eminiar 0.8.0 → 0.9.0

package/dist/hook.js

@@ -3941,11 +3941,11 @@ var require_out = __commonJS({
       async.read(path2, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports.stat = stat;
-    function statSync5(path2, optionsOrSettings) {
+    function statSync6(path2, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path2, settings);
     }
-    exports.statSync = statSync5;
+    exports.statSync = statSync6;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -4403,7 +4403,7 @@ var require_queue = __commonJS({
       if (!(_concurrency >= 1)) {
         throw new Error("fastqueue concurrency must be equal to or greater than 1");
       }
-      var cache2 = reusify(Task);
+      var cache3 = reusify(Task);
       var queueHead = null;
       var queueTail = null;
       var _running = 0;
@@ -4482,7 +4482,7 @@ var require_queue = __commonJS({
         return _running === 0 && self.length() === 0;
       }
       function push(value, done) {
-        var current = cache2.get();
+        var current = cache3.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -4503,7 +4503,7 @@ var require_queue = __commonJS({
         }
       }
       function unshift(value, done) {
-        var current = cache2.get();
+        var current = cache3.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -4525,7 +4525,7 @@ var require_queue = __commonJS({
       }
       function release(holder) {
         if (holder) {
-          cache2.release(holder);
+          cache3.release(holder);
         }
         var next = queueHead;
         if (next && _running <= _concurrency) {
@@ -4575,7 +4575,7 @@ var require_queue = __commonJS({
             errorHandler2(new Error("abort"), val);
           }
           callback.call(context2, new Error("abort"));
-          cache2.release(current);
+          cache3.release(current);
           current = next;
         }
         self.drain = noop;
@@ -5917,7 +5917,9 @@ var CATEGORIES = {
   intent: 4,
   data: 4,
   tool_call: 4,
-  session_start: 4
+  session_start: 4,
+  /** A proactive recall decision (fired or quiet) and what it showed; never in the guide. */
+  recall: 4
 };
 var GUIDE_ORDER = [
   { title: "Last Request", categories: ["user_prompt"] },
@@ -25733,21 +25735,21 @@ function visit(schema, fnOrHandlers) {
     const h = fnOrHandlers[node2._zod.def.type];
     return h ? h(node2, rewritten) : node2;
   };
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   function run(s) {
-    const cached3 = cache2.get(s);
+    const cached3 = cache3.get(s);
     if (cached3 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache2.get(s)
+        getter: () => cache3.get(s)
       });
     }
     if (cached3 !== void 0)
       return cached3;
-    cache2.set(s, RESOLVING);
+    cache3.set(s, RESOLVING);
     const inner = mapInner(s);
     const mapped = fn(inner, inner !== s);
-    cache2.set(s, mapped);
+    cache3.set(s, mapped);
     return mapped;
   }
   function mapInner(s) {
@@ -26082,7 +26084,12 @@ var ConfigSchema = external_exports.object({
     /** Before WebSearch / WebFetch: the indexed doc pages that already answer it. */
     onWeb: external_exports.boolean().default(true),
     maxMemories: external_exports.number().int().min(0).max(10).default(3),
-    maxDocs: external_exports.number().int().min(0).max(10).default(2)
+    maxDocs: external_exports.number().int().min(0).max(10).default(2),
+    /**
+     * Prompts after which an item already shown in this context window may be injected
+     * again when it matches (0 = once per context window only).
+     */
+    repeatAfter: external_exports.number().int().min(0).max(1e3).default(10)
   }).prefault({}),
   docs: external_exports.object({
     /** Project-relative manifest of documentation sources (`em_docs`); commit it. */
@@ -26975,6 +26982,8 @@ var PROMPT_FILLER = /* @__PURE__ */ new Set([
 ]);
 var MAX_TERMS = 16;
 var RECALL_CATEGORY = "recall";
+var DEFAULT_REPEAT_AFTER = 10;
+var NAME_MATCH_RATIO = 0.3;
 function promptTerms(prompt) {
   const body = prompt.replace(/^\s*\/\S+/, " ");
   return parseQuery(body).terms.filter((t) => t.length >= 3 && !PROMPT_FILLER.has(t) && !/^\d+$/.test(t)).slice(0, MAX_TERMS);
@@ -26982,26 +26991,50 @@ function promptTerms(prompt) {
 function requiredMatches(termCount) {
   return Math.min(3, Math.max(2, Math.ceil(termCount * 0.2)));
 }
-function shownKeys(db, sessionId) {
+function shownKeys(db, sessionId, repeatAfter = DEFAULT_REPEAT_AFTER) {
   const events = db.eventsBySession(sessionId, {
-    categories: [RECALL_CATEGORY, "session_start"]
+    categories: [RECALL_CATEGORY, "session_start", "user_prompt"]
   });
-  const out = /* @__PURE__ */ new Set();
+  const shownAt = /* @__PURE__ */ new Map();
+  let prompts = 0;
   for (const e of events) {
     if (e.category === "session_start") {
-      out.clear();
+      shownAt.clear();
+      prompts = 0;
+      continue;
+    }
+    if (e.category === "user_prompt") {
+      prompts++;
       continue;
     }
     try {
-      for (const k of JSON.parse(e.payload).keys ?? []) out.add(k);
+      for (const k of JSON.parse(e.payload).keys ?? [])
+        shownAt.set(k, prompts);
     } catch {
     }
   }
+  const out = /* @__PURE__ */ new Set();
+  for (const [k, at] of shownAt) if (repeatAfter <= 0 || prompts - at < repeatAfter) out.add(k);
   return out;
 }
-function recordShown(db, sessionId, keys) {
-  if (!keys.length) return;
-  db.eventInsert({ sessionId, category: RECALL_CATEGORY, priority: 4, payload: { keys } });
+function recordShown(db, sessionId, keys, info = { path: "prompt" }) {
+  if (!keys.length && !info.trace) return;
+  const t = info.trace;
+  db.eventInsert({
+    sessionId,
+    category: RECALL_CATEGORY,
+    priority: 4,
+    payload: {
+      keys,
+      path: info.path,
+      ...t ? {
+        terms: t.terms,
+        need: t.need,
+        candidates: t.candidates.length,
