kiro-memory 1.9.0 → 3.0.0

package/plugin/dist/hooks/userPromptSubmit.js

@@ -16,6 +16,290 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/utils/secrets.ts
+function redactSecrets(text) {
+  if (!text) return text;
+  let redacted = text;
+  for (const { pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    redacted = redacted.replace(pattern, (match) => {
+      const prefix = match.substring(0, Math.min(4, match.length));
+      return `${prefix}***REDACTED***`;
+    });
+  }
+  return redacted;
+}
+var SECRET_PATTERNS;
+var init_secrets = __esm({
+  "src/utils/secrets.ts"() {
+    "use strict";
+    SECRET_PATTERNS = [
+      // AWS Access Keys (AKIA, ABIA, ACCA, ASIA prefixes + 16 alphanumeric chars)
+      { name: "aws-key", pattern: /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/g },
+      // JWT tokens (three base64url segments separated by dots)
+      { name: "jwt", pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g },
+      // Generic API keys in key=value or key: value assignments
+      { name: "api-key", pattern: /(?:api[_-]?key|apikey|api[_-]?secret)\s*[:=]\s*['"]?([a-zA-Z0-9_\-]{20,})['"]?/gi },
+      // Password/secret/token in variable assignments
+      { name: "credential", pattern: /(?:password|passwd|pwd|secret|token|auth[_-]?token|access[_-]?token|bearer)\s*[:=]\s*['"]?([^\s'"]{8,})['"]?/gi },
+      // Credentials embedded in URLs (user:pass@host)
+      { name: "url-credential", pattern: /(?:https?:\/\/)([^:]+):([^@]+)@/g },
+      // PEM-encoded private keys (RSA, EC, DSA, OpenSSH)
+      { name: "private-key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+      // GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_ prefixes)
+      { name: "github-token", pattern: /gh[pousr]_[a-zA-Z0-9]{36,}/g },
+      // Slack bot/user/app tokens
+      { name: "slack-token", pattern: /xox[bpoas]-[a-zA-Z0-9-]{10,}/g },
+      // HTTP Authorization Bearer header values
+      { name: "bearer-header", pattern: /\bBearer\s+([a-zA-Z0-9_\-\.]{20,})/g },
+      // Generic hex secrets (32+ hex chars after a key/secret/token/password label)
+      { name: "hex-secret", pattern: /(?:key|secret|token|password)\s*[:=]\s*['"]?([0-9a-f]{32,})['"]?/gi }
+    ];
+  }
+});
+
+// src/utils/categorizer.ts
+function categorize(input) {
+  const scores = /* @__PURE__ */ new Map();
+  const searchText = [
+    input.title,
+    input.text || "",
+    input.narrative || "",
+    input.concepts || ""
+  ].join(" ").toLowerCase();
+  const allFiles = [input.filesModified || "", input.filesRead || ""].join(",");
+  for (const rule of CATEGORY_RULES) {
+    let score = 0;
+    for (const kw of rule.keywords) {
+      if (searchText.includes(kw.toLowerCase())) {
+        score += rule.weight;
+      }
+    }
+    if (rule.types && rule.types.includes(input.type)) {
+      score += rule.weight * 2;
+    }
+    if (rule.filePatterns && allFiles) {
+      for (const pattern of rule.filePatterns) {
+        if (pattern.test(allFiles)) {
+          score += rule.weight;
+        }
+      }
+    }
+    if (score > 0) {
+      scores.set(rule.category, (scores.get(rule.category) || 0) + score);
+    }
+  }
+  let bestCategory = "general";
+  let bestScore = 0;
+  for (const [category, score] of scores) {
+    if (score > bestScore) {
+      bestScore = score;
+      bestCategory = category;
+    }
+  }
+  return bestCategory;
+}
+var CATEGORY_RULES;
+var init_categorizer = __esm({
+  "src/utils/categorizer.ts"() {
+    "use strict";
+    CATEGORY_RULES = [
+      {
+        category: "security",
+        keywords: [
+          "security",
+          "vulnerability",
+          "cve",
+          "xss",
+          "csrf",
+          "injection",
+          "sanitize",
+          "escape",
+          "auth",
+          "authentication",
+          "authorization",
+          "permission",
+          "helmet",
+          "cors",
+          "rate-limit",
+          "token",
+          "encrypt",
+          "decrypt",
+          "secret",
+          "redact",
+          "owasp"
+        ],
+        filePatterns: [/security/i, /auth/i, /secrets?\.ts/i],
+        weight: 10
+      },
+      {
+        category: "testing",
+        keywords: [
+          "test",
+          "spec",
+          "expect",
+          "assert",
+          "mock",
+          "stub",
+          "fixture",
+          "coverage",
+          "jest",
+          "vitest",
+          "bun test",
+          "unit test",
+          "integration test",
+          "e2e"
+        ],
+        types: ["test"],
+        filePatterns: [/\.test\./i, /\.spec\./i, /tests?\//i, /__tests__/i],
+        weight: 8
+      },
+      {
+        category: "debugging",
+        keywords: [
+          "debug",
+          "fix",
+          "bug",
+          "error",
+          "crash",
+          "stacktrace",
+          "stack trace",
+          "exception",
+          "breakpoint",
+          "investigate",
+          "root cause",
+          "troubleshoot",
+          "diagnose",
+          "bisect",
+          "regression"
+        ],
+        types: ["bugfix"],
+        weight: 8
+      },
+      {
+        category: "architecture",
+        keywords: [
+          "architect",
+          "design",
+          "pattern",
+          "modular",
+          "migration",
+          "schema",
+          "database",
+          "api design",
+          "abstract",
+          "dependency injection",
+          "singleton",
+          "factory",
+          "observer",
+          "middleware",
+          "pipeline",
+          "microservice",
+          "monolith"
+        ],
+        types: ["decision", "constraint"],
+        weight: 7
+      },
+      {
+        category: "refactoring",
+        keywords: [
+          "refactor",
+          "rename",
+          "extract",
+          "inline",
+          "move",
+          "split",
+          "merge",
+          "simplify",
+          "cleanup",
+          "clean up",
+          "dead code",
+          "consolidate",
+          "reorganize",
+          "restructure",
+          "decouple"
+        ],
+        weight: 6
+      },
+      {
+        category: "config",
+        keywords: [
+          "config",
+          "configuration",
+          "env",
+          "environment",
+          "dotenv",
+          ".env",
+          "settings",
+          "tsconfig",
+          "eslint",
+          "prettier",
+          "webpack",
+          "vite",
+          "esbuild",
+          "docker",
+          "ci/cd",
+          "github actions",
+          "deploy",
+          "build",
+          "bundle",
+          "package.json"
+        ],
+        filePatterns: [
+          /\.config\./i,
+          /\.env/i,
+          /tsconfig/i,
+          /\.ya?ml/i,
+          /Dockerfile/i,
+          /docker-compose/i
+        ],
+        weight: 5
+      },
+      {
+        category: "docs",
+        keywords: [
+          "document",
+          "readme",
+          "changelog",
+          "jsdoc",
+          "comment",
+          "explain",
+          "guide",
+          "tutorial",
+          "api doc",
+          "openapi",
+          "swagger"
+        ],
+        types: ["docs"],
+        filePatterns: [/\.md$/i, /docs?\//i, /readme/i, /changelog/i],
+        weight: 5
+      },
+      {
+        category: "feature-dev",
+        keywords: [
+          "feature",
+          "implement",
+          "add",
+          "create",
+          "new",
+          "endpoint",
+          "component",
+          "module",
+          "service",
+          "handler",
+          "route",
+          "hook",
+          "plugin",
+          "integration"
+        ],
+        types: ["feature", "file-write"],
+        weight: 3
+        // lowest — generic catch-all for development
+      }
+    ];
+  }
+});
+
 // src/services/sqlite/Observations.ts
 var Observations_exports = {};
 __export(Observations_exports, {
@@ -41,11 +325,23 @@ function isDuplicateObservation(db, contentHash, windowMs = 3e4) {
 }
 function createObservation(db, memorySessionId, project, type, title, subtitle, text, narrative, facts, concepts, filesRead, filesModified, promptNumber, contentHash = null, discoveryTokens = 0) {
   const now = /* @__PURE__ */ new Date();
+  const safeTitle = redactSecrets(title);
+  const safeText = text ? redactSecrets(text) : text;
+  const safeNarrative = narrative ? redactSecrets(narrative) : narrative;
+  const autoCategory = categorize({
+    type,
+    title: safeTitle,
+    text: safeText,
+    narrative: safeNarrative,
+    concepts,
+    filesModified,
+    filesRead
+  });
   const result = db.run(
     `INSERT INTO observations
-     (memory_session_id, project, type, title, subtitle, text, narrative, facts, concepts, files_read, files_modified, prompt_number, created_at, created_at_epoch, content_hash, discovery_tokens)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    [memorySessionId, project, type, title, subtitle, text, narrative, facts, concepts, filesRead, filesModified, promptNumber, now.toISOString(), now.getTime(), contentHash, discoveryTokens]
+     (memory_session_id, project, type, title, subtitle, text, narrative, facts, concepts, files_read, files_modified, prompt_number, created_at, created_at_epoch, content_hash, discovery_tokens, auto_category)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [memorySessionId, project, type, safeTitle, subtitle, safeText, safeNarrative, facts, concepts, filesRead, filesModified, promptNumber, now.toISOString(), now.getTime(), contentHash, discoveryTokens, autoCategory]
   );
   return Number(result.lastInsertRowid);
 }
@@ -57,16 +353,16 @@ function getObservationsBySession(db, memorySessionId) {
 }
 function getObservationsByProject(db, project, limit = 100) {
   const query = db.query(
-    "SELECT * FROM observations WHERE project = ? ORDER BY created_at_epoch DESC LIMIT ?"
