gnosys 5.9.5 → 5.11.0

package/dist/lib/chat/types.js

@@ -3,4 +3,3 @@
  * React/ink components can import without pulling fs/path dependencies.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/lib/chat/write.d.ts

@@ -11,10 +11,10 @@
  *   tags.from-chat: ["true"]
  *   tags.source: ["remember" | "save-turn" | "auto" | "attach"]
  */
-import { GnosysDB } from "../db.js";
-import { GnosysConfig } from "../config.js";
-import { Turn } from "./types.js";
-export type PromoteSource = "remember" | "save-turn" | "auto" | "attach";
+import type { GnosysDB } from "../db.js";
+import type { GnosysConfig } from "../config.js";
+import type { Turn } from "./types.js";
+type PromoteSource = "remember" | "save-turn" | "auto" | "attach";
 export interface PromoteOptions {
     /** Free-form text to save. */
     content: string;
@@ -63,4 +63,4 @@ export interface AutoPromoteHint {
  * Returns null when nothing matches.
  */
 export declare function detectAutoPromote(userText: string): AutoPromoteHint | null;
-//# sourceMappingURL=write.d.ts.map
+export {};

package/dist/lib/chat/write.js

@@ -200,4 +200,3 @@ function fnv1a(text) {
     }
     return (hash >>> 0).toString(16).padStart(8, "0");
 }
-//# sourceMappingURL=write.js.map

package/dist/lib/chunkSplitter.d.ts

@@ -43,4 +43,3 @@ export declare function splitSegments(segments: Array<{
     page?: string;
     timerange?: string;
 }>, options?: ChunkOptions): TextChunk[];
-//# sourceMappingURL=chunkSplitter.d.ts.map

package/dist/lib/chunkSplitter.js

@@ -230,4 +230,3 @@ export function splitSegments(segments, options) {
     }
     return allChunks;
 }
-//# sourceMappingURL=chunkSplitter.js.map

package/dist/lib/cleanup.d.ts

@@ -49,4 +49,3 @@ export interface CleanupResult {
  * writes when `yes === true`, otherwise just returns the diff (dry run).
  */
 export declare function cleanupRegistry(opts: CleanupOptions): Promise<CleanupResult>;
-//# sourceMappingURL=cleanup.d.ts.map

package/dist/lib/cleanup.js

@@ -165,4 +165,3 @@ export async function cleanupRegistry(opts) {
     }
     return { removed: toRemove, kept: categorized.alive.length, wrote: true };
 }
-//# sourceMappingURL=cleanup.js.map

package/dist/lib/config.d.ts

@@ -382,4 +382,3 @@ export declare function generateConfigTemplate(): string;
  */
 export declare const ALL_PROVIDERS: LLMProviderName[];
 export {};
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.js

@@ -7,6 +7,7 @@ import fs from "fs/promises";
 import path from "path";
 import { execSync } from "child_process";
 import { getGnosysHome } from "./paths.js";
+import { atomicWriteFile } from "./atomicWrite.js";
 // ─── LLM Provider Schemas ───────────────────────────────────────────────
 const LLMProviderEnum = z.enum(["anthropic", "ollama", "groq", "openai", "lmstudio", "xai", "mistral", "custom"]);
 const AnthropicConfigSchema = z.object({
@@ -534,7 +535,7 @@ export async function loadConfig(storePath) {
 export async function writeConfig(storePath, config) {
     const configPath = path.join(storePath, "gnosys.json");
     const merged = GnosysConfigSchema.parse(config);
-    await fs.writeFile(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+    await atomicWriteFile(configPath, JSON.stringify(merged, null, 2) + "\n");
 }
 /**
  * Update specific fields in gnosys.json without overwriting the whole file.
@@ -554,7 +555,7 @@ export async function updateConfig(storePath, updates) {
     // Validate for shape/type errors. The validated object has defaults
     // applied; we deliberately throw it away and persist `merged` instead.
     const validated = GnosysConfigSchema.parse(merged);
-    await fs.writeFile(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+    await atomicWriteFile(configPath, JSON.stringify(merged, null, 2) + "\n");
     return validated;
 }
 /**
@@ -617,4 +618,3 @@ export function generateConfigTemplate() {
  * All supported provider names.
  */
 export const ALL_PROVIDERS = ["anthropic", "ollama", "groq", "openai", "lmstudio", "xai", "mistral", "custom"];
-//# sourceMappingURL=config.js.map

