imprnt 0.1.3-edge.61 → 0.1.3-edge.62

package/CLAUDE.md

@@ -148,13 +148,13 @@ imprnt keeps exactly two "robot" helpers, carried over from PAI (the system impr
 
 ## Updating & contradictions
 
-Correct the ONE entity note. Everything links by ID so the fix propagates. Old name → `aliases`. A contradiction stamps the stale line `> superseded by [[...]]`. Marked, never silently overwritten. Because `raw/` is immutable, any claim is traceable to its snapshot, and a schema change is just a `reingest` over `raw/`.
+Correct the ONE entity note. Everything links by ID so the fix propagates. Old name → `aliases`. A contradiction stamps the stale line `> superseded by [[...]]`. Marked, never silently overwritten. Because `raw/` is immutable, any claim is traceable to its snapshot, and a schema change is just re-running `ingest` over `raw/`.
 
 ## Migrating existing structured knowledge
 
 A migration is the one-time bulk WRITE: snapshot every chosen source into `raw/<source>/` (immutable, complete), then the LLM fans each source out into atomic, domain-filed, linked notes. Two rules keep it honest:
 
-- **Re-derive from the ORIGINAL source, not a prior vault.** When you rebuild the vault, go back to the original snapshots in `raw/`. Don't reshuffle a previous vault's notes (that migrates yesterday's mistakes forward). A schema change is just a `reingest` over `raw/`.
+- **Re-derive from the ORIGINAL source, not a prior vault.** When you rebuild the vault, go back to the original snapshots in `raw/`. Don't reshuffle a previous vault's notes (that migrates yesterday's mistakes forward). A schema change is just re-running `ingest` over `raw/`.
 - **But preserve genuine prior enrichment.** When a *source* is already an atomic, enriched note (a prior system's knowledge notes), map its fields onto this contract and keep its typed links. Don't re-derive it from scratch (that pays the LLM to downgrade good work). Re-deriving from scratch is for *unstructured* sources (the dense prose blobs).
 
