+- A broken memory can no longer escalate into the capsule's `must_follow` section. That section is the one that can force a strict-mode Guard block, and a rule naming a file that no longer exists is a rule nobody can follow; such memories surface under `uncertain_or_disputed` instead.
+- Unanchored memories are left unlabelled. Absence of anchors is not a clean bill of health, and presenting it as one would be the same mistake in the other direction.
+- A project that cannot be read — a moved checkout, a missing drive — reports unknown rather than broken. Memories are never discredited because the machine changed.
+
+### Memory privacy
+
+- `memory_encode`, `POST /v1/encode`, and `Audrey.encode` now redact content, context values, and affect labels before anything reaches the episodes table, the full-text index, or the embedding model. Previously only tool-trace capture was redacted; a secret pasted into an explicit "remember this" call was stored in plaintext. The MCP tool result now echoes the stored (redacted) content plus a redaction summary instead of reflecting the caller's raw input, and batch encodes embed the redacted text rather than the original.
+- A dedicated redaction rule catches multi-word passphrases and BIP39-style mnemonics (eight or more space- or hyphen-joined lowercase words). The previous identifier exemption treated exactly that shape as a machine identifier and let it through.
+- `redactJson` handles a literal `__proto__` key as ordinary data: the nested value is redacted and preserved instead of silently vanishing through the prototype setter.
+- A filesystem-path shape raises the entropy bar for the high-entropy secret rule instead of exempting the value outright. Long mixed-case paths can cross the plain entropy gate, which mangled stored `cwd` metadata and silently broke Guard project scoping; a blanket exemption fixed that but opened a wider hole, because AWS secret access keys draw from an alphabet containing `/` and roughly one in seventeen lands in a path-like shape by chance. Measured against 20,000 generated keys: 5.78% stored verbatim before, 0.02% after, with every path in a corpus of absolute, relative, temp-directory and toolchain paths still preserved intact.
+- Sensitive key detection matches the sensitive word anywhere in a compound key rather than only as its suffix. `aws_secret_access_key` and `stripe_secret_key` matched nothing before, which also stopped `redactJson`'s sensitive-ancestor fallback from covering their values — so both redaction layers missed the field name credentials actually ship under. Plural collection fields such as `tokens` stay unmatched.
+- `memory_import` and `POST /v1/import` redact content, context, and affect before anything is stored or embedded, and strip the reserved trust marker the same way every other ingestion boundary does. Import previously did neither, so a snapshot could carry secrets into storage verbatim and grant itself verified control-memory trust — the one path that bypassed both of this release's security additions. Imported timestamps must now parse as real dates.
+- `memory_export` escapes markup in its response. It was the one tool returning stored memory content without the anti-injection escaping its siblings apply.
+- Memories marked `private` are excluded from the episode content sent to a configured cloud LLM during consolidation. They still consolidate through the local heuristic path.
+- The first cloud LLM completion in a process prints a one-time stderr notice naming the provider and endpoint before any memory content leaves the machine.
+
+### Guard trust and provenance
+
+- A must-follow memory only escalates to a high-severity directive (capable of forcing a strict-mode block) when its source is `direct-observation` or `told-by-user` **and** its context carries the `audrey_trust: user-verified` marker, which only Autopilot's genuine user-prompt capture can set — MCP, HTTP, and CLI encode boundaries strip it from caller-supplied context. Previously any caller could self-report a trusted source and plant a durable directive into every future Guard decision. Trusted-source memories created before this release are grandfathered at medium severity: still surfaced, never alone sufficient to force a strict block.
+- `Audrey.afterAction` accepts `overrideReason` for recording a succeeded outcome against a receipt that was blocked for a policy reason rather than an exact repeated failure. The reason is written into the event metadata as durable evidence. Exact-repeat-failure blocks still cannot be recorded as succeeded this way; they require a fresh acknowledged `beforeAction`. Exact-repeat detection now applies uniformly across the library API, MCP tools, HTTP routes, and CLI, which previously enforced different subsets of these checks.
+- Generated hooks now guard `MultiEdit` and every `mcp__*` tool from connected MCP servers, excluding Audrey's own memory tools so Guard preflight does not recursively fire on `memory_recall` and its siblings.
+- Preflight reuses the failure analysis its capsule already computed instead of scanning `memory_events` a second time, and its tagged must-follow sweep only runs when a must-follow tag exists anywhere in the store.
+- A failure in that tagged must-follow sweep now surfaces as a high-severity memory-health warning. It was swallowed, so the sweep that exists precisely to catch a control directive the capsule ranked too low could drop it and say nothing.