package/dist/lib/dashboard.d.ts

@@ -2,9 +2,9 @@
  * Gnosys Dashboard — Aggregated system status in a pretty terminal display.
  * Combines memory stats, maintenance health, graph stats, and LLM routing.
  */
-import { GnosysResolver } from "./resolver.js";
-import { GnosysConfig, LLMProviderName } from "./config.js";
-import { GnosysDB } from "./db.js";
+import type { GnosysResolver } from "./resolver.js";
+import { type GnosysConfig, type LLMProviderName } from "./config.js";
+import type { GnosysDB } from "./db.js";
 export interface DashboardData {
     stores: Array<{
         label: string;
@@ -92,4 +92,3 @@ export declare function formatDashboard(data: DashboardData): string;
  * Format dashboard data as structured JSON for MCP tool consumption.
  */
 export declare function formatDashboardJSON(data: DashboardData): string;
-//# sourceMappingURL=dashboard.d.ts.map

package/dist/lib/dashboard.js

@@ -5,6 +5,8 @@
 import { resolveTaskModel, ALL_PROVIDERS, } from "./config.js";
 import { isProviderAvailable } from "./llm.js";
 import { GnosysEmbeddings } from "./embeddings.js";
+import { readMachineConfig } from "./machineConfig.js";
+import { effectiveProjectPath } from "./projectPaths.js";
 import fs from "fs/promises";
 import path from "path";
 /**
@@ -53,9 +55,11 @@ export async function collectDashboardData(resolver, config, version, gnosysDb)
     let totalMemories = 0;
     if (gnosysDb?.isAvailable() && gnosysDb?.isMigrated()) {
         const projects = gnosysDb.getAllProjects();
+        const machine = readMachineConfig();
         for (const p of projects) {
             const count = gnosysDb.getMemoriesByProject(p.id).length;
-            storeData.push({ label: p.name, path: p.working_directory, memoryCount: count });
+            const path = effectiveProjectPath(gnosysDb, p, machine) ?? "(not on this machine)";
+            storeData.push({ label: p.name, path, memoryCount: count });
             totalMemories += count;
         }
         // Also count user/global-scoped memories that have no project_id
@@ -417,4 +421,3 @@ export function formatDashboard(data) {
 export function formatDashboardJSON(data) {
     return JSON.stringify(data, null, 2);
 }
-//# sourceMappingURL=dashboard.js.map

package/dist/lib/db.d.ts

@@ -40,12 +40,26 @@ export interface DbProject {
     id: string;
     name: string;
     working_directory: string;
+    root_id?: string | null;
+    rel_path?: string | null;
     user: string;
     agent_rules_target: string | null;
     obsidian_vault: string | null;
     created: string;
     modified: string;
 }
+/**
+ * v5.11: Per-machine project location override. One row per (project, machine)
+ * for projects that live OUTSIDE any named root (so root_id/rel_path can't
+ * resolve them). The composite primary key means each machine owns its own
+ * row — machines never clobber each other's path.
+ */
+export interface DbProjectLocation {
+    project_id: string;
+    machine_id: string;
+    abs_path: string;
+    modified: string;
+}
 export type MemoryScope = "project" | "user" | "global";
 export interface DbRelationship {
     source_id: string;
@@ -223,6 +237,13 @@ export declare class GnosysDB {
      */
     getMemoriesByScope(scope: MemoryScope): DbMemory[];
     insertProject(project: DbProject): void;
+    /** This machine's stored absolute path for a project, or null if none. */
+    getProjectLocation(projectId: string, machineId: string): DbProjectLocation | null;
+    /** All machines' stored locations for a project. */
+    getProjectLocations(projectId: string): DbProjectLocation[];
+    /** Record/replace this machine's path for a project (composite PK). */
+    setProjectLocation(loc: DbProjectLocation): void;
+    deleteProjectLocation(projectId: string, machineId: string): void;
     getProject(id: string): DbProject | null;
     getProjectByDirectory(dir: string): DbProject | null;
     getAllProjects(): DbProject[];
@@ -291,6 +312,9 @@ export declare class GnosysDB {
     transaction<T>(fn: () => T): T;
     getMeta(key: string): string | null;
     setMeta(key: string, value: string): void;
+    /** Remove a meta key. Used by v5.11 migrate to move machine-local values
+     * (machine_id, remote_path) out of the synced DB into machine.json. */
+    deleteMeta(key: string): void;
     /**
      * Get the machine ID designated to run dream cycles. Stored in gnosys_meta
      * under `dream_machine_id`. Returns null if no machine is designated (dream
@@ -355,4 +379,3 @@ export declare class GnosysDB {
     getSchemaVersion(): number;
 }
 export { fnv1a };
-//# sourceMappingURL=db.d.ts.map