 **A dense multi-topic source splits into atomic linked notes: one snapshot, many notes.** Real migration sources are dense blobs covering many objects at once (a health-overview file = the med stack + a health profile + an insurance-critical prescription decision + the doctor-as-a-person). Don't file the whole blob as one note. That loses the entity graph (the doctor never becomes a `people/`, the decision never becomes a linkable note). Instead: split it into one atomic note per object across the right folders (`people/` for the doctor, `holdings/kind:med` for a tracked drug+dose, `health/`/`identity/` for the profile/decision), link them, and keep the single `raw/` snapshot as the shared provenance for all of them. `ingest` writes one snapshot. The LLM fans it out into the right number of notes.
@@ -176,11 +176,11 @@ Core is the vault + `ingest → recall → check`. Everything else (a task-mirro
 - **Write** single-writer-per-path: a plugin writes only its own folder and **proposes** vault-note changes for `ingest`/you to apply. It never mutates a note. Frontmatter labels are **slug-namespaced** (`whenful.synced`), read-your-own-only. Core ignores unknown keys.
 - **`recall` searches `vault/` only, forever.** Sibling dirs + `raw/` are outside the corpus by construction. A plugin surfaces into search only by **proposing one low-frequency summary note** (the escape hatch).
 - **Behavior plugins** are a separate class: ship a fixed-size fragment the **user wires into the agent's system prompt**. The vault never auto-injects. Remove = delete the wire-in. No referee for conflicting fragments, the user owns composition. (The old system imposed. imprnt composes.)
-- **Harness plugins** are the third class: they customize Claude Code itself, never the vault (timemachine's PreToolUse snapshot hook, the statusline, a skill). The same plugin folder doubles as a **native Claude Code plugin** (`.claude-plugin/plugin.json` + `hooks/` + `skills/`, Anthropic's format) and/or carries **`imp-settings.json`** (the settings keys Claude only takes via config, e.g. `statusLine`, with `${PLUGIN_DIR}` as the plugin's absolute dir). `imp` carries enabled ones into every session it launches: one `--plugin-dir` per native plugin + one merged `--settings`. Stock `claude` stays stock, nothing is ever written to settings files, `plugin rm` undoes everything.
+- **Harness plugins** are the third class: they customize Claude Code itself, never the vault (timemachine's PreToolUse snapshot hook, the statusline, a skill). The same plugin folder doubles as a **native Claude Code plugin** (`.claude-plugin/plugin.json` + `hooks/` + `skills/`, Anthropic's format) and/or carries **`imp-settings.json`** (the settings keys Claude only takes via config, e.g. `statusLine`, with `${PLUGIN_DIR}` as the plugin's absolute dir). `imp` carries enabled ones into every claude session it launches: one `--plugin-dir` per native plugin + one merged `--settings` (gemini has no host for claude harness plugins, so `imp --gemini` skips them with a warning). Stock `claude` stays stock, nothing is ever written to settings files, `plugin rm` undoes everything.
 - **Capability modules** are the one bend in "share nothing": a module may *provide* a capability another *consumes* (the session-host brokers an authed-session token to the kleinanzeigen watcher). Bounded so it can't re-bloat core: the consumer copies a tiny client (`sessionToken(site) -> string | null`) over a **localhost broker**, never imports the provider or reads its folder. The invariant that replaces "no cross-plugin reads": **removing a provider degrades a consumer gracefully** (`null` = host down, fall back), never breaks it. This is a third contact surface (vault . agent-context . broker), fenced like the sync edge: deterministic, answer-on-request, auditable (token fingerprint, never the token), never resident. The litmus extends: zero core edits to add/remove a *provider* too, because there is no capability registry in core. Credential-holding modules follow the auth finding: human login once, read-only attach, never copy a profile, never automate the password. Full rules: `plugins/README.md`.
 - **Secrets are env vars at the plugin's edge.** A plugin calling an external service reads its key from an env var named in its README and fails loud when missing. Keys never land in the vault, the plugin folder, or anything committed. No central secret store.
 - **Commands only, no forced daemon.** The user schedules sync. Install/remove is manual (README `## Install` / `## Remove` + `rm -rf`), no registry.
-- **Core ↔ plugin contact = exactly three convention-based aggregators**, all dumb and uniform: `imprnt check --all` globs `plugins/*/check.js` (each plugin's built artifact), runs each with `node`, reads **exit code only**, forwards stdout verbatim, never parses plugin output. `imprnt ingest --apply` files staged notes the plugins drop in `plugins/*/proposed/`. `imp` turns the enable list into launch flags (`--plugin-dir` per native plugin + one merged `--settings`) for the session it spawns. All discover by filename/dir convention, never by import, never by naming a specific plugin. Fence: core may provide read-only *aggregation* helpers, never write/orchestration. (Not k8s liveness/readiness. Nothing runs, so the only health question is "is the data sound", which is what `check` answers.)
+- **Core ↔ plugin contact = exactly four convention-based contact points**, all dumb and uniform: `imprnt check --all` globs `plugins/*/check.js` (each plugin's built artifact), runs each with `node`, reads **exit code only**, forwards stdout verbatim, never parses plugin output. `imprnt ingest --apply` files staged notes the plugins drop in `plugins/*/proposed/`. `imp` turns the enable list into launch flags (`--plugin-dir` per native plugin + one merged `--settings`) for the session it spawns. `imprnt <module> <command>` dispatches to `plugins/<module>/<module>.js` (stdio inherited, exit code passed through, a built-in subcommand always wins, zero per-module logic). All discover by filename/dir convention, never by import, never by naming a specific plugin. Fence: core may provide read-only *aggregation* helpers, never write/orchestration. (Not k8s liveness/readiness. Nothing runs, so the only health question is "is the data sound", which is what `check` answers.)
 
 ## Out of scope (on purpose)
 No task management. No auto-injected context. No background loop. No self-grading. No MCP/vector/embeddings on the vault. No sensitivity machinery (it's private by being private). **No `out/` zone for deliverables.** A produced artifact (an article, an export) lives in your artifacts dir and a vault note points to it. The vault holds knowledge, not outputs. Every plugin is a self-contained dir you can `rm -rf`. "It belongs" is not a reason to add it. (Plugin-contract out-of-scope list lives in `plugins/README.md`.)

package/README.md

@@ -127,7 +127,7 @@ asking ("add the anti-slop plugin"), each a separate `imprnt-plugin-*` package:
 | `imprnt-plugin-anti-slop` | Rules that keep its prose from reading like AI. |
 | `imprnt-plugin-whenful` | A local mirror of your [Whenful](https://whenful.com) tasks, shown inline at read. |
 | `imprnt-plugin-kleinanzeigen` | A watcher for your Kleinanzeigen inbox: regex triage of buyer messages, drafts, a phone digest. You press send. |
-| `imprnt-plugin-session-host` | A warm browser holding your logged-in sessions, providing the authed-session capability. You enroll each site once. |
+| `imprnt-plugin-session-host` | A warm browser holding your logged-in sessions, providing the authed-session capability. You enroll each site once. Not yet on npm: install from a repo checkout with `imprnt plugin add session-host --from <dir>`. |
 | `imprnt-plugin-timemachine` | Snapshots your work before each change so you can recover what the agent breaks. |
 | `imprnt-plugin-statusline` | A customizable status line: model, branch, context, cost, rate limits, clock. |
 | `imprnt-plugin-telegram` | Your vault from your phone: text a bot, the answer comes from your notes. |
@@ -164,7 +164,7 @@ assistant that files and recalls for you:
 