+        gated: t.candidates.filter((c) => c.outcome !== "shown").slice(0, 6).map((c) => `${c.key} ${c.outcome}${c.why ? ` (${c.why})` : ""}`)
+      } : {}
+    }
+  });
 }
 function clip2(s, max) {
   const t = s.replace(/\s+/g, " ").trim();
@@ -27024,16 +27057,53 @@ function kindRank(kind) {
   const i = KIND_ORDER.indexOf(kind);
   return i === -1 ? KIND_ORDER.length : i;
 }
+function sharedTerms(terms, ...texts) {
+  const hay = texts.join("\n").toLowerCase();
+  return terms.filter((t) => {
+    const base = t.replace(/\*$/, "").toLowerCase();
+    return !!base && new RegExp(`(?<![\\p{L}\\p{N}_])${escapeRe(base)}`, "u").test(hay);
+  });
+}
+function nameTerms(m) {
+  const slug = (m.name ?? "").split("/").pop() ?? "";
+  let tags = [];
+  try {
+    tags = m.tags ? JSON.parse(m.tags) : [];
+  } catch {
+  }
+  return [...slug.toLowerCase().split(/[-._]+/), ...tags.map((t) => t.toLowerCase())].filter(
+    (t) => t.length >= 4
+  );
+}
+function namesMemory(term, names) {
+  const t = term.replace(/\*$/, "");
+  if (t.length < 4) return false;
+  return names.some((n) => t === n || t.includes(n) || n.includes(t));
+}
+function qualifies(matched, need, termCount, m, text) {
+  if (matched.length >= need) return { ok: true };
+  if (m?.name && text?.toLowerCase().includes(m.name)) return { ok: true, why: "named" };
+  if (m && matched.length >= 1 && matched.length / Math.max(1, termCount) >= NAME_MATCH_RATIO) {
+    const names = nameTerms(m);
+    const hit = matched.find((t) => namesMemory(t, names));
+    if (hit) return { ok: true, why: `slug/tag "${hit}"` };
+  }
+  return { ok: false, why: `${matched.length}/${need} terms` };
+}
 async function recallForText(db, text, opts = {}) {
   const maxMemories = opts.maxMemories ?? 3;
   const maxDocs = opts.maxDocs ?? 2;
   const terms = promptTerms(text);
-  if (terms.length < 2 || maxMemories <= 0 && maxDocs <= 0) return { text: "", keys: [] };
+  const trace = opts.trace ? { path: opts.path ?? "prompt", terms, need: 0, candidates: [] } : void 0;
+  const quiet = () => ({ text: "", keys: [], trace });
+  if (terms.length < 2 || maxMemories <= 0 && maxDocs <= 0) return quiet();
   const need = opts.minMatches ?? requiredMatches(terms.length);
+  if (trace) trace.need = need;
   const query = terms.join(" ");
-  const seen = opts.sessionId ? shownKeys(db, opts.sessionId) : /* @__PURE__ */ new Set();
+  const seen = opts.sessionId ? shownKeys(db, opts.sessionId, opts.repeatAfter) : /* @__PURE__ */ new Set();
   const lines = [];
   const keys = [];
+  const note = (c) => trace?.candidates.push(c);
   if (maxMemories > 0) {
     const r = await search(db, query, {
       mode: "lexical",
@@ -27042,14 +27112,38 @@ async function recallForText(db, text, opts = {}) {
       filters: { source: "memory" }
     });
     let n = 0;
+    const considered = /* @__PURE__ */ new Set();
     for (const h of r.hits) {
-      if (n >= maxMemories) break;
-      if (h.matched.length < need) continue;
       const uri = h.chunk.document.uri;
       const name = uri?.startsWith("memory:") ? uri.slice(7) : void 0;
       const m = name ? db.memoryGetByName(name) : void 0;
       const key = `memory:${name}`;
-      if (!m?.name || !live(m) || !specific(m) || seen.has(key) || keys.includes(key)) continue;
+      if (!m?.name || considered.has(key)) continue;
+      considered.add(key);
+      const label = `${m.name} [${m.kind}]`;
+      const matched = sharedTerms(terms, m.name, m.content, m.tags ?? "");
+      if (!live(m)) {
+        note({ key, label, matched, outcome: "skipped", why: m.status ?? "retired" });
+        continue;
+      }
+      if (!specific(m)) {
+        note({ key, label, matched, outcome: "skipped", why: "onboarding" });
+        continue;
+      }
+      const q = qualifies(matched, need, terms.length, m, text);
+      if (!q.ok) {
+        note({ key, label, matched, outcome: "gated", why: q.why });
+        continue;
+      }
+      if (seen.has(key)) {
+        note({ key, label, matched, outcome: "seen", why: q.why });
+        continue;
+      }
+      if (n >= maxMemories) {
+        note({ key, label, matched, outcome: "over-limit", why: q.why });
+        continue;
+      }
+      note({ key, label, matched, outcome: "shown", why: q.why });
       lines.push(`- memory ${m.name} [${m.kind}]: ${gist(m)}`);
       keys.push(key);
       n++;
@@ -27064,28 +27158,62 @@ async function recallForText(db, text, opts = {}) {
     let n = 0;
     const docsSeen = /* @__PURE__ */ new Set();
     for (const h of r.hits) {
-      if (n >= maxDocs) break;
-      if (h.matched.length < need) continue;
       const d = h.chunk.document;
       const key = `doc:${d.id}`;
-      if (docsSeen.has(d.id) || seen.has(key)) continue;
+      if (docsSeen.has(d.id)) continue;
       docsSeen.add(d.id);
+      const label = `${d.source} \u203A ${clip2(d.title, 60)}`;
+      const matched = sharedTerms(terms, h.chunk.title, h.chunk.body);
+      if (matched.length < need) {
+        note({ key, label, matched, outcome: "gated", why: `${matched.length}/${need} terms` });
+        continue;
+      }
+      if (seen.has(key)) {
+        note({ key, label, matched, outcome: "seen" });
+        continue;
+      }
+      if (n >= maxDocs) {
+        note({ key, label, matched, outcome: "over-limit" });
+        continue;
+      }
+      note({ key, label, matched, outcome: "shown" });
       lines.push(`- ${d.source} \u203A ${clip2(d.title, 80)}: ${clip2(h.snippet, 160)}`);
       keys.push(key);
       n++;
     }
   }
-  if (!lines.length) return { text: "", keys: [] };
+  if (!lines.length) return quiet();
   return {
     text: [
       "eminiar recall \u2014 project memories and indexed docs that match this request (check them before deciding; superseded ones are omitted):",
       ...lines,
       'Full text: em_memory {action:"read", name} for a memory, em_docs {action:"lookup", query} for docs; em_recall {query} searches further.'