+    "SELECT * FROM observations WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?"
   );
   return query.all(project, limit);
 }
 function searchObservations(db, searchTerm, project) {
   const sql = project ? `SELECT * FROM observations
        WHERE project = ? AND (title LIKE ? ESCAPE '\\' OR text LIKE ? ESCAPE '\\' OR narrative LIKE ? ESCAPE '\\')
-       ORDER BY created_at_epoch DESC` : `SELECT * FROM observations
+       ORDER BY created_at_epoch DESC, id DESC` : `SELECT * FROM observations
        WHERE title LIKE ? ESCAPE '\\' OR text LIKE ? ESCAPE '\\' OR narrative LIKE ? ESCAPE '\\'
-       ORDER BY created_at_epoch DESC`;
+       ORDER BY created_at_epoch DESC, id DESC`;
   const pattern = `%${escapeLikePattern(searchTerm)}%`;
   const query = db.query(sql);
   if (project) {
@@ -99,21 +395,32 @@ function consolidateObservations(db, project, options = {}) {
     ORDER BY cnt DESC
   `).all(project, minGroupSize);
   if (groups.length === 0) return { merged: 0, removed: 0 };
-  let totalMerged = 0;
-  let totalRemoved = 0;
+  if (options.dryRun) {
+    let totalMerged = 0;
+    let totalRemoved = 0;
+    for (const group of groups) {
+      const obsIds = group.ids.split(",").map(Number);
+      const placeholders = obsIds.map(() => "?").join(",");
+      const count = db.query(
+        `SELECT COUNT(*) as cnt FROM observations WHERE id IN (${placeholders})`
+      ).get(...obsIds)?.cnt || 0;
+      if (count >= minGroupSize) {
+        totalMerged += 1;
+        totalRemoved += count - 1;
+      }
+    }
+    return { merged: totalMerged, removed: totalRemoved };
+  }
   const runConsolidation = db.transaction(() => {
+    let merged = 0;
+    let removed = 0;
     for (const group of groups) {
       const obsIds = group.ids.split(",").map(Number);
       const placeholders = obsIds.map(() => "?").join(",");
       const observations = db.query(
-        `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC`
+        `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC, id DESC`
       ).all(...obsIds);
       if (observations.length < minGroupSize) continue;
-      if (options.dryRun) {
-        totalMerged += 1;
-        totalRemoved += observations.length - 1;
-        continue;
-      }
       const keeper = observations[0];
       const others = observations.slice(1);
       const uniqueTexts = /* @__PURE__ */ new Set();
@@ -126,22 +433,24 @@ function consolidateObservations(db, project, options = {}) {
       const consolidatedText = Array.from(uniqueTexts).join("\n---\n").substring(0, 1e5);
       db.run(
         "UPDATE observations SET text = ?, title = ? WHERE id = ?",
-        [consolidatedText, `[consolidato x${observations.length}] ${keeper.title}`, keeper.id]
+        [consolidatedText, `[consolidated x${observations.length}] ${keeper.title}`, keeper.id]
       );
       const removeIds = others.map((o) => o.id);
       const removePlaceholders = removeIds.map(() => "?").join(",");
       db.run(`DELETE FROM observations WHERE id IN (${removePlaceholders})`, removeIds);
       db.run(`DELETE FROM observation_embeddings WHERE observation_id IN (${removePlaceholders})`, removeIds);
-      totalMerged += 1;
-      totalRemoved += removeIds.length;
+      merged += 1;
+      removed += removeIds.length;
     }
+    return { merged, removed };
   });
-  runConsolidation();
-  return { merged: totalMerged, removed: totalRemoved };
+  return runConsolidation();
 }
 var init_Observations = __esm({
   "src/services/sqlite/Observations.ts"() {
     "use strict";
+    init_secrets();
+    init_categorizer();
   }
 });
 
@@ -164,7 +473,7 @@ function escapeLikePattern3(input) {
 }
 function sanitizeFTS5Query(query) {
   const trimmed = query.length > 1e4 ? query.substring(0, 1e4) : query;
-  const terms = trimmed.replace(/[""]/g, "").split(/\s+/).filter((t) => t.length > 0).slice(0, 100).map((t) => `"${t}"`);
+  const terms = trimmed.replace(/[""\u0022]/g, "").split(/\s+/).filter((t) => t.length > 0).slice(0, 100).map((t) => `"${t}"`);
   return terms.join(" ");
 }
 function searchObservationsFTS(db, query, filters = {}) {
@@ -261,7 +570,7 @@ function searchObservationsLIKE(db, query, filters = {}) {
     sql += " AND created_at_epoch <= ?";
     params.push(filters.dateEnd);
   }
-  sql += " ORDER BY created_at_epoch DESC LIMIT ?";
+  sql += " ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
   params.push(limit);
   const stmt = db.query(sql);
   return stmt.all(...params);
@@ -286,7 +595,7 @@ function searchSummariesFiltered(db, query, filters = {}) {
     sql += " AND created_at_epoch <= ?";
     params.push(filters.dateEnd);
   }
-  sql += " ORDER BY created_at_epoch DESC LIMIT ?";
+  sql += " ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
   params.push(limit);
   const stmt = db.query(sql);
   return stmt.all(...params);
@@ -296,7 +605,7 @@ function getObservationsByIds(db, ids) {
   const validIds = ids.filter((id) => typeof id === "number" && Number.isInteger(id) && id > 0).slice(0, 500);
   if (validIds.length === 0) return [];
   const placeholders = validIds.map(() => "?").join(",");
-  const sql = `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC`;
+  const sql = `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC, id DESC`;
   const stmt = db.query(sql);
   return stmt.all(...validIds);
 }
@@ -308,11 +617,11 @@ function getTimeline(db, anchorId, depthBefore = 5, depthAfter = 5) {
   const beforeStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations
-    WHERE created_at_epoch < ?
-    ORDER BY created_at_epoch DESC
+    WHERE (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+    ORDER BY created_at_epoch DESC, id DESC
     LIMIT ?
   `);
-  const before = beforeStmt.all(anchorEpoch, depthBefore).reverse();
+  const before = beforeStmt.all(anchorEpoch, anchorEpoch, anchorId, depthBefore).reverse();
   const selfStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations WHERE id = ?
@@ -321,34 +630,46 @@ function getTimeline(db, anchorId, depthBefore = 5, depthAfter = 5) {
   const afterStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations
-    WHERE created_at_epoch > ?
-    ORDER BY created_at_epoch ASC
+    WHERE (created_at_epoch > ? OR (created_at_epoch = ? AND id > ?))
+    ORDER BY created_at_epoch ASC, id ASC
     LIMIT ?
   `);
-  const after = afterStmt.all(anchorEpoch, depthAfter);
+  const after = afterStmt.all(anchorEpoch, anchorEpoch, anchorId, depthAfter);
   return [...before, ...self, ...after];
 }
 function getProjectStats(db, project) {
-  const obsStmt = db.query("SELECT COUNT(*) as count FROM observations WHERE project = ?");
-  const sumStmt = db.query("SELECT COUNT(*) as count FROM summaries WHERE project = ?");
-  const sesStmt = db.query("SELECT COUNT(*) as count FROM sessions WHERE project = ?");
-  const prmStmt = db.query("SELECT COUNT(*) as count FROM prompts WHERE project = ?");
-  const discoveryStmt = db.query(
-    "SELECT COALESCE(SUM(discovery_tokens), 0) as total FROM observations WHERE project = ?"