 The docs are the website, [imprnt.dev](https://imprnt.dev), built straight from markdown in
 [`site/docs/`](site/docs/) (the single source): getting started, how it works, the model, plugins,
-architecture, design decisions, and contributing. Edit a file there and the site updates on the next
+design decisions, and contributing. Edit a file there and the site updates on the next
 deploy.
 
 - [`CLAUDE.md`](CLAUDE.md), the contract your assistant reads inside the vault: note formats, conventions.
@@ -174,8 +174,8 @@ deploy.
 
 The engine is built with [Bun](https://bun.sh) and [Turborepo](https://turborepo.com) (dev tools
 only, never needed by people who use it through their assistant). Clone, `bun install`,
-`bun run build`, `bun run test`. The architecture and the build-and-release model are in the
-[architecture](https://imprnt.dev/architecture/) and [contributing](https://imprnt.dev/contributing/) docs.
+`bun run build`, `bun run test`. The reasoning behind the design and the build-and-release model are in the
+[design decisions](https://imprnt.dev/design-decisions/) and [contributing](https://imprnt.dev/contributing/) docs.
 
 ## License
 

package/dist/cli.js

@@ -737,12 +737,19 @@ function readRegistry() {
     for (const [k, v] of Object.entries(raw?.vaults ?? {}))
       if (typeof v === "string")
         vaults[k] = v;
+    const defaultModels = {};
+    for (const [k, v] of Object.entries(raw?.defaultModels ?? {}))
+      if (typeof v === "string")
+        defaultModels[k] = v;
+    const passthrough = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
     return {
+      ...passthrough,
       default: typeof raw?.default === "string" ? raw.default : undefined,
       vaults,
       defaultAgent: typeof raw?.defaultAgent === "string" ? raw.defaultAgent : undefined,
       skipPermissions: typeof raw?.skipPermissions === "boolean" ? raw.skipPermissions : undefined,
-      defaultModel: typeof raw?.defaultModel === "string" ? raw.defaultModel : undefined
+      defaultModel: typeof raw?.defaultModel === "string" ? raw.defaultModel : undefined,
+      defaultModels: Object.keys(defaultModels).length ? defaultModels : undefined
     };
   } catch {
     return { vaults: {} };
@@ -787,12 +794,25 @@ function setSkipPermissions(on) {
   reg.skipPermissions = on;
   return writeRegistry(reg);
 }
-function readDefaultModel() {
-  return readRegistry().defaultModel;
+function readDefaultModel(agent) {
+  const reg = readRegistry();
+  const scoped = reg.defaultModels?.[agent];
+  if (scoped !== undefined)
+    return scoped;
+  return agent === (reg.defaultAgent ?? "claude") ? reg.defaultModel : undefined;
 }
-function setDefaultModel(model) {
+function setDefaultModel(model, agent) {
   const reg = readRegistry();
-  reg.defaultModel = model || undefined;
+  const models = { ...reg.defaultModels ?? {} };
+  const legacyAgent = reg.defaultAgent ?? "claude";
+  if (reg.defaultModel && models[legacyAgent] === undefined)
+    models[legacyAgent] = reg.defaultModel;
+  reg.defaultModel = undefined;
+  if (model)
+    models[agent] = model;
+  else
+    delete models[agent];
+  reg.defaultModels = Object.keys(models).length ? models : undefined;
   return writeRegistry(reg);
 }
 function writeRegistry(reg) {
@@ -1005,14 +1025,19 @@ function joinFragments(parts) {
 