+- `memory_recall` strips the reserved trust marker from caller-supplied context, matching `POST /v1/recall`. Query-side context feeds match scoring and is never persisted, so this closes no exploit on its own; it keeps the rule "the marker does not cross an external boundary in either direction" true of every boundary rather than resting on a per-handler judgement.
+- The `memory_encode` response falls back to redacted content when re-reading the stored row fails, instead of echoing the caller's raw input. The fallback was the one path that could return a secret the storage boundary had just scrubbed.
+
+### Performance
+
+- `recentFailures()` replaced three correlated per-row subqueries with a single materialized window-function pass backed by a new composite index on `(tool_name, outcome, created_at, actor_agent)`. Measured before the fix: about 199 ms per call at 10,000 `memory_events` rows and about 24 s at 100,000 rows — inside a Guard check whose hook timeout is 30 s. Measured after (`npm run bench:scale`, 50,000 events): 22 ms p95. This query runs on every prompt and every guarded tool call.
+- Database open no longer re-scans episodes, semantics, and procedures for unsynced embeddings on every hook process. A persisted per-table high-water mark plus partial indexes reduce a steady-state open to one `MAX(id)` comparison per table. The mark is keyed on memory id rather than rowid: SQLite hands out `max(rowid)+1`, so deleting the row holding the current maximum makes the next insert reuse that rowid, and a rowid mark then reads the new row as already synced and drops it from its vector table permanently. Memory ids are ULIDs, which a delete never recycles. Schema migrates to v15; each migration commits atomically with its version bump.
+- Consolidation's near-duplicate merge lookup uses the vec0 index instead of computing a cosine distance against every active memory for the agent. That scan ran once per extracted principle inside the consolidation write transaction, holding SQLite's write lock against concurrent Guard hooks. Measured: 2.2 ms at 500 active semantics and 176 ms at 30,000 before, 0.08 ms and 6.1 ms after. `benchmarks/scale.bench.js` now gates this path, which it seeded but never measured.
+- Guard's must-follow existence probe is backed by a partial index. The leading-wildcard `LIKE` scanned the whole episodes table on the hottest path in the system; measured at 50,000 episodes with no match, 3.54 ms before and 0.003 ms after.
+- `memory_events` has retention: Autopilot maintenance prunes events older than 90 days by default (`deleteEventsBefore` batches deletes and reports the count). The table previously grew without bound for the life of an install.
+- `benchmarks/scale.bench.js` seeds tens of thousands of rows and asserts p95 budgets for the hook hot path (`recentFailures`, capsule build, preflight, cold reopen), which the 20-row benchmark that previously gated releases could not catch.
+
+### Recall quality
+
+- Hybrid recall normalizes the FTS signal onto the same scale as the vector score before weighting. The previous fusion mixed a raw 0–1 vector score against reciprocal-rank terms two orders of magnitude smaller, so the nominal 0.7 FTS weight contributed at most ~0.023 and exact keyword or identifier matches almost always lost to loosely similar vector hits.
+- Confidence rewards independent corroboration: `source_type_diversity`, already tracked and reinforced on every semantic memory, now feeds a bounded bonus in the confidence formula. Two identically-supported memories are no longer scored the same when one is backed by three independent source types and the other by three copies of the same source.
+- Consolidation checks new principles against existing active memories and merges near-duplicates (evidence union, reinforcement bookkeeping) instead of minting a redundant semantic or procedure on every dream cycle; recall's duplicate suppression also breaks equal-reliability ties deterministically for near-identical content instead of letting both duplicates through.
+- Capsules accept `excludeIds`, and Autopilot passes the session's already-injected set, so exclusion happens before the character budget is spent and later capsules surface next-ranked unseen memories instead of going quiet while re-fetching content the session has already seen.
+
+### Dependencies
+
+- Took the available production dependency fixes: `hono` 4.12 to 4.13 (cross-user data disclosure through retained SSR output, CORS ReDoS, `Connection` header handling), `@hono/node-server` 1.19.14 to 1.19.17 (path traversal via encoded backslash on Windows), plus `body-parser`, `fast-uri`, and `tar`. All are within the declared ranges; no major versions moved.
+- Two high-severity `sharp` advisories remain, reached through `@huggingface/transformers`, which declares a range with no patched release. Audrey never imports `sharp`, so a text-only embedding pipeline does not execute it, but it is installed and the advisory is real. Recorded in the README production checklist rather than suppressed.
+
+### Autopilot
+
+- Worktree checkouts resolve to their repository's common root, so all worktrees of one repo share a memory namespace instead of fragmenting must-follow rules and failure history per checkout. A drive-qualified pointer (`C:/repo/.git/worktrees/...`) read on a POSIX host is treated as absolute rather than joined onto the worktree directory, so it fails by not existing instead of silently resolving to a path that never did.