-  );
-  const discoveryTokens = discoveryStmt.get(project)?.total || 0;
-  const readStmt = db.query(
-    `SELECT COALESCE(SUM(
-      CAST((LENGTH(COALESCE(title, '')) + LENGTH(COALESCE(narrative, ''))) / 4 AS INTEGER)
-    ), 0) as total FROM observations WHERE project = ?`
-  );
-  const readTokens = readStmt.get(project)?.total || 0;
+  const sql = `
+    WITH
+      obs_stats AS (
+        SELECT
+          COUNT(*) as count,
+          COALESCE(SUM(discovery_tokens), 0) as discovery_tokens,
+          COALESCE(SUM(
+            CAST((LENGTH(COALESCE(title, '')) + LENGTH(COALESCE(narrative, ''))) / 4 AS INTEGER)
+          ), 0) as read_tokens
+        FROM observations WHERE project = ?
+      ),
+      sum_count AS (SELECT COUNT(*) as count FROM summaries WHERE project = ?),
+      ses_count AS (SELECT COUNT(*) as count FROM sessions WHERE project = ?),
+      prm_count AS (SELECT COUNT(*) as count FROM prompts WHERE project = ?)
+    SELECT
+      obs_stats.count as observations,
+      obs_stats.discovery_tokens,
+      obs_stats.read_tokens,
+      sum_count.count as summaries,
+      ses_count.count as sessions,
+      prm_count.count as prompts
+    FROM obs_stats, sum_count, ses_count, prm_count
+  `;
+  const row = db.query(sql).get(project, project, project, project);
+  const discoveryTokens = row?.discovery_tokens || 0;
+  const readTokens = row?.read_tokens || 0;
   const savings = Math.max(0, discoveryTokens - readTokens);
   return {
-    observations: obsStmt.get(project)?.count || 0,
-    summaries: sumStmt.get(project)?.count || 0,
-    sessions: sesStmt.get(project)?.count || 0,
-    prompts: prmStmt.get(project)?.count || 0,
+    observations: row?.observations || 0,
+    summaries: row?.summaries || 0,
+    sessions: row?.sessions || 0,
+    prompts: row?.prompts || 0,
     tokenEconomics: { discoveryTokens, readTokens, savings }
   };
 }
@@ -356,7 +677,7 @@ function getStaleObservations(db, project) {
   const rows = db.query(`
     SELECT * FROM observations
     WHERE project = ? AND files_modified IS NOT NULL AND files_modified != ''
-    ORDER BY created_at_epoch DESC
+    ORDER BY created_at_epoch DESC, id DESC
     LIMIT 500
   `).all(project);
   const staleObs = [];
@@ -493,7 +814,7 @@ async function readStdin() {
         }
         resolve(JSON.parse(data));
       } catch (err) {
-        reject(new Error(`Errore parsing stdin JSON: ${err}`));
+        reject(new Error(`Error parsing stdin JSON: ${err}`));
       }
     });
     process.stdin.on("error", (err) => {
@@ -551,11 +872,11 @@ async function runHook(name, handler) {
     }
     debugLog(name, "stdin", input);
     await handler(input);
-    debugLog(name, "completato", { success: true });
+    debugLog(name, "completed", { success: true });
     process.exit(0);
   } catch (error) {
-    debugLog(name, "errore", { error: String(error) });
-    process.stderr.write(`[kiro-memory:${name}] Errore: ${error}
+    debugLog(name, "error", { error: String(error) });
+    process.stderr.write(`[kiro-memory:${name}] Error: ${error}
 `);
     process.exit(0);
   }
@@ -565,14 +886,15 @@ async function runHook(name, handler) {
 import BetterSqlite3 from "better-sqlite3";
 var Database = class {
   _db;
+  _stmtCache = /* @__PURE__ */ new Map();
   constructor(path, options) {
     this._db = new BetterSqlite3(path, {
-      // better-sqlite3 crea il file di default (non serve 'create')
+      // better-sqlite3 creates the file by default ('create' not needed)
       readonly: options?.readwrite === false ? true : false
     });
   }
   /**
-   * Esegui una query SQL senza risultati
+   * Execute a SQL query without results
    */
   run(sql, params) {
     const stmt = this._db.prepare(sql);
@@ -580,51 +902,53 @@ var Database = class {
     return result;
   }
   /**
-   * Prepara una query con interfaccia compatibile bun:sqlite
+   * Prepare a query with bun:sqlite-compatible interface.
+   * Returns a cached prepared statement for repeated queries.
    */
   query(sql) {
-    return new BunQueryCompat(this._db, sql);
+    let cached = this._stmtCache.get(sql);
+    if (!cached) {
+      cached = new BunQueryCompat(this._db, sql);
+      this._stmtCache.set(sql, cached);
+    }
+    return cached;
   }
   /**
-   * Crea una transazione
+   * Create a transaction
    */
   transaction(fn) {
     return this._db.transaction(fn);
   }
   /**
-   * Chiudi la connessione
+   * Close the connection
    */
   close() {
+    this._stmtCache.clear();
     this._db.close();
   }
 };
 var BunQueryCompat = class {
-  _db;
-  _sql;
+  _stmt;
   constructor(db, sql) {
-    this._db = db;
-    this._sql = sql;
+    this._stmt = db.prepare(sql);
   }
   /**
-   * Restituisce tutte le righe
+   * Returns all rows
    */
   all(...params) {
-    const stmt = this._db.prepare(this._sql);
-    return params.length > 0 ? stmt.all(...params) : stmt.all();
+    return params.length > 0 ? this._stmt.all(...params) : this._stmt.all();
   }
   /**
-   * Restituisce la prima riga o null
+   * Returns the first row or null
    */
   get(...params) {
-    const stmt = this._db.prepare(this._sql);
-    return params.length > 0 ? stmt.get(...params) : stmt.get();
+    return params.length > 0 ? this._stmt.get(...params) : this._stmt.get();
   }
   /**
-   * Esegui senza risultati
+   * Execute without results
    */
   run(...params) {
-    const stmt = this._db.prepare(this._sql);
-    return params.length > 0 ? stmt.run(...params) : stmt.run();
+    return params.length > 0 ? this._stmt.run(...params) : this._stmt.run();
   }
 };
 
@@ -886,40 +1210,62 @@ function ensureDir(dirPath) {
 var SQLITE_MMAP_SIZE_BYTES = 256 * 1024 * 1024;
 var SQLITE_CACHE_SIZE_PAGES = 1e4;
 var KiroMemoryDatabase = class {
-  db;
+  _db;
   /**
-   * @param dbPath - Percorso al file SQLite (default: DB_PATH)
-   * @param skipMigrations - Se true, salta il migration runner (per hook ad alta frequenza)
+   * Readonly accessor for the underlying Database instance.
+   * Prefer using query() and run() proxy methods directly.
+   */
+  get db() {
+    return this._db;
+  }
+  /**
+   * @param dbPath - Path to the SQLite file (default: DB_PATH)
+   * @param skipMigrations - If true, skip the migration runner (for high-frequency hooks)
    */
   constructor(dbPath = DB_PATH, skipMigrations = false) {
     if (dbPath !== ":memory:") {
       ensureDir(DATA_DIR2);
     }
-    this.db = new Database(dbPath, { create: true, readwrite: true });
-    this.db.run("PRAGMA journal_mode = WAL");
-    this.db.run("PRAGMA synchronous = NORMAL");
-    this.db.run("PRAGMA foreign_keys = ON");
-    this.db.run("PRAGMA temp_store = memory");
-    this.db.run(`PRAGMA mmap_size = ${SQLITE_MMAP_SIZE_BYTES}`);
-    this.db.run(`PRAGMA cache_size = ${SQLITE_CACHE_SIZE_PAGES}`);
+    this._db = new Database(dbPath, { create: true, readwrite: true });
+    this._db.run("PRAGMA journal_mode = WAL");
+    this._db.run("PRAGMA busy_timeout = 5000");
+    this._db.run("PRAGMA synchronous = NORMAL");
+    this._db.run("PRAGMA foreign_keys = ON");
+    this._db.run("PRAGMA temp_store = memory");
+    this._db.run(`PRAGMA mmap_size = ${SQLITE_MMAP_SIZE_BYTES}`);
+    this._db.run(`PRAGMA cache_size = ${SQLITE_CACHE_SIZE_PAGES}`);
     if (!skipMigrations) {
-      const migrationRunner = new MigrationRunner(this.db);
+      const migrationRunner = new MigrationRunner(this._db);
       migrationRunner.runAllMigrations();
     }
   }
   /**
-   * Esegue una funzione all'interno di una transazione atomica.
-   * Se fn() lancia un errore, la transazione viene annullata automaticamente.