 `);
 }
+function flagHead(args) {
+  const term = args.indexOf("--");
+  return term < 0 ? args : args.slice(0, term);
+}
 function claudeRenderArgs(spec) {
   const systemPrompt = spec.insideProject ? spec.globals : joinFragments([spec.cast, spec.pointer, spec.globals]);
   const harness = spec.pluginsRoot ? harnessFlags(spec.pluginsRoot) : [];
   const extra = spec.addDirs.flatMap((d) => ["--add-dir", d]);
   const lead = [];
-  if (spec.skipPermissions && !spec.passthrough.includes("--dangerously-skip-permissions"))
+  const head = flagHead(spec.passthrough);
+  if (spec.skipPermissions && !head.includes("--dangerously-skip-permissions"))
     lead.push("--dangerously-skip-permissions");
-  if (spec.model && !spec.passthrough.some((a) => a === "--model" || a.startsWith("--model=")))
+  if (spec.model && !head.some((a) => a === "--model" || a.startsWith("--model=")))
     lead.push("--model", spec.model);
   const pass = lead.length ? [...lead, ...spec.passthrough] : spec.passthrough;
   const body = systemPrompt ? mergeFragment(pass, systemPrompt, extra) : [...pass, ...extra];
@@ -1052,15 +1077,15 @@ function geminiRenderArgs(spec) {
     console.error("imp: gemini does not host claude harness plugins (statusline, timemachine) - skipping them");
   }
   const lead = [];
+  const head = flagHead(spec.passthrough);
   if (spec.skipPermissions) {
-    if (!spec.passthrough.includes("--yolo") && !spec.passthrough.includes("-y"))
+    if (!head.includes("--yolo") && !head.includes("-y"))
       lead.push("--yolo");
-    if (!spec.passthrough.includes("--skip-trust"))
+    if (!head.includes("--skip-trust"))
       lead.push("--skip-trust");
   }
   const pass = [...spec.passthrough];
-  const mTerm = pass.indexOf("--");
-  const mEnd = mTerm < 0 ? pass.length : mTerm;
+  const mEnd = flagHead(pass).length;
   const isModelFlag = (a) => a === "-m" || a === "--model" || a.startsWith("-m=") || a.startsWith("--model=");
   const mIdx = pass.slice(0, mEnd).findIndex(isModelFlag);
   if (mIdx >= 0) {
@@ -1182,7 +1207,7 @@ function resolveLaunch(passthrough, config = {}) {
       rest.push(a);
   }
   const name = agentFlag ?? process.env.IMPRNT_AGENT ?? config.agent ?? "claude";
-  let backend = backends[name];
+  let backend = Object.hasOwn(backends, name) ? backends[name] : undefined;
   if (!backend) {
     console.error(`imp: unknown agent "${name}" - falling back to claude (valid: ${Object.keys(backends).join(", ")})`);
     backend = claudeBackend;
@@ -2318,6 +2343,13 @@ function hostMemoryStores() {
     }
   }).sort();
 }
+function memoryIndexHasContent(dir2) {
+  try {
+    return readFileSync13(join14(dir2, "MEMORY.md"), "utf8").split(/\r?\n/).some((l) => l.trim() !== "" && l.trim() !== "# Memory index");
+  } catch {
+    return false;
+  }
+}
 function syncNeedsReview(lines2) {
   const p = join14(vault4, "_needs-review.md");
   const exists = existsSync12(p);
@@ -2497,10 +2529,18 @@ var init_check = __esm(() => {
   for (const r of uncovered)
     review.push(`- [ ] unclassified snapshot \`${r}\` — no vault note points back`);
   memoryStores = hostMemoryStores();
-  strayStores = memoryStores.map((dir2) => ({
-    dir: dir2,
-    files: existsSync12(dir2) ? readdirSync8(dir2).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort() : []
-  })).filter((s) => s.files.length > 0);
+  strayStores = memoryStores.map((dir2) => {
+    let files3 = [];
+    try {
+      if (existsSync12(dir2))
+        files3 = readdirSync8(dir2).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
+    } catch (e) {
+      console.error(`⚠ host auto-memory sweep: could not read ${dir2} (${e instanceof Error ? e.message : String(e)}) - skipping it`);
+    }
+    if (memoryIndexHasContent(dir2))
+      files3.push("MEMORY.md (has content)");
+    return { dir: dir2, files: files3 };
+  }).filter((s) => s.files.length > 0);
   strayCount = strayStores.reduce((n, s) => n + s.files.length, 0);
   for (const s of strayStores)
     review.push(`- [ ] host auto-memory not empty — ${s.files.length} note(s) in ${s.dir}; migrate knowledge → vault notes, behavior → a CLAUDE.local.md fragment, then empty it`);
@@ -2754,7 +2794,7 @@ var init_cli = __esm(async () => {
       const home = requireVaultHome();
       const { backend, skipPermissions, passthrough } = resolveLaunch(rest, { agent: readDefaultAgent(), yolo: readSkipPermissions() });
       const resumed = backend.resolveResume ? await backend.resolveResume(passthrough, home) : passthrough;
-      const spec = assembleSession({ cwd: home, vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel() });
+      const spec = assembleSession({ cwd: home, vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel(backend.name) });
       process.exit(launchBackend(backend, home, backend.renderArgs(spec), spec.env));