     ].join("\n"),
-    keys
+    keys,
+    trace
   };
 }
-function mentionsFile(m, rel) {
+var SYMBOL_KINDS = [
+  "function",
+  "class",
+  "method",
+  "interface",
+  "trait",
+  "type",
+  "enum",
+  "variable"
+];
+function fileSymbols(db, rel) {
+  try {
+    return db.graphFindNodes({ path: rel, kinds: SYMBOL_KINDS, limit: 400 }).filter((n) => n.path === rel).map((n) => n.name);
+  } catch {
+    return [];
+  }
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function linksFile(m, rel) {
   if (!m.node_ids) return false;
   try {
     return JSON.parse(m.node_ids).some((id) => fileOf(id) === rel);
@@ -27093,23 +27221,50 @@ function mentionsFile(m, rel) {
     return false;
   }
 }
+function bodyNamesPath(body, rel) {
+  return new RegExp(`(?:^|[^\\w/.-]|\\./)${escapeRe(rel)}(?![\\w-])`, "m").test(body);
+}
+function symbolMentionPattern(symbols) {
+  const names = [...new Set(symbols)].filter((s) => /^[A-Za-z_$][\w$]{4,}$/.test(s));
+  if (!names.length) return void 0;
+  const alt = names.map(escapeRe).join("|");
+  return new RegExp(`(?:[\`#.](?:${alt})(?!\\w)|(?<!\\w)(?:${alt})\\()`);
+}
 function memoriesForFile(db, rel, opts = {}) {
-  const linked = db.memoryList({ limit: 1e3 }).filter((m) => live(m) && specific(m) && mentionsFile(m, rel)).sort((a, b) => kindRank(a.kind) - kindRank(b.kind));
-  if (!linked.length) return { text: "", keys: [] };
-  const seen = opts.sessionId ? shownKeys(db, opts.sessionId) : /* @__PURE__ */ new Set();
+  const symRe = opts.symbols?.length ? symbolMentionPattern(opts.symbols) : void 0;
+  const how = (m) => {
+    if (linksFile(m, rel)) return "related";
+    if (bodyNamesPath(m.content, rel)) return "names the path";
+    if (symRe?.test(m.content)) return "names a symbol";
+    return void 0;
+  };
+  const trace = opts.trace ? { path: "file", terms: [rel], need: 0, candidates: [] } : void 0;
+  const linked = db.memoryList({ limit: 1e3 }).map((m) => ({ m, why: how(m) })).filter((x) => !!x.why && live(x.m) && specific(x.m)).sort((a, b) => kindRank(a.m.kind) - kindRank(b.m.kind));
+  if (!linked.length) return { text: "", keys: [], trace };
+  const seen = opts.sessionId ? shownKeys(db, opts.sessionId, opts.repeatAfter) : /* @__PURE__ */ new Set();
   const lines = [];
   const keys = [];
-  for (const m of linked) {
-    if (lines.length >= (opts.max ?? 3)) break;
+  for (const { m, why } of linked) {
     const key = `memory:${m.name}`;
-    if (!m.name || seen.has(key)) continue;
+    const label = `${m.name} [${m.kind}]`;
+    if (!m.name) continue;
+    if (seen.has(key)) {
+      trace?.candidates.push({ key, label, matched: [rel], outcome: "seen", why });
+      continue;
+    }
+    if (lines.length >= (opts.max ?? 3)) {
+      trace?.candidates.push({ key, label, matched: [rel], outcome: "over-limit", why });
+      continue;
+    }
+    trace?.candidates.push({ key, label, matched: [rel], outcome: "shown", why });
     lines.push(`${m.name} [${m.kind}]: ${gist(m, 140)}`);
     keys.push(key);
   }
-  if (!lines.length) return { text: "", keys: [] };
+  if (!lines.length) return { text: "", keys: [], trace };
   return {
     text: `eminiar memory: ${rel} is covered by ${lines.join(" \xB7 ")} \u2014 respect it (em_memory {action:"read", name} for the full text) or update the memory if this change overrides it.`,
-    keys
+    keys,
+    trace
   };
 }
 var RISKY = 0.3;
@@ -27125,22 +27280,32 @@ function riskLine(path2, f) {
   return `${path2} is bug-prone (${parts.join("; ")})`;
 }
 function fileContext(db, rel, opts = {}) {
-  const key = `file:${rel}`;
-  if (opts.sessionId && shownKeys(db, opts.sessionId).has(key)) return { text: "", keys: [] };
+  const seen = opts.sessionId ? shownKeys(db, opts.sessionId, opts.repeatAfter) : /* @__PURE__ */ new Set();
   const lines = [];
-  const f = readFileRisk(db)[rel];
-  const risk = f ? riskLine(rel, f) : void 0;
-  if (risk)
-    lines.push(
-      `eminiar history: ${risk}. em_history {action:"file", path:"${rel}"} shows those fixes; keep the behaviour they restored covered by a test.`
-    );
-  const fanIn = db.metricsGet([fileId(rel)])[0]?.fan_in ?? 0;
-  if (fanIn >= FAN_IN)
-    lines.push(
-      `eminiar graph: ${rel} is imported by ${fanIn} files; em_graph_impact {node:"${fileId(rel)}"} lists them before you change an exported signature.`
-    );
+  const keys = [];
+  const histKey = `hist:${rel}`;
+  if (!seen.has(histKey)) {
+    const f = readFileRisk(db)[rel];
+    const risk = f ? riskLine(rel, f) : void 0;
+    if (risk) {
+      lines.push(
+        `eminiar history: ${risk}. em_history {action:"file", path:"${rel}"} shows those fixes; keep the behaviour they restored covered by a test.`
+      );
+      keys.push(histKey);
+    }
+  }
+  const fanKey = `fanin:${rel}`;
+  if (opts.edit && !seen.has(fanKey)) {
+    const fanIn = db.metricsGet([fileId(rel)])[0]?.fan_in ?? 0;
+    if (fanIn >= FAN_IN) {