+- A named host's generated config uses that host's own agent name instead of inheriting an ambient `AUDREY_AGENT`. Autopilot exports that variable into every hook process, so `audrey install --host codex` run from inside a hooked Claude Code session wrote `claude-code` into Codex's config and pointed both hosts at one memory namespace — in exactly the session where someone is most likely to run the install. The unnamed `generic` host, which has no identity of its own, still honors an explicitly exported name.
+- The Python client accepts an affect without `valence`, matching the TypeScript type and the MCP schemas, which both made it optional. Python was rejecting payloads the server accepts.
+- Only the `global-preference` tag crosses project boundaries. Generic `preference`-class tags no longer leak project-local memories into every other project's packets.
+- Hook processes derive their internal embedding and LLM timeouts from the invoked event's declared host timeout, leaving margin to exit cleanly instead of being killed mid-write by the host.
+
+### Diagnostics
+
+- `audrey doctor` inspects Claude Code hook installs (present handlers, unparseable runtime, missing node/entrypoint paths) with the same depth previously applied only to Codex, and warns when an installed hook entrypoint's version differs from the running CLI — the two known causes of memory packets silently stopping.
+- Hook failures append to a small rotating log under the data directory, independent of the SQLite store, and doctor surfaces the recent failure history. Previously a hook crash left no trace beyond that process's stderr.
+- The MCP tools that return stored memory content directly (`memory_recall`, `memory_capsule`, `memory_greeting`, `memory_guard_before`, `memory_preflight`, `memory_reflexes`) apply the same evidence-not-authority framing and markup escaping as the auto-injected packet, and `memory_recall` no longer silently drops the `partial_failure` degradation signal its HTTP counterpart already reported.
+
+### HTTP surface
+
+- `POST /v1/encode` strips the reserved trust-context marker from caller-supplied `context` before it reaches storage, and `POST /v1/recall` does the same for its `context` match parameter (including the nested `recall.context` that `POST /v1/capsule` forwards to it), so an HTTP caller can no longer self-certify a memory or query as genuine user-stated direction.
+- Adds `POST /v1/promote`, gated behind `AUDREY_ENABLE_ADMIN_TOOLS=1` like `/v1/export`, `/v1/import`, and `/v1/forget`. It mirrors the `memory_promote` MCP tool and CLI command.
+- `POST /v1/guard/after` validates `outcome` against the real enum (`succeeded`, `failed`, `blocked`, `skipped`, `unknown`) instead of a bare type assertion, returning 400 with a specific message on an invalid value instead of a raw SQLite constraint error.
+- `POST /v1/guard/after` accepts `override_reason` / `overrideReason`, plumbed through to `Audrey.afterAction` for recording a succeeded outcome against a Guard receipt that was blocked for a reason other than an exact repeated failure.
+- Every route now honors a per-call `agent` in the request body as a fallback when the `X-Audrey-Agent` header is absent. This makes the Python client's per-call `agent` keyword argument actually take effect; previously it was silently ignored because every route resolved the acting agent from the header only. The header still wins when both are present.
+
+### Provider configuration
+
+- Cloud embedding and LLM providers are never auto-selected from an ambient `ANTHROPIC_API_KEY` or `OPENAI_API_KEY`. Leaving `AUDREY_EMBEDDING_PROVIDER` or `AUDREY_LLM_PROVIDER` unset (or `auto`) uses local embeddings and local heuristic reflection; a cloud provider requires explicitly setting the variable, and doing so without the matching API key now fails loudly instead of running unconfigured.
+
+### Repository hygiene and packaging
+
+- `docs/PRODUCTION_BACKLOG.md` was tracked in git and listed in `package.json`'s `files` array, so an internal P0/P1/P2 backlog, pricing notes, and launch-postmortem detail shipped in every `npm install audrey` tarball. It has been removed from git tracking and from `files`; the content is preserved locally, outside the repo. `docs/AUDREY_PAPER_OUTLINE.md` is removed from `files` too — it is a pre-writing outline, not something a library consumer needs — but stays tracked in git because `scripts/create-paper-submission-bundle.mjs` reads it as a real build input.
+- Trims the published npm package to what a consumer of the library or MCP server actually needs: `dist/`, `examples/`, `README.md`, `CHANGELOG.md`, `SECURITY.md`, and `LICENSE`. Benchmarks, the compiled arXiv PDF, submission bundles, and other repo-only documentation no longer ship. Measured with `npm pack --dry-run`: 399 files / 965.3 kB packed / 4.0 MB unpacked before, 217 files / 332.7 kB packed / 1.5 MB unpacked after.
+- Removes the `pretest` lifecycle hook that made every `npm test` silently run a full rebuild plus the entire benchmark and paper pipeline, including `paper:sync`, which unconditionally overwrote `README.md` and three files under `docs/paper/`. `npm test` is now just the Vitest run; `tests/setup/ensure-release-artifacts.js` already generates the fixtures those tests need. `npm run test:artifacts` remains available as an explicit script; its benchmark steps stay folded into `release:gate`, `release:gate:sandbox`, and `release:gate:paper`, and its paper steps (`paper:sync` onward) remain exclusive to `release:gate:paper`, same as before this change. `release:gate` now builds and runs the performance benchmark explicitly instead of relying on the removed hook to do it implicitly.
+
 ## 1.1.3 - 2026-07-13
 