     }
     case "context": {
@@ -2777,7 +2817,7 @@ var init_cli = __esm(async () => {
         console.log("set: imprnt agent <claude|gemini>   override one session: imp --gemini | imp --claude");
         break;
       }
-      if (!(name in backends)) {
+      if (!Object.hasOwn(backends, name)) {
         console.error(`unknown agent "${name}" — valid: ${Object.keys(backends).join(", ")}`);
         process.exit(1);
       }
@@ -2811,29 +2851,32 @@ var init_cli = __esm(async () => {
       break;
     }
     case "model": {
+      const envAgent = process.env.IMPRNT_AGENT;
+      const agentName = envAgent ?? readDefaultAgent() ?? "claude";
+      const agent = agentName in backends ? agentName : "claude";
       const [arg] = rest;
       if (!arg) {
-        const m = readDefaultModel();
-        console.log(`default model: ${m ?? "(agent's own default)"}`);
+        const m = readDefaultModel(agent);
+        console.log(`default model for ${agent}: ${m ?? "(agent's own default)"}`);
         console.log("set: imprnt model <alias|id>   clear: imprnt model off");
         console.log(`gemini aliases: ${Object.entries(GEMINI_MODEL_ALIASES).map(([k, v]) => `${k}=${v}`).join(", ")}`);
         break;
       }
       if (arg === "off" || arg === "default" || arg === "none") {
-        const r2 = setDefaultModel("");
+        const r2 = setDefaultModel("", agent);
         if (!r2.ok) {
           console.error(`could not clear default model (${configPath()}): ${r2.error}`);
           process.exit(1);
         }
-        console.log(`default model cleared (${configPath()}) — the agent uses its own default`);
+        console.log(`default model for ${agent} cleared (${configPath()}) — the agent uses its own default`);
         break;
       }
-      const r = setDefaultModel(arg);
+      const r = setDefaultModel(arg, agent);
       if (!r.ok) {
         console.error(`could not set default model (${configPath()}): ${r.error}`);
         process.exit(1);
       }
-      console.log(`default model set to ${arg} (${configPath()})`);
+      console.log(`default model for ${agent} set to ${arg} (${configPath()})`);
       break;
     }
     case "plugin": {
@@ -3104,7 +3147,10 @@ enable: imprnt plugin add <name>   disable: imprnt plugin rm <name> [--purge]`);
         added.push("CLAUDE.md");
       }
       try {
+        const prevMode = statSync9(target).mode & 511;
         chmodSync(target, 448);
+        if (prevMode !== 448)
+          console.log(`locked ${target} to owner-only (chmod 700, was ${prevMode.toString(8).padStart(3, "0")})`);
       } catch (e) {
         console.error(`could not set owner-only (chmod 700) on ${target}: ${e instanceof Error ? e.message : String(e)} — tighten it by hand to honor the private-vault promise`);
       }
@@ -3154,7 +3200,7 @@ enable: imprnt plugin add <name>   disable: imprnt plugin rm <name> [--purge]`);
         const raw = bare ? [] : [cmd, ...rest];
         const { backend, skipPermissions, passthrough } = resolveLaunch(raw, { agent: readDefaultAgent(), yolo: readSkipPermissions() });
         const resumed = backend.resolveResume ? await backend.resolveResume(passthrough, process.cwd()) : passthrough;
-        const spec = assembleSession({ cwd: process.cwd(), vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel() });
+        const spec = assembleSession({ cwd: process.cwd(), vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel(backend.name) });
         process.exit(launchBackend(backend, process.cwd(), backend.renderArgs(spec), spec.env));
       }
       console.log(`imprnt — deterministic-first markdown knowledge vault
@@ -3174,7 +3220,7 @@ engine (same subcommands under \`imp\` or \`imprnt\`):
   imprnt context                           print the vault contract — agents run this before writing any note
   imprnt agent [claude|gemini]             show or set the per-machine default agent backend for imp
   imprnt yolo [on|off]                      show or set the per-machine skip-permissions default for imp
-  imprnt model [alias|id|off]               show or set the per-machine default model (gemini aliases: pro, flash, pro25, lite, ...)
+  imprnt model [alias|id|off]               show or set the per-machine default model for the current default agent (gemini aliases: pro, flash, pro25, lite, ...)
   imprnt check [--all] [--vault D]         integrity (orphan links, disconnected notes, uncovered snapshots) + regenerate index.md; --all also runs each plugins/*/check.js
   imprnt ingest --apply <file> [--vault D] file a pre-enriched staged note from a plugin into the vault (snapshot + resolve); --apply-all globs plugins/*/proposed/
   imprnt hot [--vault D]                   needs-review + the session primer