+   * Prepare a query (delegates to underlying Database).
+   * Proxy method to avoid ctx.db.db.query() double access.
+   */
+  query(sql) {
+    return this._db.query(sql);
+  }
+  /**
+   * Execute a SQL statement without results (delegates to underlying Database).
+   * Proxy method to avoid ctx.db.db.run() double access.
+   */
+  run(sql, params) {
+    return this._db.run(sql, params);
+  }
+  /**
+   * Executes a function within an atomic transaction.
+   * If fn() throws an error, the transaction is automatically rolled back.
    */
   withTransaction(fn) {
-    const transaction = this.db.transaction(fn);
-    return transaction(this.db);
+    const transaction = this._db.transaction(fn);
+    return transaction(this._db);
   }
   /**
    * Close the database connection
    */
   close() {
-    this.db.close();
+    this._db.close();
   }
 };
 var MigrationRunner = class {
@@ -1160,11 +1506,104 @@ var MigrationRunner = class {
           db.run("CREATE INDEX IF NOT EXISTS idx_summaries_project_epoch ON summaries(project, created_at_epoch DESC)");
           db.run("CREATE INDEX IF NOT EXISTS idx_prompts_project_epoch ON prompts(project, created_at_epoch DESC)");
         }
+      },
+      {
+        version: 10,
+        up: (db) => {
+          db.run(`
+            CREATE TABLE IF NOT EXISTS job_queue (
+              id INTEGER PRIMARY KEY AUTOINCREMENT,
+              type TEXT NOT NULL,
+              status TEXT NOT NULL DEFAULT 'pending',
+              payload TEXT,
+              result TEXT,
+              error TEXT,
+              retry_count INTEGER DEFAULT 0,
+              max_retries INTEGER DEFAULT 3,
+              priority INTEGER DEFAULT 0,
+              created_at TEXT NOT NULL,
+              created_at_epoch INTEGER NOT NULL,
+              started_at_epoch INTEGER,
+              completed_at_epoch INTEGER
+            )
+          `);
+          db.run("CREATE INDEX IF NOT EXISTS idx_jobs_status ON job_queue(status)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_jobs_type ON job_queue(type)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_jobs_priority ON job_queue(status, priority DESC, created_at_epoch ASC)");
+        }
+      },
+      {
+        version: 11,
+        up: (db) => {
+          db.run("ALTER TABLE observations ADD COLUMN auto_category TEXT");
+          db.run("CREATE INDEX IF NOT EXISTS idx_observations_category ON observations(auto_category)");
+        }
+      },
+      {
+        version: 12,
+        up: (db) => {
+          db.run(`
+            CREATE TABLE IF NOT EXISTS github_links (
+              id INTEGER PRIMARY KEY AUTOINCREMENT,
+              observation_id INTEGER,
+              session_id TEXT,
+              repo TEXT NOT NULL,
+              issue_number INTEGER,
+              pr_number INTEGER,
+              event_type TEXT NOT NULL,
+              action TEXT,
+              title TEXT,
+              url TEXT,
+              author TEXT,
+              created_at TEXT NOT NULL,
+              created_at_epoch INTEGER NOT NULL,
+              FOREIGN KEY (observation_id) REFERENCES observations(id)
+            )
+          `);
+          db.run("CREATE INDEX IF NOT EXISTS idx_github_links_repo ON github_links(repo)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_github_links_obs ON github_links(observation_id)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_github_links_event ON github_links(event_type)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_github_links_repo_issue ON github_links(repo, issue_number)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_github_links_repo_pr ON github_links(repo, pr_number)");
+        }
+      },
+      {
+        version: 13,
+        up: (db) => {
+          db.run("CREATE INDEX IF NOT EXISTS idx_observations_keyset ON observations(created_at_epoch DESC, id DESC)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_observations_project_keyset ON observations(project, created_at_epoch DESC, id DESC)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_summaries_keyset ON summaries(created_at_epoch DESC, id DESC)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_summaries_project_keyset ON summaries(project, created_at_epoch DESC, id DESC)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_prompts_keyset ON prompts(created_at_epoch DESC, id DESC)");
+          db.run("CREATE INDEX IF NOT EXISTS idx_prompts_project_keyset ON prompts(project, created_at_epoch DESC, id DESC)");
+        }
       }
     ];
   }
 };
 
+// src/services/sqlite/cursor.ts
+function encodeCursor(id, epoch) {
+  const raw = `${epoch}:${id}`;
+  return Buffer.from(raw, "utf8").toString("base64url");
+}
+function decodeCursor(cursor) {
+  try {
+    const raw = Buffer.from(cursor, "base64url").toString("utf8");
+    const colonIdx = raw.indexOf(":");
+    if (colonIdx === -1) return null;
+    const epochStr = raw.substring(0, colonIdx);
+    const idStr = raw.substring(colonIdx + 1);
+    const epoch = parseInt(epochStr, 10);
+    const id = parseInt(idStr, 10);
+    if (!Number.isInteger(epoch) || epoch <= 0) return null;
+    if (!Number.isInteger(id) || id <= 0) return null;
+    return { epoch, id };
+  } catch {
+    return null;
+  }
+}
+
 // src/services/sqlite/Sessions.ts
 function createSession(db, contentSessionId, project, userPrompt) {
   const now = /* @__PURE__ */ new Date();
@@ -1208,16 +1647,16 @@ function createSummary(db, sessionId, project, request, investigated, learned, c
 }
 function getSummariesByProject(db, project, limit = 50) {
   const query = db.query(
-    "SELECT * FROM summaries WHERE project = ? ORDER BY created_at_epoch DESC LIMIT ?"
+    "SELECT * FROM summaries WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?"
   );
   return query.all(project, limit);
 }
 function searchSummaries(db, searchTerm, project) {
   const sql = project ? `SELECT * FROM summaries
        WHERE project = ? AND (request LIKE ? ESCAPE '\\' OR learned LIKE ? ESCAPE '\\' OR completed LIKE ? ESCAPE '\\' OR notes LIKE ? ESCAPE '\\')
-       ORDER BY created_at_epoch DESC` : `SELECT * FROM summaries
+       ORDER BY created_at_epoch DESC, id DESC` : `SELECT * FROM summaries
        WHERE request LIKE ? ESCAPE '\\' OR learned LIKE ? ESCAPE '\\' OR completed LIKE ? ESCAPE '\\' OR notes LIKE ? ESCAPE '\\'
-       ORDER BY created_at_epoch DESC`;
+       ORDER BY created_at_epoch DESC, id DESC`;
   const pattern = `%${escapeLikePattern2(searchTerm)}%`;
   const query = db.query(sql);
   if (project) {
@@ -1239,7 +1678,7 @@ function createPrompt(db, contentSessionId, project, promptNumber, promptText) {
 }
 function getPromptsByProject(db, project, limit = 100) {
   const query = db.query(
-    "SELECT * FROM prompts WHERE project = ? ORDER BY created_at_epoch DESC LIMIT ?"
+    "SELECT * FROM prompts WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?"
   );
   return query.all(project, limit);
 }
@@ -1267,13 +1706,13 @@ function createCheckpoint(db, sessionId, project, data) {
 }
 function getLatestCheckpoint(db, sessionId) {
   const query = db.query(
-    "SELECT * FROM checkpoints WHERE session_id = ? ORDER BY created_at_epoch DESC LIMIT 1"
+    "SELECT * FROM checkpoints WHERE session_id = ? ORDER BY created_at_epoch DESC, id DESC LIMIT 1"
   );
   return query.get(sessionId);
 }
 function getLatestCheckpointByProject(db, project) {
   const query = db.query(
-    "SELECT * FROM checkpoints WHERE project = ? ORDER BY created_at_epoch DESC LIMIT 1"
+    "SELECT * FROM checkpoints WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT 1"
   );
   return query.get(project);
 }
@@ -1335,9 +1774,9 @@ function getReportData(db, project, startEpoch, endEpoch) {
   const staleCount = (project ? db.query(staleSql).get(project, startEpoch, endEpoch)?.count : db.query(staleSql).get(startEpoch, endEpoch)?.count) || 0;
   const summarySql = project ? `SELECT learned, completed, next_steps FROM summaries
        WHERE project = ? AND created_at_epoch >= ? AND created_at_epoch <= ?
-       ORDER BY created_at_epoch DESC` : `SELECT learned, completed, next_steps FROM summaries
+       ORDER BY created_at_epoch DESC, id DESC` : `SELECT learned, completed, next_steps FROM summaries
        WHERE created_at_epoch >= ? AND created_at_epoch <= ?