 ### MCP Registry publishing fixes

package/README.md

@@ -60,7 +60,7 @@ Autopilot then closes the loop:
 | A tool failure is reported | Forms a durable, sanitized failure memory for the next attempt |
 | The turn stops or context compacts | Runs lightweight, due-only consolidation without holding the conversation open |
 
-Infrastructure failures are fail-open by default: a broken memory service must not strand a developer. Teams that need enforcement can set `AUDREY_HOOK_FAIL_CLOSED=1`.
+Each hook event carries a host-declared timeout (30 seconds for the `PreToolUse` Guard check); Audrey races its own internal embedding/LLM timeout a few seconds ahead of that deadline so it can exit cleanly instead of losing the race to the host's kill. Infrastructure failures are fail-open by default: if Audrey itself errors or runs out of time, the tool call proceeds unguarded rather than freezing the session. Set `AUDREY_HOOK_FAIL_CLOSED=1` to deny the action instead when the `PreToolUse` check fails this way; other lifecycle hooks (session start, prompt recall, post-tool bookkeeping) have no "deny" to fall back to and always degrade open regardless of this setting.
 
 ## A small story about a failed deploy
 
@@ -94,11 +94,34 @@ Audrey treats memory as more than a pile of text chunks.
 
 Every context packet includes memory IDs, confidence, provenance where available, and a reason for inclusion. Uncertain or disputed memories are labeled as such. Retrieved content is wrapped with a simple rule: memory is evidence, not authority; current system and user instructions always win.
 
+## When a memory stops being true
+
+Age is not the only way a memory goes wrong. A note saying "ship with `npm run deploy:prod`" is perfectly recent, well sourced, and completely wrong the day that script is deleted. Worse, every recall reinforces it, because retrieval counts as evidence that a memory is useful. A confidently stated, well-supported, false instruction is more damaging than no memory at all.
+
+So Audrey checks. When a memory is written, it records the claims inside it that can be verified against the project — repository-relative paths and package script names — and keeps only the ones that resolve at that moment. That last part is what makes the signal worth anything: a claim that never resolved is a guess about a typo, while a claim that resolved once and no longer does is the world moving out from under a memory that still asserts it.
+
+```bash
+audrey ground
+```
+
+```text
+[audrey] Grounding memories against /home/you/project
+[audrey] Checked 14: 12 still true, 2 broken, 0 repaired.
+[audrey]   01K8ZQ... references a missing npm_script: deploy:prod
+[audrey]   01K8ZR... references a missing path: scripts/release.mjs
+```
+
+Broken memories are not deleted. They keep their content, say plainly what they still refer to, and take a confidence penalty so they stop leading by default while remaining readable and repairable. They also stop being eligible for the packet's must-follow section — that is the section that can force a Guard block, and a rule naming a file that no longer exists is a rule nobody can follow.
+
+Repair is symmetric. Restore the file or the script and the next check clears the flag. A checkout that has moved reports unknown rather than broken, because a memory should not be discredited for describing a project this machine cannot currently see.
+
+Memories with no checkable claims are left unlabeled. Silence is not a clean bill of health, and presenting it as one would be the same mistake pointed the other way.
+
 ## What Audrey deliberately does not do
 
 Audrey does not upload your memory to a hosted service by default. It does not treat every sentence as permanent truth. It does not promote instructions from arbitrary tool output into trusted policy. It does not claim that a small local benchmark proves state-of-the-art memory quality.
 
-Raw prompt events and tool bodies are not retained by default. Audrey stores hashes, bounded summaries, fingerprints, and redaction metadata. Explicit user-memory language is persisted intentionally; tool failure memories are sanitized first. Admin export/import/forget surfaces are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1`.
+Raw prompt events and tool bodies are not retained by default. Audrey stores hashes, bounded summaries, fingerprints, and redaction metadata. Explicit user-memory language is persisted intentionally; tool failure memories are sanitized first. Admin export/import/forget/promote surfaces are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1`.
 
 At-rest encryption, identity-bound tenant authorization, rate limiting, and regulated retention remain deployment responsibilities today. They are not hidden behind a “production ready” badge.
 
@@ -122,7 +145,7 @@ The default store is SQLite, FTS5, and `sqlite-vec`. Local embeddings are the de
 
 ### A safer shared store
 
-Agent-scoped recall now continues through validation, contradiction detection, interference, affect, failure lookup, capsules, greetings, Guard, and REST request routing. Hidden retrieval candidates do not reinforce themselves; only memories actually surfaced to the caller receive retrieval bookkeeping.
+Agent-scoped recall now continues through validation, contradiction detection, interference, affect, failure lookup, capsules, greetings, Guard, and REST request routing. Hidden retrieval candidates do not reinforce themselves; only memories actually surfaced to the caller receive retrieval bookkeeping (usage count and last-reinforced timestamp for semantic and procedural memories). Explicit validation feedback (`memory_validate` / `/v1/validate`) separately adjusts salience based on how a memory actually performed, not merely on being recalled.
 
 Vector candidates are partitioned by agent before nearest-neighbor ranking, so one busy agent cannot crowd another out of a bounded search. For hard tenant boundaries, still use a distinct `AUDREY_DATA_DIR` per tenant or security domain.
 
@@ -223,10 +246,10 @@ The shared hook adapter normalizes current Codex and Claude Code payloads.
 