package/dist/imp.js

@@ -737,12 +737,19 @@ function readRegistry() {
     for (const [k, v] of Object.entries(raw?.vaults ?? {}))
       if (typeof v === "string")
         vaults[k] = v;
+    const defaultModels = {};
+    for (const [k, v] of Object.entries(raw?.defaultModels ?? {}))
+      if (typeof v === "string")
+        defaultModels[k] = v;
+    const passthrough = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
     return {
+      ...passthrough,
       default: typeof raw?.default === "string" ? raw.default : undefined,
       vaults,
       defaultAgent: typeof raw?.defaultAgent === "string" ? raw.defaultAgent : undefined,
       skipPermissions: typeof raw?.skipPermissions === "boolean" ? raw.skipPermissions : undefined,
-      defaultModel: typeof raw?.defaultModel === "string" ? raw.defaultModel : undefined
+      defaultModel: typeof raw?.defaultModel === "string" ? raw.defaultModel : undefined,
+      defaultModels: Object.keys(defaultModels).length ? defaultModels : undefined
     };
   } catch {
     return { vaults: {} };
@@ -787,12 +794,25 @@ function setSkipPermissions(on) {
   reg.skipPermissions = on;
   return writeRegistry(reg);
 }
-function readDefaultModel() {
-  return readRegistry().defaultModel;
+function readDefaultModel(agent) {
+  const reg = readRegistry();
+  const scoped = reg.defaultModels?.[agent];
+  if (scoped !== undefined)
+    return scoped;
+  return agent === (reg.defaultAgent ?? "claude") ? reg.defaultModel : undefined;
 }
-function setDefaultModel(model) {
+function setDefaultModel(model, agent) {
   const reg = readRegistry();
-  reg.defaultModel = model || undefined;
+  const models = { ...reg.defaultModels ?? {} };
+  const legacyAgent = reg.defaultAgent ?? "claude";
+  if (reg.defaultModel && models[legacyAgent] === undefined)
+    models[legacyAgent] = reg.defaultModel;
+  reg.defaultModel = undefined;
+  if (model)
+    models[agent] = model;
+  else
+    delete models[agent];
+  reg.defaultModels = Object.keys(models).length ? models : undefined;
   return writeRegistry(reg);
 }
 function writeRegistry(reg) {
@@ -1005,14 +1025,19 @@ function joinFragments(parts) {
 