-       ORDER BY created_at_epoch DESC`;
+       ORDER BY created_at_epoch DESC, id DESC`;
   const summaryRows = project ? db.query(summarySql).all(project, startEpoch, endEpoch) : db.query(summarySql).all(startEpoch, endEpoch);
   const topLearnings = [];
   const completedTasks = [];
@@ -1402,20 +1841,61 @@ function getReportData(db, project, startEpoch, endEpoch) {
 // src/services/sqlite/index.ts
 init_Search();
 
+// src/types/worker-types.ts
+var KNOWLEDGE_TYPES = ["constraint", "decision", "heuristic", "rejected"];
+
+// src/services/sqlite/Retention.ts
+var KNOWLEDGE_TYPE_LIST = KNOWLEDGE_TYPES;
+var KNOWLEDGE_PLACEHOLDERS = KNOWLEDGE_TYPE_LIST.map(() => "?").join(", ");
+
 // src/sdk/index.ts
 init_Observations();
 import { createHash } from "crypto";
 init_Search();
 
 // src/services/search/EmbeddingService.ts
+var MODEL_CONFIGS = {
+  "all-MiniLM-L6-v2": {
+    modelId: "Xenova/all-MiniLM-L6-v2",
+    dimensions: 384
+  },
+  "jina-code-v2": {
+    modelId: "jinaai/jina-embeddings-v2-base-code",
+    dimensions: 768
+  },
+  "bge-small-en": {
+    modelId: "BAAI/bge-small-en-v1.5",
+    dimensions: 384
+  }
+};
+var FASTEMBED_COMPATIBLE_MODELS = /* @__PURE__ */ new Set(["all-MiniLM-L6-v2", "bge-small-en"]);
 var EmbeddingService = class {
   provider = null;
   model = null;
   initialized = false;
   initializing = null;
+  config;
+  configName;
+  constructor() {
+    const envModel = process.env.KIRO_MEMORY_EMBEDDING_MODEL || "all-MiniLM-L6-v2";
+    this.configName = envModel;
+    if (MODEL_CONFIGS[envModel]) {
+      this.config = MODEL_CONFIGS[envModel];
+    } else if (envModel.includes("/")) {
+      const dimensions = parseInt(process.env.KIRO_MEMORY_EMBEDDING_DIMENSIONS || "384", 10);
+      this.config = {
+        modelId: envModel,
+        dimensions: isNaN(dimensions) ? 384 : dimensions
+      };
+    } else {
+      logger.warn("EMBEDDING", `Unknown model name '${envModel}', falling back to 'all-MiniLM-L6-v2'`);
+      this.configName = "all-MiniLM-L6-v2";
+      this.config = MODEL_CONFIGS["all-MiniLM-L6-v2"];
+    }
+  }
   /**
-   * Inizializza il servizio di embedding.
-   * Tenta fastembed, poi @huggingface/transformers, poi fallback a null.
+   * Initialize the embedding service.
+   * Tries fastembed (when compatible), then @huggingface/transformers, then falls back to null.
    */
   async initialize() {
     if (this.initialized) return this.provider !== null;
@@ -1426,45 +1906,48 @@ var EmbeddingService = class {
     return result;
   }
   async _doInitialize() {
-    try {
-      const fastembed = await import("fastembed");
-      const EmbeddingModel = fastembed.EmbeddingModel || fastembed.default?.EmbeddingModel;
-      const FlagEmbedding = fastembed.FlagEmbedding || fastembed.default?.FlagEmbedding;
-      if (FlagEmbedding && EmbeddingModel) {
-        this.model = await FlagEmbedding.init({
-          model: EmbeddingModel.BGESmallENV15
-        });
-        this.provider = "fastembed";
-        this.initialized = true;
-        logger.info("EMBEDDING", "Inizializzato con fastembed (BGE-small-en-v1.5)");
-        return true;
+    const fastembedCompatible = FASTEMBED_COMPATIBLE_MODELS.has(this.configName);
+    if (fastembedCompatible) {
+      try {
+        const fastembed = await import("fastembed");
+        const EmbeddingModel = fastembed.EmbeddingModel || fastembed.default?.EmbeddingModel;
+        const FlagEmbedding = fastembed.FlagEmbedding || fastembed.default?.FlagEmbedding;
+        if (FlagEmbedding && EmbeddingModel) {
+          this.model = await FlagEmbedding.init({
+            model: EmbeddingModel.BGESmallENV15
+          });
+          this.provider = "fastembed";
+          this.initialized = true;
+          logger.info("EMBEDDING", `Initialized with fastembed (BGE-small-en-v1.5) for model '${this.configName}'`);
+          return true;
+        }
+      } catch (error) {
+        logger.debug("EMBEDDING", `fastembed not available: ${error}`);
       }
-    } catch (error) {
-      logger.debug("EMBEDDING", `fastembed non disponibile: ${error}`);
     }
     try {
       const transformers = await import("@huggingface/transformers");
       const pipeline = transformers.pipeline || transformers.default?.pipeline;
       if (pipeline) {
-        this.model = await pipeline("feature-extraction", "Xenova/all-MiniLM-L6-v2", {
+        this.model = await pipeline("feature-extraction", this.config.modelId, {
           quantized: true
         });
         this.provider = "transformers";
         this.initialized = true;
-        logger.info("EMBEDDING", "Inizializzato con @huggingface/transformers (all-MiniLM-L6-v2)");
+        logger.info("EMBEDDING", `Initialized with @huggingface/transformers (${this.config.modelId})`);
         return true;
       }
     } catch (error) {
-      logger.debug("EMBEDDING", `@huggingface/transformers non disponibile: ${error}`);
+      logger.debug("EMBEDDING", `@huggingface/transformers not available: ${error}`);
     }
     this.provider = null;
     this.initialized = true;
-    logger.warn("EMBEDDING", "Nessun provider embedding disponibile, ricerca semantica disabilitata");
+    logger.warn("EMBEDDING", "No embedding provider available, semantic search disabled");
     return false;
   }
   /**
-   * Genera embedding per un singolo testo.
-   * Ritorna Float32Array con 384 dimensioni, o null se non disponibile.
+   * Generate embedding for a single text.
+   * Returns Float32Array with configured dimensions, or null if not available.
    */
   async embed(text) {
     if (!this.initialized) await this.initialize();
@@ -1477,46 +1960,118 @@ var EmbeddingService = class {
         return await this._embedTransformers(truncated);
       }
     } catch (error) {
-      logger.error("EMBEDDING", `Errore generazione embedding: ${error}`);
+      logger.error("EMBEDDING", `Error generating embedding: ${error}`);
     }
     return null;
   }
   /**
-   * Genera embeddings in batch.
+   * Generate embeddings in batch.
+   * Uses native batch support when available (fastembed, transformers),
+   * falls back to serial processing on batch failure.
    */
   async embedBatch(texts) {
     if (!this.initialized) await this.initialize();
     if (!this.provider || !this.model) return texts.map(() => null);
-    const results = [];
-    for (const text of texts) {
-      try {
-        const embedding = await this.embed(text);
-        results.push(embedding);
-      } catch {
-        results.push(null);
+    if (texts.length === 0) return [];
+    const truncated = texts.map((t) => t.substring(0, 2e3));
+    try {
+      if (this.provider === "fastembed") {
+        return await this._embedBatchFastembed(truncated);
+      } else if (this.provider === "transformers") {
+        return await this._embedBatchTransformers(truncated);
       }
+    } catch (error) {
+      logger.warn("EMBEDDING", `Batch embedding failed, falling back to serial: ${error}`);
     }
-    return results;
+    return this._embedBatchSerial(truncated);
   }
   /**
-   * Verifica se il servizio è disponibile.
+   * Check if the service is available.
    */
   isAvailable() {
     return this.initialized && this.provider !== null;
   }
   /**
-   * Nome del provider attivo.
+   * Name of the active provider.
    */
   getProvider() {
     return this.provider;
   }
   /**
-   * Dimensioni del vettore embedding.
+   * Embedding vector dimensions for the active model configuration.
    */
   getDimensions() {
-    return 384;
+    return this.config.dimensions;
+  }
+  /**
+   * Human-readable model name used as identifier in the observation_embeddings table.
+   * Returns the short name (e.g., 'all-MiniLM-L6-v2') or the full HF model ID for custom models.
+   */
+  getModelName() {
+    return this.configName;
+  }
+  // --- Batch implementations ---
+  /**
+   * Native batch embedding with fastembed.
+   * FlagEmbedding.embed() accepts string[] and returns an async iterable of batches.