 - Context injection is bounded by `AUDREY_CONTEXT_BUDGET_CHARS` (default 4000; Autopilot uses a conservative 3200-character packet unless overridden).
 - Prompt and tool retrieval queries are bounded before embedding. Large edits carry hashes and lengths instead of file bodies; exact Guard identity uses a full redacted digest rather than a truncated prefix.
-- Only `Bash`, `Edit`, `Write`, `NotebookEdit`, and `apply_patch` are guarded and observed by the generated default hooks.
+- The generated default hooks guard and observe `Bash`, `Edit`, `MultiEdit`, `Write`, `NotebookEdit`, `apply_patch`, and every `mcp__*` tool from connected MCP servers, excluding Audrey's own memory tools so the Guard never guards itself.
 - Pre/post correlation uses `session_id + tool_use_id`, so parallel tool calls do not attach to the wrong receipt.
 - Claude `PostToolUseFailure` and Codex responses that explicitly expose a non-zero exit normalize to the same failure path. Current Codex hooks can omit Bash exit status; Audrey records an opaque result as `unknown`, never as invented success.
-- Context and Guard failures emit `{}` and log to stderr unless fail-closed mode is explicitly enabled.
+- On an internal error, every hook logs to stderr and emits `{}` (no opinion, so the tool proceeds). Only `PreToolUse` changes behavior under `AUDREY_HOOK_FAIL_CLOSED=1`, emitting a deny decision instead; context-injection and post-tool hooks have no deny path and always emit `{}`.
 - Stop hooks always emit valid JSON and never continue or block a completed turn.
 
 Codex hook interception is a guardrail, not a complete shell-policy boundary. The current host contract does not intercept every richer `unified_exec` path and may omit the exit status of silent Bash failures. See the [Codex hooks documentation](https://learn.chatgpt.com/docs/hooks). Use the Guard receipt as evidence, and keep sandboxing, approvals, CI, and deployment controls in place.
@@ -285,8 +308,9 @@ Core routes:
 | Close a Guard receipt | `POST /v1/guard/after` |
 | Consolidate and decay | `POST /v1/dream` |
 | Health and index state | `GET /v1/status` |
+| Promote learned procedures to rule files (admin) | `POST /v1/promote` |
 
-Use `AUDREY_API_KEY` for any non-loopback deployment. `X-Audrey-Agent` scopes encode, recall, capsules, preflight, Guard, consolidation, and greetings inside a trusted deployment; it is a routing header, not an authentication boundary. Bind agent/tenant identity at your gateway rather than trusting an arbitrary public header.
+Use `AUDREY_API_KEY` for any non-loopback deployment. `X-Audrey-Agent` scopes encode, recall, capsules, preflight, Guard, consolidation, and greetings inside a trusted deployment; it is a routing header, not an authentication boundary. Bind agent/tenant identity at your gateway rather than trusting an arbitrary public header. Every route also accepts a per-call `agent` field in the JSON body as a fallback for callers (such as the Python client) that cannot set a header per request; the header wins whenever both are present.
 
 ### Python client
 
@@ -311,7 +335,8 @@ episode
   ├─ transactional SQLite + vector + FTS write
   ├─ agent-scoped interference / resonance / validation
   ├─ reinforcement or contradiction evidence
-  └─ sleep-time consolidation into semantic or procedural memory
+  ├─ sleep-time consolidation into semantic or procedural memory
+  └─ grounding checks that stored claims still hold in the project
 
 query
   ├─ bounded vector candidates
@@ -325,12 +350,12 @@ Agent-scoped vector search uses a native `sqlite-vec` partition key before neare
 
 ### MCP surface
 
-Audrey exposes 22 MCP tools plus status, recent-memory, and principle resources and briefing/recall/reflection prompts. The main groups are:
+Audrey exposes 23 MCP tools plus status, recent-memory, and principle resources and briefing/recall/reflection prompts. The main groups are:
 
 - capture: `memory_encode`, `memory_reflect`, `memory_observe_tool`
 - retrieval: `memory_recall`, `memory_capsule`, `memory_greeting`
 - action safety: `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`
-- lifecycle: `memory_consolidate`, `memory_dream`, `memory_decay`, `memory_resolve_truth`
+- lifecycle: `memory_consolidate`, `memory_dream`, `memory_decay`, `memory_resolve_truth`, `memory_ground`
 - governance: `memory_validate`, `memory_promote`, `memory_forget`, `memory_export`, `memory_import`, `memory_status`, `memory_introspect`
 