 `);
 }
+function flagHead(args) {
+  const term = args.indexOf("--");
+  return term < 0 ? args : args.slice(0, term);
+}
 function claudeRenderArgs(spec) {
   const systemPrompt = spec.insideProject ? spec.globals : joinFragments([spec.cast, spec.pointer, spec.globals]);
   const harness = spec.pluginsRoot ? harnessFlags(spec.pluginsRoot) : [];
   const extra = spec.addDirs.flatMap((d) => ["--add-dir", d]);
   const lead = [];
-  if (spec.skipPermissions && !spec.passthrough.includes("--dangerously-skip-permissions"))
+  const head = flagHead(spec.passthrough);
+  if (spec.skipPermissions && !head.includes("--dangerously-skip-permissions"))
     lead.push("--dangerously-skip-permissions");
-  if (spec.model && !spec.passthrough.some((a) => a === "--model" || a.startsWith("--model=")))
+  if (spec.model && !head.some((a) => a === "--model" || a.startsWith("--model=")))
     lead.push("--model", spec.model);
   const pass = lead.length ? [...lead, ...spec.passthrough] : spec.passthrough;
   const body = systemPrompt ? mergeFragment(pass, systemPrompt, extra) : [...pass, ...extra];
@@ -1052,15 +1077,15 @@ function geminiRenderArgs(spec) {
     console.error("imp: gemini does not host claude harness plugins (statusline, timemachine) - skipping them");
   }
   const lead = [];
+  const head = flagHead(spec.passthrough);
   if (spec.skipPermissions) {
-    if (!spec.passthrough.includes("--yolo") && !spec.passthrough.includes("-y"))
+    if (!head.includes("--yolo") && !head.includes("-y"))
       lead.push("--yolo");
-    if (!spec.passthrough.includes("--skip-trust"))
+    if (!head.includes("--skip-trust"))
       lead.push("--skip-trust");
   }
   const pass = [...spec.passthrough];
-  const mTerm = pass.indexOf("--");
-  const mEnd = mTerm < 0 ? pass.length : mTerm;
+  const mEnd = flagHead(pass).length;
   const isModelFlag = (a) => a === "-m" || a === "--model" || a.startsWith("-m=") || a.startsWith("--model=");
   const mIdx = pass.slice(0, mEnd).findIndex(isModelFlag);
   if (mIdx >= 0) {
@@ -1182,7 +1207,7 @@ function resolveLaunch(passthrough, config = {}) {
       rest.push(a);
   }
   const name = agentFlag ?? process.env.IMPRNT_AGENT ?? config.agent ?? "claude";
-  let backend = backends[name];
+  let backend = Object.hasOwn(backends, name) ? backends[name] : undefined;
   if (!backend) {
     console.error(`imp: unknown agent "${name}" - falling back to claude (valid: ${Object.keys(backends).join(", ")})`);
     backend = claudeBackend;
@@ -2318,6 +2343,13 @@ function hostMemoryStores() {
     }
   }).sort();
 }
+function memoryIndexHasContent(dir2) {
+  try {
+    return readFileSync13(join14(dir2, "MEMORY.md"), "utf8").split(/\r?\n/).some((l) => l.trim() !== "" && l.trim() !== "# Memory index");
+  } catch {
+    return false;
+  }
+}
 function syncNeedsReview(lines2) {
   const p = join14(vault4, "_needs-review.md");
   const exists = existsSync12(p);
@@ -2497,10 +2529,18 @@ var init_check = __esm(() => {
   for (const r of uncovered)
     review.push(`- [ ] unclassified snapshot \`${r}\` — no vault note points back`);
   memoryStores = hostMemoryStores();
-  strayStores = memoryStores.map((dir2) => ({
-    dir: dir2,
-    files: existsSync12(dir2) ? readdirSync8(dir2).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort() : []
-  })).filter((s) => s.files.length > 0);
+  strayStores = memoryStores.map((dir2) => {
+    let files3 = [];
+    try {
+      if (existsSync12(dir2))
+        files3 = readdirSync8(dir2).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
+    } catch (e) {
+      console.error(`⚠ host auto-memory sweep: could not read ${dir2} (${e instanceof Error ? e.message : String(e)}) - skipping it`);
+    }
+    if (memoryIndexHasContent(dir2))
+      files3.push("MEMORY.md (has content)");
+    return { dir: dir2, files: files3 };
+  }).filter((s) => s.files.length > 0);
   strayCount = strayStores.reduce((n, s) => n + s.files.length, 0);
   for (const s of strayStores)
     review.push(`- [ ] host auto-memory not empty — ${s.files.length} note(s) in ${s.dir}; migrate knowledge → vault notes, behavior → a CLAUDE.local.md fragment, then empty it`);
@@ -2754,7 +2794,7 @@ var init_cli = __esm(async () => {
       const home = requireVaultHome();
       const { backend, skipPermissions, passthrough } = resolveLaunch(rest, { agent: readDefaultAgent(), yolo: readSkipPermissions() });
       const resumed = backend.resolveResume ? await backend.resolveResume(passthrough, home) : passthrough;
-      const spec = assembleSession({ cwd: home, vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel() });
+      const spec = assembleSession({ cwd: home, vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel(backend.name) });
       process.exit(launchBackend(backend, home, backend.renderArgs(spec), spec.env));
     }
     case "context": {
@@ -2777,7 +2817,7 @@ var init_cli = __esm(async () => {
         console.log("set: imprnt agent <claude|gemini>   override one session: imp --gemini | imp --claude");