+   */
+  async _embedBatchFastembed(texts) {
+    const results = [];
+    const embeddings = this.model.embed(texts, texts.length);
+    for await (const batch of embeddings) {
+      if (batch) {
+        for (const vec of batch) {
+          results.push(vec instanceof Float32Array ? vec : new Float32Array(vec));
+        }
+      }
+    }
+    while (results.length < texts.length) {
+      results.push(null);
+    }
+    return results;
   }
-  // --- Provider specifici ---
+  /**
+   * Batch embedding with @huggingface/transformers pipeline.
+   * The pipeline accepts string[] and returns a Tensor with shape [N, dims].
+   */
+  async _embedBatchTransformers(texts) {
+    const output = await this.model(texts, {
+      pooling: "mean",
+      normalize: true
+    });
+    if (!output?.data) {
+      return texts.map(() => null);
+    }
+    const dims = this.getDimensions();
+    const data = output.data instanceof Float32Array ? output.data : new Float32Array(output.data);
+    const results = [];
+    for (let i = 0; i < texts.length; i++) {
+      const offset = i * dims;
+      if (offset + dims <= data.length) {
+        results.push(data.slice(offset, offset + dims));
+      } else {
+        results.push(null);
+      }
+    }
+    return results;
+  }
+  /**
+   * Serial fallback: embed texts one at a time.
+   * Used when native batch fails.
+   */
+  async _embedBatchSerial(texts) {
+    const results = [];
+    for (const text of texts) {
+      try {
+        const embedding = await this.embed(text);
+        results.push(embedding);
+      } catch {
+        results.push(null);
+      }
+    }
+    return results;
+  }
+  // --- Single-text provider implementations ---
   async _embedFastembed(text) {
     const embeddings = this.model.embed([text], 1);
     for await (const batch of embeddings) {
@@ -1547,17 +2102,21 @@ function getEmbeddingService() {
 }
 
 // src/services/search/VectorSearch.ts
+var DEFAULT_MAX_CANDIDATES = 2e3;
 function cosineSimilarity(a, b) {
-  if (a.length !== b.length) return 0;
+  const len = a.length;
+  if (len !== b.length) return 0;
   let dotProduct = 0;
   let normA = 0;
   let normB = 0;
-  for (let i = 0; i < a.length; i++) {
-    dotProduct += a[i] * b[i];
-    normA += a[i] * a[i];
-    normB += b[i] * b[i];
-  }
-  const denominator = Math.sqrt(normA) * Math.sqrt(normB);
+  for (let i = 0; i < len; i++) {
+    const ai = a[i];
+    const bi = b[i];
+    dotProduct += ai * bi;
+    normA += ai * ai;
+    normB += bi * bi;
+  }
+  const denominator = Math.sqrt(normA * normB);
   if (denominator === 0) return 0;
   return dotProduct / denominator;
 }
@@ -1570,23 +2129,36 @@ function bufferToFloat32(buf) {
 }
 var VectorSearch = class {
   /**
-   * Ricerca semantica: calcola cosine similarity tra query e tutti gli embeddings.
+   * Semantic search with SQL pre-filtering for scalability.
+   *
+   * 2-phase strategy:
+   * 1. SQL pre-filters by project + sorts by recency (loads max N candidates)
+   * 2. JS computes cosine similarity only on filtered candidates
+   *
+   * With 50k observations and maxCandidates=2000, loads only ~4% of data.
    */
   async search(db, queryEmbedding, options = {}) {
     const limit = options.limit || 10;
     const threshold = options.threshold || 0.3;
+    const maxCandidates = options.maxCandidates || DEFAULT_MAX_CANDIDATES;
     try {
-      let sql = `
+      const conditions = [];
+      const params = [];
+      if (options.project) {
+        conditions.push("o.project = ?");
+        params.push(options.project);
+      }
+      const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+      const sql = `
         SELECT e.observation_id, e.embedding,
                o.title, o.text, o.type, o.project, o.created_at, o.created_at_epoch
         FROM observation_embeddings e
         JOIN observations o ON o.id = e.observation_id
+        ${whereClause}
+        ORDER BY o.created_at_epoch DESC
+        LIMIT ?
       `;
-      const params = [];
-      if (options.project) {
-        sql += " WHERE o.project = ?";
-        params.push(options.project);
-      }
+      params.push(maxCandidates);
       const rows = db.query(sql).all(...params);
       const scored = [];
       for (const row of rows) {
@@ -1607,14 +2179,15 @@ var VectorSearch = class {
         }
       }
       scored.sort((a, b) => b.similarity - a.similarity);
+      logger.debug("VECTOR", `Search: ${rows.length} candidates \u2192 ${scored.length} above threshold \u2192 ${Math.min(scored.length, limit)} results`);
       return scored.slice(0, limit);
     } catch (error) {
-      logger.error("VECTOR", `Errore ricerca vettoriale: ${error}`);
+      logger.error("VECTOR", `Vector search error: ${error}`);
       return [];
     }
   }
   /**
-   * Salva embedding per un'osservazione.
+   * Store embedding for an observation.
    */
   async storeEmbedding(db, observationId, embedding, model) {
     try {
@@ -1630,18 +2203,18 @@ var VectorSearch = class {
         embedding.length,
         (/* @__PURE__ */ new Date()).toISOString()
       );
-      logger.debug("VECTOR", `Embedding salvato per osservazione ${observationId}`);
+      logger.debug("VECTOR", `Embedding saved for observation ${observationId}`);
     } catch (error) {
-      logger.error("VECTOR", `Errore salvataggio embedding: ${error}`);
+      logger.error("VECTOR", `Error saving embedding: ${error}`);
     }
   }
   /**
-   * Genera embeddings per osservazioni che non li hanno ancora.
+   * Generate embeddings for observations that don't have them yet.
    */
   async backfillEmbeddings(db, batchSize = 50) {
     const embeddingService2 = getEmbeddingService();
     if (!await embeddingService2.initialize()) {
-      logger.warn("VECTOR", "Embedding service non disponibile, backfill saltato");
+      logger.warn("VECTOR", "Embedding service not available, backfill skipped");
       return 0;
     }
     const rows = db.query(`
@@ -1654,7 +2227,7 @@ var VectorSearch = class {
     `).all(batchSize);
     if (rows.length === 0) return 0;
     let count = 0;
-    const model = embeddingService2.getProvider() || "unknown";
+    const model = embeddingService2.getModelName();
     for (const row of rows) {
       const parts = [row.title];
       if (row.text) parts.push(row.text);
@@ -1667,11 +2240,11 @@ var VectorSearch = class {
         count++;
       }
     }
-    logger.info("VECTOR", `Backfill completato: ${count}/${rows.length} embeddings generati`);
+    logger.info("VECTOR", `Backfill completed: ${count}/${rows.length} embeddings generated`);
     return count;
   }
   /**
-   * Statistiche sugli embeddings.
+   * Embedding statistics.