 The server also sends host instructions explaining the Guard receipt loop when lifecycle hooks are unavailable.
@@ -342,7 +367,7 @@ The server also sends host instructions explaining the Guard receipt loop when l
 | `AUDREY_DATA_DIR` | `~/.audrey/data` | SQLite store; use a distinct directory per tenant/security boundary |
 | `AUDREY_AGENT` | host-specific | Logical memory owner used for scoped operations |
 | `AUDREY_EMBEDDING_PROVIDER` | `local` | `local`, `gemini`, `openai`, or `mock` |
-| `AUDREY_LLM_PROVIDER` | auto | `anthropic`, `openai`, or `mock` for reflection/consolidation |
+| `AUDREY_LLM_PROVIDER` | unset | `anthropic`, `openai`, or `mock` for reflection/consolidation; unset (or `auto`) uses local heuristics only, never an ambient `ANTHROPIC_API_KEY`/`OPENAI_API_KEY` |
 | `AUDREY_LLM_MODEL` | provider default | Explicit LLM model override |
 | `AUDREY_DEVICE` | `gpu` | Local embedding device; falls back to CPU |
 | `AUDREY_CONTEXT_BUDGET_CHARS` | `4000` | Maximum default capsule size |
@@ -353,7 +378,7 @@ The server also sends host instructions explaining the Guard receipt loop when l
 | `AUDREY_API_KEY` | unset | Bearer token for REST access |
 | `AUDREY_HOST` | `127.0.0.1` | REST bind address |
 | `AUDREY_PORT` | `7437` | REST port |
-| `AUDREY_ENABLE_ADMIN_TOOLS` | `0` | Enable export, import, and forget operations |
+| `AUDREY_ENABLE_ADMIN_TOOLS` | `0` | Enable export, import, forget, and promote operations |
 | `AUDREY_ENABLE_SHARED_SCOPE` | `0` | Allow explicit cross-agent REST recall; admin tools also enable it |
 | `AUDREY_PROFILE` | `0` | Include stage timing diagnostics |
 | `AUDREY_DISABLE_WARMUP` | `0` | Disable MCP embedding warmup |
@@ -374,6 +399,8 @@ Provider secrets are never embedded in generated hook commands. `--include-secre
 - Keep the hook runtime on a stable installed path.
 - Load-test concurrent writers for your topology; SQLite WAL is not a distributed coordination layer.
 
+`npm audit --omit=dev` reports two high-severity advisories against `sharp`, pulled in as a hard dependency of `@huggingface/transformers` for the local embedding runtime. There is no patched release compatible with the version range that package declares. Audrey never imports `sharp` — it is image-preprocessing code that a text-only embedding pipeline does not reach — but the package is installed, so the advisory is genuine and unresolved rather than dismissed. Running with `AUDREY_EMBEDDING_PROVIDER` set to a hosted provider avoids the dependency path entirely.
+
 ### Benchmarks and evidence
 
 Run the release gates locally:
@@ -390,7 +417,7 @@ npm run pack:check
 GuardBench currently contains ten local, deterministic pre-action scenarios covering repeated failures, procedures, scope changes, recovery, redaction, conflicting instructions, and noisy stores. The checked-in v1 methodology uses a mock 64-dimensional embedding provider and exists to catch regressions. A perfect local pass is not a claim about real-provider latency or production false-positive rates.
 
 <!-- guardbench-summary:start -->
-Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 4.607ms / 21.585ms p50/p95 Guard latency under the mock-provider methodology.
+Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 3.805ms / 13.445ms p50/p95 Guard latency under the mock-provider methodology.
 <!-- guardbench-summary:end -->
 
 `benchmarks/perf-snapshot.js` measures encode and hybrid-recall p50/p95/p99 at configurable corpus sizes with machine and provider provenance. Run it on the hardware and embedding provider you plan to operate; hosted-provider latency is dominated by its network round trip.

package/dist/mcp-server/codex-hooks-probe.d.ts

@@ -0,0 +1,22 @@
+export interface CodexReportedHook {
+    sourcePath: string;
+    enabled: boolean;
+    trustStatus: string;
+    statusMessage: string;
+    command: string;
+}
+export interface CodexHooksProbeResult {
+    hooks: CodexReportedHook[];
+    warnings: string[];
+    errors: string[];
+}
+export interface CodexHooksProbeInvocation {
+    command: string;
+    argsPrefix: string[];
+    cwd: string;
+    version: string;
+    timeoutMs?: number;
+}
+export declare function parseCodexHooksListResponse(response: unknown): CodexHooksProbeResult;
+export declare function probeCodexHooks(invocation: CodexHooksProbeInvocation): Promise<CodexHooksProbeResult>;
+//# sourceMappingURL=codex-hooks-probe.d.ts.map

package/dist/mcp-server/codex-hooks-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-hooks-probe.d.ts","sourceRoot":"","sources":["../../mcp-server/codex-hooks-probe.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAcD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAoCpF;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,qBAAqB,CAAC,CAkFhC"}