package/dist/lib/db.js

@@ -20,9 +20,11 @@ import path from "path";
 import fs from "fs";
 import { enableWAL } from "./lock.js";
 import { getGnosysHome as getGnosysHomeImpl, getCentralDbPath as getCentralDbPathImpl } from "./paths.js";
+import { readMachineConfig } from "./machineConfig.js";
+import { logError } from "./log.js";
 import { ulid } from "ulidx";
 // ─── Schema ─────────────────────────────────────────────────────────────
-const SCHEMA_VERSION = 3;
+const SCHEMA_VERSION = 4;
 const SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS memories (
   id                  TEXT PRIMARY KEY,
@@ -61,6 +63,8 @@ CREATE INDEX IF NOT EXISTS idx_memories_last_reinforced ON memories(last_reinfor
 CREATE INDEX IF NOT EXISTS idx_memories_content_hash ON memories(content_hash);
 CREATE INDEX IF NOT EXISTS idx_memories_project_id ON memories(project_id);
 CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope);
+CREATE INDEX IF NOT EXISTS idx_memories_modified ON memories(modified);
+CREATE INDEX IF NOT EXISTS idx_memories_created ON memories(created);
 
 CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
   id,
@@ -112,10 +116,15 @@ CREATE INDEX IF NOT EXISTS idx_audit_timestamp ON audit_log(timestamp);
 CREATE INDEX IF NOT EXISTS idx_audit_operation ON audit_log(operation);
 CREATE INDEX IF NOT EXISTS idx_audit_trace ON audit_log(trace_id);
 
+-- v5.11: working_directory is a machine-local display cache (not UNIQUE, not
+-- identity). Portable identity is id (UUID); portable location is root_id +
+-- rel_path resolved against this machine's roots (see machineConfig.ts).
 CREATE TABLE IF NOT EXISTS projects (
   id                  TEXT PRIMARY KEY,
   name                TEXT NOT NULL,
-  working_directory   TEXT NOT NULL UNIQUE,
+  working_directory   TEXT NOT NULL DEFAULT '',
+  root_id             TEXT,
+  rel_path            TEXT,
   user                TEXT NOT NULL,
   agent_rules_target  TEXT,
   obsidian_vault      TEXT,
@@ -123,6 +132,15 @@ CREATE TABLE IF NOT EXISTS projects (
   modified            TEXT NOT NULL
 );
 