    */
   getStats(db) {
     try {
@@ -1698,21 +2271,21 @@ function getVectorSearch() {
 var HybridSearch = class {
   embeddingInitialized = false;
   /**
-   * Inizializza il servizio di embedding (lazy, non bloccante)
+   * Initialize the embedding service (lazy, non-blocking)
    */
   async initialize() {
     try {
       const embeddingService2 = getEmbeddingService();
       await embeddingService2.initialize();
       this.embeddingInitialized = embeddingService2.isAvailable();
-      logger.info("SEARCH", `HybridSearch inizializzato (embedding: ${this.embeddingInitialized ? "attivo" : "disattivato"})`);
+      logger.info("SEARCH", `HybridSearch initialized (embedding: ${this.embeddingInitialized ? "active" : "disabled"})`);
     } catch (error) {
-      logger.warn("SEARCH", "Inizializzazione embedding fallita, uso solo FTS5", {}, error);
+      logger.warn("SEARCH", "Embedding initialization failed, using only FTS5", {}, error);
       this.embeddingInitialized = false;
     }
   }
   /**
-   * Ricerca ibrida con scoring a 4 segnali
+   * Hybrid search with 4-signal scoring
    */
   async search(db, query, options = {}) {
     const limit = options.limit || 10;
@@ -1728,7 +2301,7 @@ var HybridSearch = class {
           const vectorResults = await vectorSearch2.search(db, queryEmbedding, {
             project: options.project,
             limit: limit * 2,
-            // Prendiamo piu risultati per il ranking
+            // Fetch more results for ranking
             threshold: 0.3
           });
           for (const hit of vectorResults) {
@@ -1745,10 +2318,10 @@ var HybridSearch = class {
               source: "vector"
             });
           }
-          logger.debug("SEARCH", `Vector search: ${vectorResults.length} risultati`);
+          logger.debug("SEARCH", `Vector search: ${vectorResults.length} results`);
         }
       } catch (error) {
-        logger.warn("SEARCH", "Ricerca vettoriale fallita, uso solo keyword", {}, error);
+        logger.warn("SEARCH", "Vector search failed, using only keyword", {}, error);
       }
     }
     try {
@@ -1778,9 +2351,9 @@ var HybridSearch = class {
           });
         }
       }
-      logger.debug("SEARCH", `Keyword search: ${keywordResults.length} risultati`);
+      logger.debug("SEARCH", `Keyword search: ${keywordResults.length} results`);
     } catch (error) {
-      logger.error("SEARCH", "Ricerca keyword fallita", {}, error);
+      logger.error("SEARCH", "Keyword search failed", {}, error);
     }
     if (rawItems.size === 0) return [];
     const allFTS5Ranks = Array.from(rawItems.values()).filter((item) => item.fts5Rank !== null).map((item) => item.fts5Rank);
@@ -1832,9 +2405,6 @@ function getHybridSearch() {
   return hybridSearch;
 }
 
-// src/types/worker-types.ts
-var KNOWLEDGE_TYPES = ["constraint", "decision", "heuristic", "rejected"];
-
 // src/sdk/index.ts
 var KiroMemorySDK = class {
   db;
@@ -1868,33 +2438,33 @@ var KiroMemorySDK = class {
     };
   }
   /**
-   * Valida input per storeObservation
+   * Validate input for storeObservation
    */
   validateObservationInput(data) {
     if (!data.type || typeof data.type !== "string" || data.type.length > 100) {
-      throw new Error("type \xE8 obbligatorio (stringa, max 100 caratteri)");
+      throw new Error("type is required (string, max 100 chars)");
     }
     if (!data.title || typeof data.title !== "string" || data.title.length > 500) {
-      throw new Error("title \xE8 obbligatorio (stringa, max 500 caratteri)");
+      throw new Error("title is required (string, max 500 chars)");
     }
     if (!data.content || typeof data.content !== "string" || data.content.length > 1e5) {
-      throw new Error("content \xE8 obbligatorio (stringa, max 100KB)");
+      throw new Error("content is required (string, max 100KB)");
     }
   }
   /**
-   * Valida input per storeSummary
+   * Validate input for storeSummary
    */
   validateSummaryInput(data) {
     const MAX = 5e4;
     for (const [key, val] of Object.entries(data)) {
       if (val !== void 0 && val !== null) {
-        if (typeof val !== "string") throw new Error(`${key} deve essere una stringa`);
-        if (val.length > MAX) throw new Error(`${key} troppo grande (max 50KB)`);
+        if (typeof val !== "string") throw new Error(`${key} must be a string`);
+        if (val.length > MAX) throw new Error(`${key} too large (max 50KB)`);
       }
     }
   }
   /**
-   * Genera e salva embedding per un'osservazione (fire-and-forget, non blocca)
+   * Generate and store embedding for an observation (fire-and-forget, non-blocking)
    */
   async generateEmbeddingAsync(observationId, title, content, concepts) {
     try {
@@ -1914,39 +2484,39 @@ var KiroMemorySDK = class {
         );
       }
     } catch (error) {
-      logger.debug("SDK", `Embedding generation fallita per obs ${observationId}: ${error}`);
+      logger.debug("SDK", `Embedding generation failed for obs ${observationId}: ${error}`);
     }
   }
   /**
-   * Genera content hash SHA256 per deduplicazione basata su contenuto.
-   * Usa (project + type + title + narrative) come tupla di identità semantica.
-   * NON include sessionId perché è unico ad ogni invocazione.
+   * Generate SHA256 content hash for content-based deduplication.
+   * Uses (project + type + title + narrative) as semantic identity tuple.
+   * Does NOT include sessionId since it's unique per invocation.
    */
   generateContentHash(type, title, narrative) {
     const payload = `${this.project}|${type}|${title}|${narrative || ""}`;
     return createHash("sha256").update(payload).digest("hex");
   }
   /**
-   * Finestre di deduplicazione per tipo (ms).
-   * Tipi con molte ripetizioni hanno finestre più ampie.
+   * Deduplication windows per type (ms).
+   * Types with many repetitions have wider windows.
    */
   getDeduplicationWindow(type) {
     switch (type) {
       case "file-read":
         return 6e4;
-      // 60s — letture frequenti sugli stessi file
+      // 60s — frequent reads on the same files
       case "file-write":
         return 1e4;
-      // 10s — scritture rapide consecutive
+      // 10s — rapid consecutive writes
       case "command":
         return 3e4;
       // 30s — standard
       case "research":
         return 12e4;
-      // 120s — web search e fetch ripetuti
+      // 120s — repeated web search and fetch
       case "delegation":
         return 6e4;
-      // 60s — delegazioni rapide
+      // 60s — rapid delegations
       default:
         return 3e4;
     }
@@ -1960,7 +2530,7 @@ var KiroMemorySDK = class {
     const contentHash = this.generateContentHash(data.type, data.title, data.narrative);
     const dedupWindow = this.getDeduplicationWindow(data.type);
     if (isDuplicateObservation(this.db.db, contentHash, dedupWindow)) {
-      logger.debug("SDK", `Osservazione duplicata scartata (${data.type}, ${dedupWindow}ms): ${data.title}`);
+      logger.debug("SDK", `Duplicate observation discarded (${data.type}, ${dedupWindow}ms): ${data.title}`);
       return -1;
     }
     const filesRead = data.filesRead || (data.type === "file-read" ? data.files : void 0);
@@ -1988,12 +2558,12 @@ var KiroMemorySDK = class {
     return observationId;
   }
   /**
-   * Salva conoscenza strutturata (constraint, decision, heuristic, rejected).
-   * Usa il campo `type` per il knowledgeType e `facts` per i metadati JSON.
+   * Store structured knowledge (constraint, decision, heuristic, rejected).
+   * Uses the `type` field for knowledgeType and `facts` for JSON metadata.
    */
   async storeKnowledge(data) {
     if (!KNOWLEDGE_TYPES.includes(data.knowledgeType)) {
-      throw new Error(`knowledgeType non valido: ${data.knowledgeType}. Valori ammessi: ${KNOWLEDGE_TYPES.join(", ")}`);
+      throw new Error(`Invalid knowledgeType: ${data.knowledgeType}. Allowed values: ${KNOWLEDGE_TYPES.join(", ")}`);
     }
     this.validateObservationInput({ type: data.knowledgeType, title: data.title, content: data.content });
     const metadata = (() => {
@@ -2025,9 +2595,9 @@ var KiroMemorySDK = class {
       }
     })();
     const sessionId = "sdk-" + Date.now();
-    const contentHash = this.generateContentHash(data.type, data.title);
+    const contentHash = this.generateContentHash(data.knowledgeType, data.title);
     if (isDuplicateObservation(this.db.db, contentHash)) {
-      logger.debug("SDK", `Knowledge duplicata scartata: ${data.title}`);
+      logger.debug("SDK", `Duplicate knowledge discarded: ${data.title}`);
       return -1;
     }
     const discoveryTokens = Math.ceil(data.content.length / 4);
@@ -2044,11 +2614,11 @@ var KiroMemorySDK = class {
       null,
       // narrative
       JSON.stringify(metadata),
-      // facts = metadati JSON
+      // facts = JSON metadata
       data.concepts?.join(", ") || null,
       data.files?.join(", ") || null,
       null,
-      // filesModified: knowledge non modifica file
+      // filesModified: knowledge doesn't modify files
       0,
       // prompt_number
       contentHash,
@@ -2159,8 +2729,8 @@ var KiroMemorySDK = class {
     return this.project;
   }
   /**
-   * Ricerca ibrida: vector search + keyword FTS5
-   * Richiede inizializzazione HybridSearch (embedding service)
+   * Hybrid search: vector search + keyword FTS5
+   * Requires HybridSearch initialization (embedding service)
    */
   async hybridSearch(query, options = {}) {
     const hybridSearch2 = getHybridSearch();
@@ -2170,8 +2740,8 @@ var KiroMemorySDK = class {
     });
   }
   /**
-   * Ricerca solo semantica (vector search)
-   * Ritorna risultati basati su similarità coseno con gli embeddings
+   * Semantic-only search (vector search)
+   * Returns results based on cosine similarity with embeddings
    */
   async semanticSearch(query, options = {}) {
     const embeddingService2 = getEmbeddingService();
@@ -2206,21 +2776,21 @@ var KiroMemorySDK = class {
     }));
   }
   /**
-   * Genera embeddings per osservazioni che non li hanno ancora
+   * Generate embeddings for observations that don't have them yet
    */
   async backfillEmbeddings(batchSize = 50) {
     const vectorSearch2 = getVectorSearch();
     return vectorSearch2.backfillEmbeddings(this.db.db, batchSize);
   }
   /**
-   * Statistiche sugli embeddings nel database
+   * Embedding statistics in the database
    */
   getEmbeddingStats() {
     const vectorSearch2 = getVectorSearch();
     return vectorSearch2.getStats(this.db.db);
   }
   /**
-   * Inizializza il servizio di embedding (lazy, chiamare prima di hybridSearch)
+   * Initialize the embedding service (lazy, call before hybridSearch)
    */
   async initializeEmbeddings() {
     const hybridSearch2 = getHybridSearch();
@@ -2228,10 +2798,10 @@ var KiroMemorySDK = class {
     return getEmbeddingService().isAvailable();
   }
   /**
-   * Contesto smart con ranking a 4 segnali e budget token.