package/dist/mcp-server/codex-hooks-probe.js

@@ -0,0 +1,160 @@
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringList(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+        : [];
+}
+export function parseCodexHooksListResponse(response) {
+    const envelope = asRecord(response);
+    const responseError = asRecord(envelope?.['error']);
+    if (responseError) {
+        const message = typeof responseError['message'] === 'string'
+            ? responseError['message']
+            : 'Codex hooks/list returned an error.';
+        throw new Error(message);
+    }
+    const result = asRecord(envelope?.['result']);
+    const data = result?.['data'];
+    if (!Array.isArray(data))
+        throw new Error('Codex hooks/list response did not contain result.data.');
+    const parsed = { hooks: [], warnings: [], errors: [] };
+    for (const cwdValue of data) {
+        const cwdResult = asRecord(cwdValue);
+        if (!cwdResult)
+            continue;
+        parsed.warnings.push(...stringList(cwdResult['warnings']));
+        parsed.errors.push(...stringList(cwdResult['errors']));
+        const hooks = cwdResult['hooks'];
+        if (!Array.isArray(hooks))
+            continue;
+        for (const hookValue of hooks) {
+            const hook = asRecord(hookValue);
+            if (!hook)
+                continue;
+            parsed.hooks.push({
+                sourcePath: typeof hook['sourcePath'] === 'string' ? hook['sourcePath'] : '',
+                enabled: hook['enabled'] === true,
+                trustStatus: typeof hook['trustStatus'] === 'string' ? hook['trustStatus'] : 'unknown',
+                statusMessage: typeof hook['statusMessage'] === 'string' ? hook['statusMessage'] : '',
+                command: typeof hook['command'] === 'string' ? hook['command'] : '',
+            });
+        }
+    }
+    return parsed;
+}
+export function probeCodexHooks(invocation) {
+    return new Promise((resolveProbe, rejectProbe) => {
+        const child = spawn(invocation.command, [...invocation.argsPrefix, 'app-server', '--stdio'], {
+            cwd: invocation.cwd,
+            env: process.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        const stdout = createInterface({ input: child.stdout });
+        let stderr = '';
+        let settled = false;
+        const settle = (error, result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            stdout.close();
+            child.stdin.end();
+            child.kill();
+            if (error)
+                rejectProbe(error);
+            else
+                resolveProbe(result);
+        };
+        const timer = setTimeout(() => {
+            settle(new Error('Codex app-server hooks/list probe timed out.'));
+        }, invocation.timeoutMs ?? 8_000);
+        child.stderr.on('data', chunk => {
+            if (stderr.length < 4_000)
+                stderr += String(chunk).slice(0, 4_000 - stderr.length);
+        });
+        child.on('error', error => settle(error));
+        // Without these, a broken/removed binary or a pipe closed after spawn (EPIPE) raises an
+        // unhandled 'error' event on stdin/stdout and crashes the host process instead of
+        // rejecting this probe.
+        child.stdin.on('error', error => settle(error));
+        child.stdout.on('error', error => settle(error));
+        child.on('exit', code => {
+            if (!settled) {
+                const detail = stderr.trim() ? `: ${stderr.trim()}` : '';
+                settle(new Error(`Codex app-server exited before hooks/list completed (${code})${detail}`));
+            }
+        });
+        stdout.on('line', line => {
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                return;
+            }
+            const record = asRecord(message);
+            if (record?.['id'] === 0) {
+                child.stdin.write(`${JSON.stringify({ method: 'initialized', params: {} })}\n`);
+                child.stdin.write(`${JSON.stringify({
+                    method: 'hooks/list',
+                    id: 1,
+                    params: { cwds: [invocation.cwd] },
+                })}\n`);
+            }
+            else if (record?.['id'] === 1) {
+                try {
+                    settle(null, parseCodexHooksListResponse(message));
+                }
+                catch (error) {
+                    settle(error instanceof Error ? error : new Error(String(error)));
+                }
+            }
+        });
+        child.stdin.write(`${JSON.stringify({
+            method: 'initialize',
+            id: 0,
+            params: {
+                clientInfo: {
+                    name: 'audrey_doctor',
+                    title: 'Audrey Doctor',
+                    version: invocation.version,
+                },
+            },
+        })}\n`);
+    });
+}
+function isMainModule() {
+    const invoked = process.argv[1];
+    if (!invoked)
+        return false;
+    const actual = resolve(fileURLToPath(import.meta.url));
+    const requested = resolve(invoked);
+    return process.platform === 'win32'
+        ? actual.toLowerCase() === requested.toLowerCase()
+        : actual === requested;
+}
+if (isMainModule()) {
+    const encoded = process.argv[2];
+    try {
+        if (!encoded)
+            throw new Error('Codex hooks probe invocation is missing.');
+        const invocation = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+        const result = await probeCodexHooks(invocation);
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`${message.replace(/[\r\n]+/g, ' ')}\n`);
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=codex-hooks-probe.js.map

package/dist/mcp-server/codex-hooks-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-hooks-probe.js","sourceRoot":"","sources":["../../mcp-server/codex-hooks-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAiB;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,OAAO,GACX,OAAO,aAAa,CAAC,SAAS,CAAC,KAAK,QAAQ;YAC1C,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC;YAC1B,CAAC,CAAC,qCAAqC,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAE5E,MAAM,MAAM,GAA0B,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9E,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,UAAU,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;gBACjC,WAAW,EAAE,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtF,aAAa,EAAE,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrF,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,UAAqC;IAErC,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE;YAC3F,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,MAA8B,EAAQ,EAAE;YAC3E,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,KAAK;gBAAE,WAAW,CAAC,KAAK,CAAC,CAAC;;gBACzB,YAAY,CAAC,MAAO,CAAC,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACpE,CAAC,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QAElC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,wFAAwF;QACxF,kFAAkF;QAClF,wBAAwB;QACxB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YACtB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YACvB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAChF,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChB,MAAM,EAAE,YAAY;oBACpB,EAAE,EAAE,CAAC;oBACL,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;iBACnC,CAAC,IAAI,CACP,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,GAAG,IAAI,CAAC,SAAS,CAAC;YAChB,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,CAAC;YACL,MAAM,EAAE;gBACN,UAAU,EAAE;oBACV,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;aACF;SACF,CAAC,IAAI,CACP,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE;QAClD,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtB,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/mcp-server/config.d.ts