+      lines.push(
+        `eminiar graph: ${rel} is imported by ${fanIn} files; em_graph_impact {node:"${fileId(rel)}"} lists them before you change an exported signature.`
+      );
+      keys.push(fanKey);
+    }
+  }
   if (!lines.length) return { text: "", keys: [] };
-  return { text: lines.join("\n"), keys: [key] };
+  return { text: lines.join("\n"), keys };
 }
 function commitContext(db, files) {
   if (!files.length) return "";
@@ -27197,7 +27362,7 @@ async function recallForError(db, error62, opts = {}) {
   const terms = promptTerms(error62.slice(0, 600)).filter((t) => !ERROR_FILLER.has(t));
   if (terms.length < 3) return { text: "", keys: [] };
   const need = Math.max(3, Math.ceil(terms.length * 0.4));
-  const seen = opts.sessionId ? shownKeys(db, opts.sessionId) : /* @__PURE__ */ new Set();
+  const seen = opts.sessionId ? shownKeys(db, opts.sessionId, opts.repeatAfter) : /* @__PURE__ */ new Set();
   const past = [];
   const keys = [];
   const r = await search(db, terms.join(" "), {
@@ -27223,8 +27388,10 @@ async function recallForError(db, error62, opts = {}) {
     maxMemories: opts.maxMemories ?? 2,
     maxDocs: 0,
     sessionId: opts.sessionId,
+    repeatAfter: opts.repeatAfter,
     // error text is wordy (paths, module names): the same proportional bar as past errors
-    minMatches: need
+    minMatches: need,
+    path: "error"
   });
   const memLines = mem.text.split("\n").filter((l) => l.startsWith("- memory "));
   if (!past.length && !memLines.length) return { text: "", keys: [] };
@@ -28720,10 +28887,13 @@ var userPromptSubmit = async (input2) => {
     const r = await recallForText(db, input2.prompt, {
       maxMemories: recall.maxMemories,
       maxDocs: recall.maxDocs,
-      sessionId
+      sessionId,
+      repeatAfter: recall.repeatAfter,
+      trace: true,
+      path: "prompt"
     });
+    recordShown(db, sessionId, r.keys, { path: "prompt", trace: r.trace });
     if (!r.text) return void 0;
-    recordShown(db, sessionId, r.keys);
     return {
       hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext: r.text }
     };
@@ -28773,11 +28943,12 @@ var postToolUseFailure = async (input2) => {
     try {
       const r = await recallForError(db, input2.error, {
         sessionId,
-        maxMemories: Math.min(2, recall.maxMemories)
+        maxMemories: Math.min(2, recall.maxMemories),
+        repeatAfter: recall.repeatAfter
       });
       if (r.text) {
         recalled = r.text;
-        recordShown(db, sessionId, r.keys);
+        recordShown(db, sessionId, r.keys, { path: "error" });
       }
     } catch {
     }
@@ -28947,8 +29118,8 @@ var preCompact = (input2) => {
 
 // src/hooks/routing.ts
 init_esm_shims();
-import { realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { extname as extname2, join as join10, relative as relative4, resolve as resolve3 } from "path";
+import { realpathSync as realpathSync4, statSync as statSync4 } from "fs";
+import { extname as extname2, join as join11, relative as relative4, resolve as resolve3 } from "path";
 
 // src/docs/manifest.ts
 init_esm_shims();
@@ -28998,10 +29169,107 @@ function readManifest(ctx) {
   return readManifestAt(manifestPath(ctx));
 }
 
+// src/permissions/settings.ts
+init_esm_shims();
+import { existsSync as existsSync4, readFileSync as readFileSync4, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+
+// src/permissions/rules.ts
+init_esm_shims();
+function parseRule(raw) {
+  const m = /^([A-Za-z][\w-]*)(?:\((.*)\))?$/s.exec(raw.trim());
+  if (!m) return void 0;
+  return { raw, tool: m[1], pattern: m[2] };
+}
+function escapeRe2(s) {
+  return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+var readRegexCache = /* @__PURE__ */ new Map();
+function readRegex(pattern) {
+  let re = readRegexCache.get(pattern);
+  if (!re) {
+    if (readRegexCache.size >= 1024) readRegexCache.clear();
+    re = new RegExp(
+      `^${pattern.split("**").map((seg) => seg.split("*").map(escapeRe2).join("[^/]*")).join(".*")}$`
+    );
+    readRegexCache.set(pattern, re);
+  }
+  return re;
+}
+function matchRead(rule, absPath) {
+  if (rule.tool !== "Read") return false;
+  if (rule.pattern === void 0) return true;
+  let p = rule.pattern;
+  if (p.startsWith("~")) p = (process.env.HOME ?? "") + p.slice(1);
+  return readRegex(p).test(absPath);
+}
+
+// src/permissions/split.ts
+init_esm_shims();
+
+// src/permissions/settings.ts
+function readRules(file3) {
+  if (!existsSync4(file3)) return {};
+  try {
+    const s = JSON.parse(readFileSync4(file3, "utf8"));
+    return s.permissions ?? {};
+  } catch {
+    return {};
+  }
+}
+function stamp(file3) {
+  try {
+    return statSync2(file3).mtimeMs;
+  } catch {
+    return -1;
+  }
+}
+var cache2 = /* @__PURE__ */ new Map();
+function loadPermissionRules(root, extraDeny = []) {
+  const files = [
+    join5(homedir2(), ".claude", "settings.json"),