+-- v5.11: per-machine path override for projects outside any named root.
+CREATE TABLE IF NOT EXISTS project_locations (
+  project_id  TEXT NOT NULL,
+  machine_id  TEXT NOT NULL,
+  abs_path    TEXT NOT NULL,
+  modified    TEXT NOT NULL,
+  PRIMARY KEY (project_id, machine_id)
+);
+
 CREATE TABLE IF NOT EXISTS gnosys_meta (
   key                 TEXT PRIMARY KEY,
   value               TEXT NOT NULL,
@@ -183,8 +201,8 @@ const MEMORY_COLUMNS = new Set([
     "project_id", "scope",
 ]);
 const PROJECT_COLUMNS = new Set([
-    "name", "working_directory", "user", "agent_rules_target",
-    "obsidian_vault", "created", "modified",
+    "name", "working_directory", "root_id", "rel_path", "user",
+    "agent_rules_target", "obsidian_vault", "created", "modified",
 ]);
 // ─── FNV-1a hash (same as embeddings.ts) ────────────────────────────────
 function fnv1a(str) {
@@ -241,9 +259,16 @@ export class GnosysDB {
         }
         const localDb = GnosysDB.openLocal();
         // Check if remote is configured. If not, we're done — return local.
+        // v5.11: the remote connection is machine-local (machine.json), since the
+        // NAS mount path / Tailscale URL differs per machine. Prefer it; fall back
+        // to the legacy synced gnosys_meta value when machine.json has none.
         let remotePath = null;
         try {
-            if (localDb.isAvailable()) {
+            const mc = readMachineConfig();
+            if (mc?.remote?.enabled && mc.remote.path) {
+                remotePath = mc.remote.path;
+            }
+            else if (localDb.isAvailable()) {
                 remotePath = localDb.getMeta("remote_path");
             }
         }
@@ -269,7 +294,10 @@ export class GnosysDB {
             // Quiet fallback notice on stderr — visible to humans, doesn't pollute
             // stdout that scripts/agents are piping. Only emitted when remote is
             // CONFIGURED but unreachable (the user expected it to work).
-            process.stderr.write(`gnosys: remote unreachable (${remotePath}), using local cache\n`);
+            logError(new Error(`remote unreachable (${remotePath}), using local cache`), {
+                module: "db",
+                op: "open",
+            });
             return localDb;
         }
         // Remote is reachable — open it and return. Close local first since we
@@ -288,7 +316,13 @@ export class GnosysDB {
      */
     static openLocal() {
         const dir = GnosysDB.getGnosysHome();
-        fs.mkdirSync(dir, { recursive: true });
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        try {
+            fs.chmodSync(dir, 0o700);
+        }
+        catch {
+            // best-effort (Windows / network FS)
+        }
         return new GnosysDB(dir);
     }
     constructor(storePath, opts) {
@@ -300,9 +334,22 @@ export class GnosysDB {
         const retryDelay = opts?.retryDelayMs ?? 500;
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
             try {
-                fs.mkdirSync(storePath, { recursive: true });
+                fs.mkdirSync(storePath, { recursive: true, mode: 0o700 });
                 this.db = new Database(this.dbFilePath);
                 enableWAL(this.db);
+                try {
+                    fs.chmodSync(storePath, 0o700);
+                    fs.chmodSync(this.dbFilePath, 0o600);
+                    for (const ext of ["-wal", "-shm"]) {
+                        const sidecar = this.dbFilePath + ext;
+                        if (fs.existsSync(sidecar)) {
+                            fs.chmodSync(sidecar, 0o600);
+                        }
+                    }
+                }
+                catch {
+                    // best-effort (Windows / network FS)
+                }
                 this.db.pragma("foreign_keys = ON");
                 // Longer busy timeout for network shares (10s)
                 this.db.pragma("busy_timeout = 10000");
@@ -453,6 +500,13 @@ export class GnosysDB {
         return new GnosysDB(dir);
     }
     applySchema() {
+        const currentVersion = this.db.pragma("user_version", { simple: true });
+        // Legacy DBs (user_version >= 1) must migrate before the full current
+        // schema is applied — SCHEMA_SQL creates indexes on columns (project_id,
+        // scope, …) that do not exist on v1/v2 databases yet.
+        if (currentVersion > 0 && currentVersion < SCHEMA_VERSION) {
+            this.migrateSchema(currentVersion);
+        }
         // Apply main schema
         this.db.exec(SCHEMA_SQL);
         // Apply triggers (separate because of FTS5 delete syntax)
@@ -462,10 +516,11 @@ export class GnosysDB {
         catch {
             // Triggers may already exist — that's fine
         }
-        // Schema migration: v1 → v2 (add project_id, scope, projects table)
-        const currentVersion = this.db.pragma("user_version", { simple: true });
-        if (currentVersion < SCHEMA_VERSION) {
-            this.migrateSchema(currentVersion);
+        // Fresh DBs (user_version 0) get the full schema first, then migrate
+        // to stamp user_version and apply any incremental steps idempotently.
+        const versionAfterSchema = this.db.pragma("user_version", { simple: true });
+        if (versionAfterSchema < SCHEMA_VERSION) {
+            this.migrateSchema(versionAfterSchema);
         }
     }
     /**
@@ -535,6 +590,57 @@ export class GnosysDB {
                 // Column already exists — fine
             }