         break;
       }
-      if (!(name in backends)) {
+      if (!Object.hasOwn(backends, name)) {
         console.error(`unknown agent "${name}" — valid: ${Object.keys(backends).join(", ")}`);
         process.exit(1);
       }
@@ -2811,29 +2851,32 @@ var init_cli = __esm(async () => {
       break;
     }
     case "model": {
+      const envAgent = process.env.IMPRNT_AGENT;
+      const agentName = envAgent ?? readDefaultAgent() ?? "claude";
+      const agent = agentName in backends ? agentName : "claude";
       const [arg] = rest;
       if (!arg) {
-        const m = readDefaultModel();
-        console.log(`default model: ${m ?? "(agent's own default)"}`);
+        const m = readDefaultModel(agent);
+        console.log(`default model for ${agent}: ${m ?? "(agent's own default)"}`);
         console.log("set: imprnt model <alias|id>   clear: imprnt model off");
         console.log(`gemini aliases: ${Object.entries(GEMINI_MODEL_ALIASES).map(([k, v]) => `${k}=${v}`).join(", ")}`);
         break;
       }
       if (arg === "off" || arg === "default" || arg === "none") {
-        const r2 = setDefaultModel("");
+        const r2 = setDefaultModel("", agent);
         if (!r2.ok) {
           console.error(`could not clear default model (${configPath()}): ${r2.error}`);
           process.exit(1);
         }
-        console.log(`default model cleared (${configPath()}) — the agent uses its own default`);
+        console.log(`default model for ${agent} cleared (${configPath()}) — the agent uses its own default`);
         break;
       }
-      const r = setDefaultModel(arg);
+      const r = setDefaultModel(arg, agent);
       if (!r.ok) {
         console.error(`could not set default model (${configPath()}): ${r.error}`);
         process.exit(1);
       }
-      console.log(`default model set to ${arg} (${configPath()})`);
+      console.log(`default model for ${agent} set to ${arg} (${configPath()})`);
       break;
     }
     case "plugin": {
@@ -3104,7 +3147,10 @@ enable: imprnt plugin add <name>   disable: imprnt plugin rm <name> [--purge]`);
         added.push("CLAUDE.md");
       }
       try {
+        const prevMode = statSync9(target).mode & 511;
         chmodSync(target, 448);
+        if (prevMode !== 448)
+          console.log(`locked ${target} to owner-only (chmod 700, was ${prevMode.toString(8).padStart(3, "0")})`);
       } catch (e) {
         console.error(`could not set owner-only (chmod 700) on ${target}: ${e instanceof Error ? e.message : String(e)} — tighten it by hand to honor the private-vault promise`);
       }
@@ -3154,7 +3200,7 @@ enable: imprnt plugin add <name>   disable: imprnt plugin rm <name> [--purge]`);
         const raw = bare ? [] : [cmd, ...rest];
         const { backend, skipPermissions, passthrough } = resolveLaunch(raw, { agent: readDefaultAgent(), yolo: readSkipPermissions() });
         const resumed = backend.resolveResume ? await backend.resolveResume(passthrough, process.cwd()) : passthrough;
-        const spec = assembleSession({ cwd: process.cwd(), vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel() });
+        const spec = assembleSession({ cwd: process.cwd(), vaultProject: home, pkgRoot, passthrough: resumed, skipPermissions, model: readDefaultModel(backend.name) });
         process.exit(launchBackend(backend, process.cwd(), backend.renderArgs(spec), spec.env));
       }
       console.log(`imprnt — deterministic-first markdown knowledge vault
@@ -3174,7 +3220,7 @@ engine (same subcommands under \`imp\` or \`imprnt\`):
   imprnt context                           print the vault contract — agents run this before writing any note
   imprnt agent [claude|gemini]             show or set the per-machine default agent backend for imp
   imprnt yolo [on|off]                      show or set the per-machine skip-permissions default for imp
-  imprnt model [alias|id|off]               show or set the per-machine default model (gemini aliases: pro, flash, pro25, lite, ...)
+  imprnt model [alias|id|off]               show or set the per-machine default model for the current default agent (gemini aliases: pro, flash, pro25, lite, ...)
   imprnt check [--all] [--vault D]         integrity (orphan links, disconnected notes, uncovered snapshots) + regenerate index.md; --all also runs each plugins/*/check.js
   imprnt ingest --apply <file> [--vault D] file a pre-enriched staged note from a plugin into the vault (snapshot + resolve); --apply-all globs plugins/*/proposed/
   imprnt hot [--vault D]                   needs-review + the session primer

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "imprnt",
-  "version": "0.1.3-edge.61",
+  "version": "0.1.3-edge.62",
   "description": "Deterministic-first, plain-markdown knowledge vault. Code does the bulk transform. The LLM only touches the irreducibly-semantic 20%. Native grep plus BM25 retrieval, zero MCP on the vault.",
   "type": "module",
   "bin": {