+    join5(root, ".claude", "settings.json"),
+    join5(root, ".claude", "settings.local.json")
+  ];
+  const key = `${root}\0${extraDeny.join("\0")}`;
+  const stamps = files.map(stamp);
+  const hit = cache2.get(key);
+  if (hit?.stamps.every((s, i) => s === stamps[i])) return hit.rules;
+  const out = { allow: [], deny: [], ask: [] };
+  const push = (list, raws) => {
+    for (const raw of raws ?? []) {
+      const r = parseRule(raw);
+      if (r) list.push(r);
+    }
+  };
+  for (const f of files) {
+    const p = readRules(f);
+    push(out.allow, p.allow);
+    push(out.deny, p.deny);
+    push(out.ask, p.ask);
+  }
+  push(out.deny, extraDeny);
+  if (cache2.size >= 16) cache2.clear();
+  cache2.set(key, { stamps, rules: out });
+  return out;
+}
+function checkRead(rules, absPaths) {
+  for (const kind of ["deny", "ask"]) {
+    for (const r of rules[kind]) {
+      if (absPaths.some((p) => matchRead(r, p))) return { allowed: false, rule: r.raw, kind };
+    }
+  }
+  return { allowed: true };
+}
+function checkReadPath(rules, abs) {
+  return checkRead(rules, [.../* @__PURE__ */ new Set([abs, realpathSync3(abs), realpathSync3.native(abs)])]);
+}
+
 // src/session/brief.ts
 init_esm_shims();
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 
 // src/memory/frontmatter.ts
 init_esm_shims();
@@ -29035,15 +29303,15 @@ function parseMemoryFile(text) {
 init_esm_shims();
 var import_fast_glob2 = __toESM(require_out4(), 1);
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync,
-  statSync as statSync2,
+  statSync as statSync3,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3, join as join5, relative as relative3, sep } from "path";
+import { dirname as dirname3, join as join6, relative as relative3, sep } from "path";
 
 // src/storage/types.ts
 init_esm_shims();
@@ -29055,7 +29323,7 @@ function memoriesRel(ctx) {
   return ctx.config.memories.dir.replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function memoriesDir(ctx) {
-  return join5(ctx.root, memoriesRel(ctx));
+  return join6(ctx.root, memoriesRel(ctx));
 }
 
 // src/session/brief.ts
@@ -29098,10 +29366,10 @@ function historyLine(db) {
   return `${parts.join("; ")}. em_history {action:"file", path} before editing, {action:"risk"} before committing.`;
 }
 function overviewParagraph(ctx) {
-  const file3 = join6(memoriesDir(ctx), "onboarding", "overview.md");
-  if (!existsSync5(file3)) return void 0;
+  const file3 = join7(memoriesDir(ctx), "onboarding", "overview.md");
+  if (!existsSync6(file3)) return void 0;
   try {
-    const body = parseMemoryFile(readFileSync5(file3, "utf8")).body.trim();
+    const body = parseMemoryFile(readFileSync6(file3, "utf8")).body.trim();
     const para = body.split(/\n\s*\n/).map(
       (p) => p.replace(/^#+\s.*$/m, "").replace(/\s+/g, " ").trim()
     ).find((p) => p.length > 20);
@@ -29150,10 +29418,10 @@ function fitBudget(lines, budget) {
 
 // src/session/server-alive.ts
 init_esm_shims();
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 function markersDir(ctx) {
-  return join7(projectDir(ctx.id), "servers");
+  return join8(projectDir(ctx.id), "servers");
 }
 function processAlive(pid) {
   try {
@@ -29165,13 +29433,13 @@ function processAlive(pid) {
 }
 function liveServers(ctx) {
   const dir = markersDir(ctx);
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const live2 = [];
   for (const name of readdirSync(dir)) {
     const pid = Number(name);
     if (!Number.isInteger(pid) || pid <= 0) continue;
     if (processAlive(pid)) live2.push(pid);
-    else rmSync(join7(dir, name), { force: true });
+    else rmSync(join8(dir, name), { force: true });
   }
   return live2;
 }
@@ -29181,30 +29449,30 @@ function serverAlive(ctx) {
 
 // src/hooks/coexist.ts
 init_esm_shims();
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join10 } from "path";
 
 // src/install/claude-config.ts
 init_esm_shims();
 import {
   copyFileSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join8 } from "path";
-var claudeDir = () => process.env.CLAUDE_CONFIG_DIR || join8(homedir2(), ".claude");
-var pluginsDir = () => join8(claudeDir(), "plugins");
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join9 } from "path";
+var claudeDir = () => process.env.CLAUDE_CONFIG_DIR || join9(homedir3(), ".claude");
+var pluginsDir = () => join9(claudeDir(), "plugins");
 
 // src/hooks/coexist.ts
 var cached2;
 function contextModeInstalled() {
   if (cached2 !== void 0) return cached2;
   try {
-    const reg = JSON.parse(readFileSync7(join9(pluginsDir(), "installed_plugins.json"), "utf8"));
+    const reg = JSON.parse(readFileSync8(join10(pluginsDir(), "installed_plugins.json"), "utf8"));
     cached2 = Object.keys(reg.plugins ?? {}).some((id) => id.startsWith("context-mode@"));
   } catch {
     cached2 = false;
@@ -29229,7 +29497,7 @@ function hookLog(level, msg) {
 }
 