         }
+        if (fromVersion < 4) {
+            // v3 → v4 (v5.11): machine-portable project paths.
+            // Add root_id/rel_path and drop the UNIQUE constraint on
+            // working_directory (which forced a single path per project across all
+            // machines). SQLite can't drop a constraint in place, so rebuild the
+            // table — but only if the new shape isn't already present (a fresh DB
+            // gets it straight from SCHEMA_SQL above).
+            const cols = this.db.pragma("table_info(projects)");
+            const hasRelPath = cols.some((c) => c.name === "rel_path");
+            if (!hasRelPath) {
+                const rebuild = this.db.transaction(() => {
+                    this.db.exec(`
+            CREATE TABLE projects_new (
+              id                  TEXT PRIMARY KEY,
+              name                TEXT NOT NULL,
+              working_directory   TEXT NOT NULL DEFAULT '',
+              root_id             TEXT,
+              rel_path            TEXT,
+              user                TEXT NOT NULL,
+              agent_rules_target  TEXT,
+              obsidian_vault      TEXT,
+              created             TEXT NOT NULL,
+              modified            TEXT NOT NULL
+            )
+          `);
+                    this.db.exec(`
+            INSERT INTO projects_new
+              (id, name, working_directory, user, agent_rules_target, obsidian_vault, created, modified)
+            SELECT id, name, working_directory, user, agent_rules_target, obsidian_vault, created, modified
+            FROM projects
+          `);
+                    this.db.exec("DROP TABLE projects");
+                    this.db.exec("ALTER TABLE projects_new RENAME TO projects");
+                });
+                rebuild();
+            }
+            try {
+                this.db.exec(`
+          CREATE TABLE IF NOT EXISTS project_locations (
+            project_id  TEXT NOT NULL,
+            machine_id  TEXT NOT NULL,
+            abs_path    TEXT NOT NULL,
+            modified    TEXT NOT NULL,
+            PRIMARY KEY (project_id, machine_id)
+          )
+        `);
+            }
+            catch {
+                // Table may already exist
+            }
+        }
         this.db.pragma(`user_version = ${SCHEMA_VERSION}`);
     }
     isAvailable() {
@@ -725,9 +831,38 @@ export class GnosysDB {
         return this.withRecovery(() => {
             this.db.prepare(`
         INSERT OR REPLACE INTO projects
-          (id, name, working_directory, user, agent_rules_target, obsidian_vault, created, modified)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(project.id, project.name, project.working_directory, project.user, project.agent_rules_target || null, project.obsidian_vault || null, project.created, project.modified);
+          (id, name, working_directory, root_id, rel_path, user, agent_rules_target, obsidian_vault, created, modified)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(project.id, project.name, project.working_directory, project.root_id ?? null, project.rel_path ?? null, project.user, project.agent_rules_target || null, project.obsidian_vault || null, project.created, project.modified);
+        });
+    }
+    // ─── Per-machine project locations (v5.11) ─────────────────────────
+    /** This machine's stored absolute path for a project, or null if none. */
+    getProjectLocation(projectId, machineId) {
+        return this.withRecovery(() => this.db
+            .prepare("SELECT * FROM project_locations WHERE project_id = ? AND machine_id = ?")
+            .get(projectId, machineId) || null);
+    }
+    /** All machines' stored locations for a project. */
+    getProjectLocations(projectId) {
+        return this.withRecovery(() => this.db
+            .prepare("SELECT * FROM project_locations WHERE project_id = ?")
+            .all(projectId));
+    }
+    /** Record/replace this machine's path for a project (composite PK). */
+    setProjectLocation(loc) {
+        return this.withRecovery(() => {
+            this.db.prepare(`
+        INSERT OR REPLACE INTO project_locations (project_id, machine_id, abs_path, modified)
+        VALUES (?, ?, ?, ?)
+      `).run(loc.project_id, loc.machine_id, loc.abs_path, loc.modified);
+        });
+    }
+    deleteProjectLocation(projectId, machineId) {
+        return this.withRecovery(() => {
+            this.db
+                .prepare("DELETE FROM project_locations WHERE project_id = ? AND machine_id = ?")
+                .run(projectId, machineId);
         });
     }
     getProject(id) {
@@ -963,6 +1098,18 @@ export class GnosysDB {
             }
         }
     }
+    /** Remove a meta key. Used by v5.11 migrate to move machine-local values
+     * (machine_id, remote_path) out of the synced DB into machine.json. */
+    deleteMeta(key) {
+        if (!this.available)
+            return;
+        try {
+            this.db.prepare("DELETE FROM gnosys_meta WHERE key = ?").run(key);
+        }
+        catch {
+            // table may not exist — nothing to delete
+        }
+    }
     // ─── Dream state (v5.4.2) ───────────────────────────────────────────
     /**
      * Get the machine ID designated to run dream cycles. Stored in gnosys_meta
@@ -1105,4 +1252,3 @@ export class GnosysDB {
 }
 // ─── Migration Helper ─────────────────────────────────────────────────
 export { fnv1a };
-//# sourceMappingURL=db.js.map