@@ -1,5 +1,5 @@
 import type { AudreyConfig, EmbeddingConfig, LLMConfig } from '../src/types.js';
-export declare const VERSION = "1.1.3";
+export declare const VERSION = "1.2.0";
 export declare const SERVER_NAME = "audrey-memory";
 export declare const DEFAULT_AGENT = "local-agent";
 export declare const DEFAULT_DATA_DIR: string;
@@ -29,13 +29,37 @@ export declare function resolveDataDir(env?: Record<string, string | undefined>)
 export declare function resolveEmbeddingProvider(env: Record<string, string | undefined>, explicit?: string | undefined): EmbeddingConfig & {
     dimensions: number;
 };
-export declare function resolveLLMProvider(env: Record<string, string | undefined>, explicit?: string | undefined): (LLMConfig & {
+/**
+ * Resolves which LLM provider to use for principle extraction / reflection.
+ * Priority: explicit config -> none (local heuristics only).
+ * Cloud providers are never auto-selected from ambient API keys: memory
+ * content is sent to the provider verbatim (buildPrincipleExtractionPrompt),
+ * so leaving AUDREY_LLM_PROVIDER unset (or 'auto') must never cause content
+ * to leave the machine just because ANTHROPIC_API_KEY/OPENAI_API_KEY happens
+ * to be set for some unrelated tool. Choose a cloud provider explicitly with
+ * AUDREY_LLM_PROVIDER=anthropic|openai.
+ */
+export declare function resolveLLMProvider(env: Record<string, string | undefined>, explicit?: string | undefined, options?: {
+    requireApiKey?: boolean;
+}): (LLMConfig & {
     apiKey?: string;
 }) | null;
 export declare function buildAudreyConfig(): AudreyConfig;
 export declare function resolveHostAgent(host: string | undefined): string;
 export declare function buildAudreyMcpEnv(env?: Record<string, string | undefined>, agent?: string, options?: McpEnvOptions): Record<string, string>;
 export declare function buildAutopilotRuntimeArgs(env?: Record<string, string | undefined>, agent?: string): string[];
+/**
+ * The agent name to write into a host's generated configuration.
+ *
+ * A named host owns its agent name; only the unnamed 'generic' host falls
+ * back to the ambient AUDREY_AGENT. Autopilot exports AUDREY_AGENT into
+ * every hook process, so `audrey install --host codex` run from inside a
+ * hooked Claude Code session used to inherit 'claude-code' and write that
+ * into Codex's config — pointing a second host at the first host's memory
+ * namespace, silently, in exactly the session where someone is most likely
+ * to run the install.
+ */
+export declare function resolveConfiguredAgent(env: Record<string, string | undefined>, host: string | undefined): string;
 export declare function buildStdioMcpServerConfig(env?: Record<string, string | undefined>, host?: string | undefined): {
     command: string;
     args: string[];

package/dist/mcp-server/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../mcp-server/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEhF,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAqC,CAAC;AACnE,eAAO,MAAM,cAAc,QAAwD,CAAC;AAEpF,eAAO,MAAM,gBAAgB;;;;;;;;;CASnB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,UAAU,aAAa;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACtC;AAyBD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAA4C,GAC9D,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB1C;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAAsC,GACxD,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAsB1C;AAED,wBAAgB,iBAAiB,IAAI,YAAY,CAehD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,EAC5C,OAAO,GAAE,aAAkB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0CxB;AAWD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,GAC3C,MAAM,EAAE,CAMV;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,IAAI,GAAE,MAAM,GAAG,SAAqB,GACnC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAOlE;AAgCD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,GAAG,SAAqB,EACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAgBR;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAqBV;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAUV"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../mcp-server/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEhF,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAC3C,eAAO,MAAM,gBAAgB,QAAqC,CAAC;AACnE,eAAO,MAAM,cAAc,QAAwD,CAAC;AAEpF,eAAO,MAAM,gBAAgB;;;;;;;;;CASnB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAEvD,UAAU,aAAa;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACtC;AAyBD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAA4C,GAC9D,eAAe,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAgB1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,GAAE,MAAM,GAAG,SAAsC,EACzD,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,CAAC,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CA0B1C;AAED,wBAAgB,iBAAiB,IAAI,YAAY,CAehD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,EAC5C,OAAO,GAAE,aAAkB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6CxB;AAWD,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,KAAK,SAAuC,GAC3C,MAAM,EAAE,CAMV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAGR;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,IAAI,GAAE,MAAM,GAAG,SAAqB,GACnC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAOlE;AAgCD,wBAAgB,mBAAmB,CACjC,IAAI,GAAE,MAAM,GAAG,SAAqB,EACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAgBR;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAqBV;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,OAAO,GAAE,aAAkB,GAC1B,MAAM,EAAE,CAUV"}