 // src/hooks/routing.ts
-var SYMBOL_KINDS = [
+var SYMBOL_KINDS2 = [
   "function",
   "class",
   "method",
@@ -29247,7 +29515,7 @@ function literalOf(pattern) {
 function symbolHints(db, pattern) {
   const lit = literalOf(pattern);
   if (!lit) return void 0;
-  const nodes = db.graphFindNodes({ query: lit, kinds: SYMBOL_KINDS, limit: 5 });
+  const nodes = db.graphFindNodes({ query: lit, kinds: SYMBOL_KINDS2, limit: 5 });
   if (!nodes.length) return void 0;
   const list = nodes.map((n) => `${n.kind} ${n.name} (${n.path}:${n.start_line ?? "?"})`).join("; ");
   return `eminiar graph: symbols matching "${lit}": ${list}. em_symbols {name_path, include_body: true} reads one; {mode:"references"} lists its callers.`;
@@ -29257,9 +29525,50 @@ function coverageHint(db, rel) {
   if (!row || row.status === "indexed") return void 0;
   return `eminiar graph: ${rel} is ${row.status}${row.reason ? ` (${row.reason})` : ""}; graph answers about it may be incomplete.`;
 }
+var GIT_HISTORY = /(?:^|[;&|]\s*)git\s+(?:(?:-C|--git-dir|--work-tree)[= ]\S+\s+|--no-pager\s+)*(log|blame|shortlog|show|whatchanged|reflog)\b([^;&|]*)/;
+var ONE_COMMIT = /(^|\s)(-1|-n\s*1|-n1|--max-count[= ]1)(?=\s|$)/;
+function historyCall(cmd) {
+  const m = GIT_HISTORY.exec(cmd);
+  if (!m) return void 0;
+  const sub = m[1];
+  const rest = (m[2] ?? "").trim();
+  const args = rest.split(/\s+/).filter(Boolean);
+  const q = (s) => JSON.stringify(s.replace(/^['"]|['"]$/g, ""));
+  const positional = (a) => !a.startsWith("-");
+  if (sub === "show") {
+    if (/\S+:\S+/.test(rest)) return void 0;
+    const sha = args.find(positional);
+    return `{action:"commit", sha:${q(sha ?? "HEAD")}}`;
+  }
+  if (sub === "blame") {
+    const path3 = args.filter(positional).pop();
+    return path3 ? `{action:"file", path:${q(path3)}}` : void 0;
+  }
+  if (sub === "log" && ONE_COMMIT.test(rest) && !/(^|\s)(-p|--patch|--stat)\b/.test(rest))
+    return void 0;
+  const lineRange = /-L\s*:?([^:\s]+):(\S+)/.exec(rest);
+  if (lineRange) {
+    const [, fn, file3] = lineRange;
+    return /^[A-Za-z_$]/.test(fn) ? `{action:"symbol", name_path:${q(`${file3}#${fn}`)}}` : `{action:"file", path:${q(file3)}}`;
+  }
+  const grep = /--grep[= ]("[^"]*"|'[^']*'|\S+)/.exec(rest);
+  if (grep) return `{action:"search", query:${q(grep[1])}}`;
+  const author = /--author[= ]("[^"]*"|'[^']*'|\S+)/.exec(rest);
+  const range = args.find((a) => positional(a) && /\.\.\.?/.test(a));
+  if (range) {
+    const [a, b] = range.split(/\.\.\.?/);
+    return `{action:"branch", name:${q(b || a || "HEAD")}}`;
+  }
+  const dash = args.indexOf("--");
+  const path2 = dash !== -1 ? args[dash + 1] : args.find((a) => positional(a) && /[/.]/.test(a) && !/^[0-9a-f]{7,40}$/i.test(a));
+  if (path2) return `{action:"file", path:${q(path2)}}`;
+  if (author) return `{action:"timeline", author:${q(author[1])}}`;
+  if (sub === "shortlog") return `{action:"timeline"}`;
+  return `{action:"overview"}`;
+}
 function docsSources(root) {
   try {
-    return readManifestAt(join10(root, ".eminiar", "docs.json")).sources;
+    return readManifestAt(join11(root, ".eminiar", "docs.json")).sources;
   } catch {
     return [];
   }
@@ -29300,12 +29609,21 @@ var BIG_TEXT_EXT = /* @__PURE__ */ new Set([
 function withoutHeredocs(cmd) {
   return cmd.replace(/<<-?\s*(['"]?)(\w+)\1[^\n]*\n[\s\S]*?\n\s*\2\s*(?=\n|$)/g, "<<$2");
 }
-function suggest(toolName, input2, root) {
+function suggest(toolName, input2, root, extra = {}) {
   switch (toolName) {
     case "Bash": {
       const cmd = withoutHeredocs(String(input2.command ?? ""));
       if (!cmd || TINY_BASH.test(cmd)) return void 0;
       if (/^\s*cat\b[^|\n]*>/.test(cmd) && !cmd.includes("|")) return void 0;
+      const history = historyCall(cmd);
+      if (history) {
+        return {
+          tool: "em_history",
+          reason: `the git history is already classified (commit kinds, fixes traced to the change that caused them, risk per file); em_history ${history} answers this without the raw log`
+        };
+      }
+      if (/^\s*git\s+log\b/.test(cmd) && ONE_COMMIT.test(cmd) && !cmd.includes("|"))
+        return void 0;
       if (HEAVY_BASH.test(cmd) || /\|\s*(head|tail|grep|wc|sort|uniq|jq|less)\b/.test(cmd)) {
         return {
           tool: "em_execute",
@@ -29318,9 +29636,11 @@ function suggest(toolName, input2, root) {
       const fp = String(input2.file_path ?? "");
       if (!fp) return void 0;
       try {
-        const st = statSync3(resolve3(root, fp));
+        const abs = resolve3(root, fp);
+        const st = statSync4(abs);
         const ext = extname2(fp).toLowerCase();
         if (st.size > 200 * 1024 || BIG_TEXT_EXT.has(ext) && st.size > 20 * 1024) {
+          if (!checkReadPath(loadPermissionRules(root), abs).allowed) return void 0;
           return {
             tool: "em_execute_file",