package/dist/lib/dbSearch.d.ts

@@ -9,9 +9,9 @@
  * Implements the same result types so consumers (recall, hybridSearch, ask)
  * work without modification.
  */
-import { GnosysDB, DbMemory } from "./db.js";
-import { SearchResult, DiscoverResult } from "./search.js";
-import { HybridSearchResult, SearchMode } from "./hybridSearch.js";
+import type { GnosysDB, DbMemory } from "./db.js";
+import type { SearchResult, DiscoverResult } from "./search.js";
+import type { HybridSearchResult, SearchMode } from "./searchTypes.js";
 export declare class GnosysDbSearch {
     private db;
     constructor(db: GnosysDB);
@@ -62,4 +62,3 @@ export declare class GnosysDbSearch {
      */
     embeddingCount(): number;
 }
-//# sourceMappingURL=dbSearch.d.ts.map

package/dist/lib/dbSearch.js

@@ -235,4 +235,3 @@ export class GnosysDbSearch {
         return this.db.getEmbeddingCount();
     }
 }
-//# sourceMappingURL=dbSearch.js.map

package/dist/lib/dbWrite.d.ts

@@ -13,8 +13,8 @@
  * Once the Obsidian Export Bridge (Phase 7e) is complete, .md writes
  * become optional — controlled by config.
  */
-import { GnosysDB } from "./db.js";
-import { MemoryFrontmatter } from "./store.js";
+import type { GnosysDB } from "./db.js";
+import { type MemoryFrontmatter } from "./store.js";
 /**
  * Sync a memory write to gnosys.db after it's been written to .md.
  * Call this after GnosysStore.writeMemory() or updateMemory().
@@ -53,4 +53,3 @@ export declare function syncConfidenceToDb(db: GnosysDB, memoryId: string, newCo
  * This supplements (and eventually replaces) the JSONL audit log.
  */
 export declare function auditToDb(db: GnosysDB, operation: string, memoryId?: string, details?: Record<string, unknown>, durationMs?: number, traceId?: string): void;
-//# sourceMappingURL=dbWrite.d.ts.map

package/dist/lib/dbWrite.js

@@ -187,4 +187,3 @@ export function auditToDb(db, operation, memoryId, details, durationMs, traceId)
         trace_id: traceId || null,
     });
 }
-//# sourceMappingURL=dbWrite.js.map

package/dist/lib/desktopNotify.d.ts

@@ -28,4 +28,3 @@ export interface NotifyOptions {
  * fell back to stderr.
  */
 export declare function notifyDesktop(message: string, opts?: NotifyOptions): Promise<boolean>;
-//# sourceMappingURL=desktopNotify.d.ts.map

package/dist/lib/desktopNotify.js

@@ -77,4 +77,3 @@ function stderrFallback(title, message) {
 function escapeAppleScript(s) {
     return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
-//# sourceMappingURL=desktopNotify.js.map

package/dist/lib/docxExtract.d.ts

@@ -24,4 +24,3 @@ export interface DocxChunk {
  * a single chunk.
  */
 export declare function extractDocxText(filePath: string): Promise<DocxChunk[]>;
-//# sourceMappingURL=docxExtract.d.ts.map