+   * Smart context with 4-signal ranking and token budget.
    *
-   * Se query presente: usa HybridSearch con SEARCH_WEIGHTS.
-   * Se senza query: ranking per recency + project match (CONTEXT_WEIGHTS).
+   * If query present: uses HybridSearch with SEARCH_WEIGHTS.
+   * If no query: ranking by recency + project match (CONTEXT_WEIGHTS).
    */
   async getSmartContext(options = {}) {
     const tokenBudget = options.tokenBudget || parseInt(process.env.KIRO_MEMORY_CONTEXT_TOKENS || "0", 10) || 2e3;
@@ -2305,8 +2875,8 @@ var KiroMemorySDK = class {
     };
   }
   /**
-   * Rileva osservazioni stale (file modificati dopo la creazione) e le marca nel DB.
-   * Ritorna il numero di osservazioni marcate come stale.
+   * Detect stale observations (files modified after creation) and mark them in DB.
+   * Returns the number of observations marked as stale.
    */
   async detectStaleObservations() {
     const staleObs = getStaleObservations(this.db.db, this.project);
@@ -2317,14 +2887,14 @@ var KiroMemorySDK = class {
     return staleObs.length;
   }
   /**
-   * Consolida osservazioni duplicate sullo stesso file e tipo.
-   * Raggruppa per (project, type, files_modified), mantiene la piu recente.
+   * Consolidate duplicate observations on the same file and type.
+   * Groups by (project, type, files_modified), keeps the most recent.
    */
   async consolidateObservations(options = {}) {
     return consolidateObservations(this.db.db, this.project, options);
   }
   /**
-   * Statistiche decay: totale, stale, mai accedute, accedute di recente.
+   * Decay statistics: total, stale, never accessed, recently accessed.
    */
   async getDecayStats() {
     const total = this.db.db.query(
@@ -2343,8 +2913,8 @@ var KiroMemorySDK = class {
     return { total, stale, neverAccessed, recentlyAccessed };
   }
   /**
-   * Crea un checkpoint strutturato per resume sessione.
-   * Salva automaticamente un context_snapshot con le ultime 10 osservazioni.
+   * Create a structured checkpoint for session resume.
+   * Automatically saves a context_snapshot with the last 10 observations.
    */
   async createCheckpoint(sessionId, data) {
     const recentObs = getObservationsByProject(this.db.db, this.project, 10);
@@ -2361,21 +2931,21 @@ var KiroMemorySDK = class {
     });
   }
   /**
-   * Recupera l'ultimo checkpoint di una sessione specifica.
+   * Retrieve the latest checkpoint of a specific session.
    */
   async getCheckpoint(sessionId) {
     return getLatestCheckpoint(this.db.db, sessionId);
   }
   /**
-   * Recupera l'ultimo checkpoint per il progetto corrente.
-   * Utile per resume automatico senza specificare session ID.
+   * Retrieve the latest checkpoint for the current project.
+   * Useful for automatic resume without specifying session ID.
    */
   async getLatestProjectCheckpoint() {
     return getLatestCheckpointByProject(this.db.db, this.project);
   }
   /**
-   * Genera un report di attività per il progetto corrente.
-   * Aggrega osservazioni, sessioni, summaries e file per un periodo temporale.
+   * Generate an activity report for the current project.
+   * Aggregates observations, sessions, summaries and files for a time period.
    */
   async generateReport(options) {
     const now = /* @__PURE__ */ new Date();
@@ -2391,6 +2961,66 @@ var KiroMemorySDK = class {
     }
     return getReportData(this.db.db, this.project, startEpoch, endEpoch);
   }
+  /**
+   * Lista osservazioni con keyset pagination.
+   * Restituisce un oggetto { data, next_cursor, has_more }.
+   *
+   * Esempio:
+   *   const page1 = await sdk.listObservations({ limit: 50 });
+   *   const page2 = await sdk.listObservations({ cursor: page1.next_cursor });
+   */
+  async listObservations(options = {}) {
+    const limit = Math.min(Math.max(options.limit ?? 50, 1), 200);
+    const project = options.project ?? this.project;
+    let rows;
+    if (options.cursor) {
+      const decoded = decodeCursor(options.cursor);
+      if (!decoded) throw new Error("Cursor non valido");
+      const sql = project ? `SELECT * FROM observations
+           WHERE project = ? AND (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+           ORDER BY created_at_epoch DESC, id DESC
+           LIMIT ?` : `SELECT * FROM observations
+           WHERE (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+           ORDER BY created_at_epoch DESC, id DESC
+           LIMIT ?`;
+      rows = project ? this.db.db.query(sql).all(project, decoded.epoch, decoded.epoch, decoded.id, limit) : this.db.db.query(sql).all(decoded.epoch, decoded.epoch, decoded.id, limit);
+    } else {
+      const sql = project ? "SELECT * FROM observations WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?" : "SELECT * FROM observations ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
+      rows = project ? this.db.db.query(sql).all(project, limit) : this.db.db.query(sql).all(limit);
+    }
+    const next_cursor = rows.length >= limit ? encodeCursor(rows[rows.length - 1].id, rows[rows.length - 1].created_at_epoch) : null;
+    return { data: rows, next_cursor, has_more: next_cursor !== null };
+  }
+  /**
+   * Lista sommari con keyset pagination.
+   * Restituisce un oggetto { data, next_cursor, has_more }.
+   *
+   * Esempio:
+   *   const page1 = await sdk.listSummaries({ limit: 20 });
+   *   const page2 = await sdk.listSummaries({ cursor: page1.next_cursor });
+   */
+  async listSummaries(options = {}) {
+    const limit = Math.min(Math.max(options.limit ?? 20, 1), 200);
+    const project = options.project ?? this.project;
+    let rows;
+    if (options.cursor) {
+      const decoded = decodeCursor(options.cursor);
+      if (!decoded) throw new Error("Cursor non valido");
+      const sql = project ? `SELECT * FROM summaries
+           WHERE project = ? AND (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+           ORDER BY created_at_epoch DESC, id DESC
+           LIMIT ?` : `SELECT * FROM summaries
+           WHERE (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+           ORDER BY created_at_epoch DESC, id DESC
+           LIMIT ?`;
+      rows = project ? this.db.db.query(sql).all(project, decoded.epoch, decoded.epoch, decoded.id, limit) : this.db.db.query(sql).all(decoded.epoch, decoded.epoch, decoded.id, limit);
+    } else {
+      const sql = project ? "SELECT * FROM summaries WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?" : "SELECT * FROM summaries ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
+      rows = project ? this.db.db.query(sql).all(project, limit) : this.db.db.query(sql).all(limit);
+    }
+    const next_cursor = rows.length >= limit ? encodeCursor(rows[rows.length - 1].id, rows[rows.length - 1].created_at_epoch) : null;
+    return { data: rows, next_cursor, has_more: next_cursor !== null };
+  }
   /**
    * Getter for direct database access (for API routes)
    */
@@ -2409,6 +3039,7 @@ function createKiroMemory(config) {
 }
 
 // src/hooks/userPromptSubmit.ts
+init_secrets();
 runHook("userPromptSubmit", async (input) => {
   const promptText = input.prompt || input.user_prompt || input.tool_input?.prompt || input.tool_input?.content;
   if (!promptText || typeof promptText !== "string" || promptText.trim().length === 0) return;
@@ -2416,7 +3047,8 @@ runHook("userPromptSubmit", async (input) => {
   const sdk = createKiroMemory({ project, skipMigrations: true });
   try {
     const sessionId = input.session_id || `kiro-${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}-${project}`;
-    await sdk.storePrompt(sessionId, Date.now(), promptText.trim());
+    const safePromptText = redactSecrets(promptText.trim());
+    await sdk.storePrompt(sessionId, Date.now(), safePromptText);
     await notifyWorker("prompt-created", { project });
     if (input.hook_event_name === "beforeSubmitPrompt") {
       process.stdout.write(JSON.stringify({ continue: true }));