             reason: `${fp} is ${Math.round(st.size / 1024)} KB; em_execute_file {path, code} processes it in the sandbox so only what you print enters context`
@@ -29331,10 +29651,18 @@ function suggest(toolName, input2, root) {
       return void 0;
     }
     case "Grep": {
-      if (input2.output_mode === "content" && !input2.head_limit) {
+      const content = input2.output_mode === "content" && !input2.head_limit;
+      if (extra.symbol) {
+        return {
+          tool: "em_symbols",
+          annotateOnly: !content,
+          reason: `the graph indexes "${extra.symbol}": em_symbols {name_path:"${extra.symbol}", mode:"references"} lists its uses, {include_body:true} its definition; em_search {queries:["${extra.symbol}"], source:"code"} finds the code by symbol`
+        };
+      }
+      if (content) {
         return {
           tool: "em_execute",
-          reason: `content-mode grep can be large; em_execute with rg and an intent returns only matching sections`
+          reason: `content-mode grep can be large; em_execute with rg and an intent returns only matching sections (em_search {queries, mode:"regex"} scans the indexed files with context)`
         };
       }
       return void 0;
@@ -29362,7 +29690,7 @@ function suggest(toolName, input2, root) {
       return {
         tool: "em_*",
         reason: "subagents should prefer em_execute / em_batch_execute / em_search over Bash, Read and Grep",
-        prefixPrompt: 'Use the eminiar tools (em_execute, em_batch_execute, em_execute_file, em_fetch_and_index, em_search) instead of Bash/Read/Grep/WebFetch whenever output may be large; return only derived answers. Check em_recall {query} for project decisions and constraints before proposing changes, and em_docs {action:"lookup", query} before WebFetch/WebSearch for anything the project depends on.\n\n'
+        prefixPrompt: 'Use the eminiar tools (em_execute, em_batch_execute, em_execute_file, em_fetch_and_index, em_search, em_symbols, em_history) instead of Bash/Read/Grep/WebFetch whenever output may be large; return only derived answers. Check em_recall {query} for project decisions and constraints before proposing changes, em_history {action:"file", path} before editing a file, em_symbols / em_search {source:"code"} before grepping for an identifier, and em_docs {action:"lookup", query} before WebFetch/WebSearch for anything the project depends on.\n\n'
       };
     default:
       return void 0;
@@ -29372,7 +29700,7 @@ function projectRel(ctx, fp) {
   if (!fp) return void 0;
   let abs = resolve3(ctx.root, fp);
   try {
-    abs = realpathSync3(abs);
+    abs = realpathSync4(abs);
   } catch {
   }
   const rel = relative4(ctx.root, abs).split("\\").join("/");
@@ -29403,15 +29731,20 @@ function fileKnowledge(ctx, input2) {
     if (!rel) return void 0;
     const db = getStorage(ctx, { vectors: false });
     const sessionId = input2.session_id || void 0;
-    const results = [memoriesForFile(db, rel, { sessionId })];
-    if (EDIT_TOOLS2.has(input2.tool_name ?? "")) results.push(fileContext(db, rel, { sessionId }));
+    const repeatAfter = ctx.config.recall.repeatAfter;
+    const edit = EDIT_TOOLS2.has(input2.tool_name ?? "");
+    const results = [
+      memoriesForFile(db, rel, { sessionId, symbols: fileSymbols(db, rel), repeatAfter }),
+      fileContext(db, rel, { sessionId, edit, repeatAfter })
+    ];
     const shown = results.filter((r) => r.text);
     if (!shown.length) return void 0;
     if (sessionId)
       recordShown(
         db,
         sessionId,
-        shown.flatMap((r) => r.keys)
+        shown.flatMap((r) => r.keys),
+        { path: "file" }
       );
     return shown.map((r) => r.text).join("\n");
   } catch {
@@ -29451,7 +29784,7 @@ async function webKnowledge(ctx, input2) {
   if (!text.trim()) return void 0;
   try {
     const db = getStorage(ctx, { vectors: false });
-    const r = await recallForText(db, text, { maxMemories: 0, maxDocs: 3 });
+    const r = await recallForText(db, text, { maxMemories: 0, maxDocs: 3, path: "web" });
     if (!r.text) return void 0;
     const pages = r.text.split("\n").filter((l) => l.startsWith("- docs:"));
     return [
@@ -29494,8 +29827,10 @@ var preToolUse = async (input2) => {
   const coexisting = contextModeInstalled() && ctx.config.routing.deferToContextMode;
   if (coexisting && ["Bash", "Read", "Grep", "WebFetch"].includes(input2.tool_name))
     return withContext(void 0, memo2);
-  const hint = joinHints(graphContext(ctx, input2), memo2);
-  const s = suggest(input2.tool_name, input2.tool_input, ctx.root);
+  const graph = graphContext(ctx, input2);
+  const hint = joinHints(graph, memo2);
+  const symbol2 = input2.tool_name === "Grep" && graph ? literalOf(String(input2.tool_input.pattern ?? "")) : void 0;
+  const s = suggest(input2.tool_name, input2.tool_input, ctx.root, { symbol: symbol2 });
   if (!s) return withContext(void 0, hint);