package/dist/lib/docxExtract.js

@@ -6,6 +6,8 @@
  * Both libraries are loaded via dynamic import so they stay optional.
  */
 import * as fs from "fs/promises";
+/** Reject DOCX archives whose entries decompress beyond this total (zip-bomb guard). */
+const MAX_DECOMPRESSED_BYTES = 200 * 1024 * 1024;
 // ─── Public API ─────────────────────────────────────────────────────────
 /**
  * Extract text from a DOCX file as markdown, split into section chunks.
@@ -25,6 +27,7 @@ export async function extractDocxText(filePath) {
     const TurndownService = (await import("turndown")).default;
     // Read the file and convert to HTML
     const buffer = await fs.readFile(filePath);
+    await assertDocxDecompressedSizeWithinLimit(buffer);
     const result = await mammoth.convertToHtml({ buffer });
     const html = result.value;
     if (!html || !html.trim()) {
@@ -77,4 +80,22 @@ export async function extractDocxText(filePath) {
     }
     return chunks;
 }
-//# sourceMappingURL=docxExtract.js.map
+/**
+ * Inspect ZIP central-directory metadata before decompression.
+ * Rejects archives whose total uncompressed payload exceeds the cap.
+ */
+async function assertDocxDecompressedSizeWithinLimit(buffer) {
+    const JSZip = (await import("jszip")).default;
+    const zip = await JSZip.loadAsync(buffer);
+    let total = 0;
+    zip.forEach((_relativePath, entry) => {
+        if (entry.dir)
+            return;
+        const data = entry._data;
+        const size = data?.uncompressedSize ?? 0;
+        total += size;
+    });
+    if (total > MAX_DECOMPRESSED_BYTES) {
+        throw new Error(`DOCX decompresses to ~${Math.floor(total / 1048576)}MB, exceeds the ${MAX_DECOMPRESSED_BYTES / 1048576}MB limit (possible zip bomb).`);
+    }
+}

package/dist/lib/dream.d.ts

@@ -17,8 +17,8 @@
  *   - Off by default — must be explicitly enabled
  *   - Uses cheap/local LLM (configurable, defaults to Ollama)
  */
-import { GnosysDB } from "./db.js";
-import { GnosysConfig, LLMProviderName } from "./config.js";
+import type { GnosysDB } from "./db.js";
+import type { GnosysConfig, LLMProviderName } from "./config.js";
 export interface DreamConfig {
     /** Enable dream mode (default: false) */
     enabled: boolean;
@@ -179,4 +179,3 @@ export declare class DreamScheduler {
  * Format a dream report as human-readable text.
  */
 export declare function formatDreamReport(report: DreamReport): string;
-//# sourceMappingURL=dream.d.ts.map

package/dist/lib/dream.js

@@ -21,6 +21,7 @@ import os from "os";
 import { getLLMProvider } from "./llm.js";
 import { notifyDesktop } from "./desktopNotify.js";
 import { syncConfidenceToDb, auditToDb } from "./dbWrite.js";
+import { logError } from "./log.js";
 /** Layer 4 alert threshold: fire desktop notification at this many consecutive provider failures. */
 const DREAM_FAILURE_NOTIFY_THRESHOLD = 3;
 export const DEFAULT_DREAM_CONFIG = {
@@ -739,7 +740,7 @@ export class DreamScheduler {
                 console.error(`[dream] Complete: ${report.decayUpdated} decay, ${report.summariesGenerated} summaries, ${report.reviewSuggestions.length} reviews, ${report.relationshipsDiscovered} relations (${(report.durationMs / 1000).toFixed(1)}s)`);
             }
             catch (err) {
-                console.error(`[dream] Error: ${err instanceof Error ? err.message : String(err)}`);
+                logError(err, { module: "dream", op: "scheduler" });
             }
             finally {
                 this.running = false;
@@ -794,4 +795,3 @@ export function formatDreamReport(report) {
     }
     return lines.join("\n");
 }
-//# sourceMappingURL=dream.js.map

package/dist/lib/embeddings.d.ts

@@ -4,7 +4,6 @@
  * Model (~80 MB) is downloaded only on first use and cached.
  * Embeddings are stored in SQLite as regeneratable sidecar data.
  */
-declare const EMBEDDING_DIM = 384;
 export declare class GnosysEmbeddings {
     private pipeline;
     private db;
@@ -80,5 +79,3 @@ export declare class GnosysEmbeddings {
     };
     close(): void;
 }
-export { EMBEDDING_DIM };
-//# sourceMappingURL=embeddings.d.ts.map