   if (s.annotateOnly) return withContext(annotate(s), hint);
   if (mode === "enforce") {
@@ -29552,7 +29887,8 @@ Verify structure with em_symbols / em_graph_impact before reading files; check e
     if (recall.onAgent && task) {
       const r = await recallForText(db, task, {
         maxMemories: recall.maxMemories,
-        maxDocs: recall.maxDocs
+        maxDocs: recall.maxDocs,
+        path: "agent"
       });
       if (r.text) parts.push(r.text);
     }
@@ -29573,15 +29909,15 @@ function annotate(s, note = "") {
 
 // src/hooks/session-start.ts
 init_esm_shims();
-import { appendFileSync as appendFileSync2, existsSync as existsSync8, readdirSync as readdirSync3 } from "fs";
-import { join as join12 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, readdirSync as readdirSync3 } from "fs";
+import { join as join13 } from "path";
 
 // src/session/current.ts
 init_esm_shims();
-import { readFileSync as readFileSync8, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync9, statSync as statSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 function file2(ctx) {
-  return join11(projectDir(ctx.id), "current-session");
+  return join12(projectDir(ctx.id), "current-session");
 }
 function setCurrentSession(ctx, sessionId) {
   writeFileSync5(file2(ctx), sessionId);
@@ -29609,7 +29945,8 @@ function routingGuidance(mode) {
     '- em_search {queries, sort:"timeline"}: everything indexed plus session memory.',
     "- em_remember {content, kind, name?, status?}: memories are markdown under .eminiar/memories (survive compaction, shareable via git); em_memory {action: list|read|edit|rename|delete|status} manages them.",
     '- em_architecture {aspects?}: the project map (folders, entry points, routes, hotspots, decisions) in one call; em_symbols {name_path | mode:"overview", file} for a symbol or a file outline; em_graph_impact {node} before a refactor; em_graph_changes for what the current diff reaches; em_graph_query {pattern | preset} to walk the graph; em_index_status for coverage. em_stats shows savings.',
-    "- em_history {action: overview | file {path} | risk | commit {sha} | branch {name} | symbol {name_path} | search {query}}: the git history classified (feat/fix/refactor\u2026), branches vs base, and each fix traced back to the commit that caused it \u2014 ask it before editing a file or committing instead of running git log/blame; commit messages are searchable via em_search (source git).",
+    "- em_history {action: overview | file {path} | risk | commit {sha} | branch {name} | symbol {name_path} | search {query}}: the git history classified (feat/fix/refactor\u2026), branches vs base, and each fix traced back to the commit that caused it \u2014 ask it before editing a file or committing instead of running git log/blame/show (those are routed to it); commit messages are searchable via em_search (source git).",
+    '- A Grep for an identifier the graph knows is routed to em_symbols {name_path, mode:"references"} / em_search {queries, source:"code"}: symbol-level answers instead of raw matches.',
     "Plain Bash/Read/Grep remain right for short fixed output and files you are about to edit."
   ].join("\n");
 }
@@ -29664,8 +30001,8 @@ ${guide}`);
   } catch {
   }
   try {
-    const onboarding = join12(memoriesDir(ctx), "onboarding");
-    const onboarded = existsSync8(onboarding) && readdirSync3(onboarding).some((f) => f.endsWith(".md"));
+    const onboarding = join13(memoriesDir(ctx), "onboarding");
+    const onboarded = existsSync9(onboarding) && readdirSync3(onboarding).some((f) => f.endsWith(".md"));
     if (!onboarded)
       parts.push(
         "No onboarding memories yet: run /eminiar:em-onboard once so future sessions start with the project's structure, build and test commands."
@@ -29676,11 +30013,22 @@ ${guide}`);
       );
   } catch {
   }
+  try {
+    if (existsSync9(join13(ctx.root, ".git")) && !db.metaGet("history_files"))
+      parts.push(
+        'Git history is not classified yet: em_history {action:"overview"} builds it (the server also does this in the background shortly after start); bug-prone files are flagged before you read or edit them once it exists.'
+      );
+  } catch {
+  }
   const docs = db.countDocuments();
   const latest = db.sessionLatest();
   parts.push(
     `eminiar index: ${docs} documents${latest && latest.id !== sessionId && latest.started_at ? `; previous session ${new Date(latest.started_at).toISOString().slice(0, 16)}` : ""}. Use em_search {sort:"timeline"} or em_recall to pick up where you left off.`
   );
+  hookLog(
+    "info",
+    `session_start source=${input2.source ?? "?"} session=${sessionId.slice(0, 8)} root=${ctx.root} db=${ctx.dbPath} documents=${docs} memories=${db.memoryCount()} history=${db.metaGet("history_files") ? "yes" : "no"}`
+  );
   return {
     hookSpecificOutput: {
       hookEventName: "SessionStart",