pi-vault-mind 0.14.2 → 0.16.3

package/dist/src/embedding-secrets.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Embedding provider secret contract.
+ *
+ * Bridge authentication (`PVM_API_TOKEN`) and provider credentials are fully
+ * decoupled. This module owns reading, writing, resolving, masking, and
+ * status reporting for the four embedding secret kinds. All four variables are
+ * stored in `<vault>/.vault-mind/vault-mind.env`; legacy JSON config copies are
+ * removed on write.
+ */
+import type { EmbeddingSecretKind, EmbeddingSecretResolutionOptions, EmbeddingSecretStatus, EmbeddingSecretStatusResponse, PutEmbeddingSecretsRequest, PutEmbeddingSecretsResponse, UniversalConfig, VaultMindConfig } from "./types.js";
+export type { EmbeddingSecretKind, EmbeddingSecretResolutionOptions, EmbeddingSecretStatus, EmbeddingSecretStatusResponse, PutEmbeddingSecretsRequest, PutEmbeddingSecretsResponse, };
+export declare const EMBEDDING_SECRET_MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+/**
+ * Resolve one embedding secret. Precedence:
+ * 1. `options.environment` if supplied, else `process.env`
+ * 2. `<vault>/.vault-mind/vault-mind.env`
+ * 3. Matching legacy field in `cfg.embedding`
+ */
+export declare const resolveEmbeddingSecret: (cfg: VaultMindConfig, kind: EmbeddingSecretKind, opts?: EmbeddingSecretResolutionOptions) => string | undefined;
+/** Return the status of all four embedding secret kinds in declaration order. */
+export declare const readEmbeddingSecretStatus: (cfg: VaultMindConfig, opts?: EmbeddingSecretResolutionOptions) => EmbeddingSecretStatusResponse;
+/**
+ * Update a single env entry in `<vault>/.vault-mind/vault-mind.env` atomically,
+ * preserving all other entries and comments. This is the entry-preserving
+ * primitive reused by callers that only need to write one variable.
+ */
+export declare const writeEnvEntry: (key: string, value: string, opts?: EmbeddingSecretResolutionOptions) => void;
+/**
+ * Update the embedding secret store. Validation runs before any mutation. The
+ * env file is replaced atomically; if the matching legacy JSON config cleanup
+ * fails, the previous env file bytes are restored.
+ */
+export declare const writeEmbeddingSecrets: (request: PutEmbeddingSecretsRequest, opts?: EmbeddingSecretResolutionOptions) => PutEmbeddingSecretsResponse;
+/**
+ * Return a deep copy of `config` with all legacy provider credential fields
+ * replaced by the fixed mask. The original config is not mutated.
+ */
+export declare const redactEmbeddingSecrets: (config: UniversalConfig) => UniversalConfig;

package/dist/src/embedding-secrets.js

@@ -0,0 +1,291 @@
+/**
+ * Embedding provider secret contract.
+ *
+ * Bridge authentication (`PVM_API_TOKEN`) and provider credentials are fully
+ * decoupled. This module owns reading, writing, resolving, masking, and
+ * status reporting for the four embedding secret kinds. All four variables are
+ * stored in `<vault>/.vault-mind/vault-mind.env`; legacy JSON config copies are
+ * removed on write.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { getTokenEnvPath } from "./utils.js";
+const DEFINITIONS = {
+    localApiKey: { env: "PVM_LOCAL_EMBEDDING_API_KEY", legacy: "apiKey" },
+    remoteApiKey: { env: "PVM_REMOTE_EMBEDDING_API_KEY", legacy: "remoteApiKey" },
+    remoteReadApiKey: { env: "PVM_MODAL_READ_TOKEN", legacy: "remoteReadApiKey" },
+    remoteWriteApiKey: { env: "PVM_MODAL_WRITE_TOKEN", legacy: "remoteWriteApiKey" },
+};
+export const EMBEDDING_SECRET_MASK = "••••••••";
+const getEnv = (opts, key) => {
+    const env = opts?.environment ?? process.env;
+    return env[key];
+};
+const getEnvPath = (opts) => getTokenEnvPath(opts?.cwd ?? process.cwd());
+/**
+ * Parse a dotenv-style file into a record while preserving the original byte
+ * content so writes can keep comments, blank lines, and unrelated variables.
+ */
+const readDotEnv = (filePath) => {
+    if (!fs.existsSync(filePath))
+        return {};
+    const out = {};
+    for (const line of fs.readFileSync(filePath, "utf-8").split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq === -1)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        let value = trimmed.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+};
+/**
+ * Resolve one embedding secret. Precedence:
+ * 1. `options.environment` if supplied, else `process.env`
+ * 2. `<vault>/.vault-mind/vault-mind.env`
+ * 3. Matching legacy field in `cfg.embedding`
+ */
+export const resolveEmbeddingSecret = (cfg, kind, opts) => {
+    const def = DEFINITIONS[kind];
+    const fromEnv = getEnv(opts, def.env);
+    if (fromEnv)
+        return fromEnv;
+    const fromStore = readDotEnv(getEnvPath(opts))[def.env];
+    if (fromStore)
+        return fromStore;
+    return cfg.embedding[def.legacy];
+};
+const getSecretSource = (cfg, kind, envRecord, opts) => {
+    const def = DEFINITIONS[kind];
+    if (getEnv(opts, def.env))
+        return "extension-environment";
+    if (envRecord[def.env])
+        return "extension-secret-store";
+    if (cfg.embedding[def.legacy])
+        return "legacy-config";
+    return "none";
+};
+/** Return the status of all four embedding secret kinds in declaration order. */
+export const readEmbeddingSecretStatus = (cfg, opts) => {
+    const kinds = [
+        "localApiKey",
+        "remoteApiKey",
+        "remoteReadApiKey",
+        "remoteWriteApiKey",
+    ];
+    const envRecord = readDotEnv(getEnvPath(opts));
+    return {
+        secrets: kinds.map((kind) => {
+            const source = getSecretSource(cfg, kind, envRecord, opts);
+            const configured = source !== "none";
+            return {
+                kind,
+                configured,
+                masked: configured ? EMBEDDING_SECRET_MASK : null,
+                source,
+            };
+        }),
+    };
+};
+/** Read the vault config object to use as the status baseline. */
+const readVaultMindConfig = (configPath) => {
+    try {
+        if (fs.existsSync(configPath)) {
+            const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            return raw.vaultMind ?? { dataDir: "", embedding: {} };
+        }
+    }
+    catch {
+        // fall through to empty config
+    }
+    return { dataDir: "", embedding: {} };
+};
+/** True when the value is an empty string; empty values are rejected before mutation. */
+const isEmptyString = (value) => value === "";
+/** Read a dotenv-style file as a list of lines, returning an empty list when absent. */
+const readEnvLines = (filePath) => {
+    if (!fs.existsSync(filePath))
+        return [];
+    return fs.readFileSync(filePath, "utf-8").split(/\r?\n/);
+};
+/**
+ * Update or remove a single env entry while preserving all other lines
+ * (comments, blanks, unrelated variables). If the key is absent and `value` is
+ * a string, it is appended. Duplicate occurrences collapse into one update.
+ */
+const updateEnvLine = (lines, key, value) => {
+    const out = [];
+    let handled = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        const match = trimmed.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=/);
+        if (!match || match[1] !== key) {
+            out.push(line);
+            continue;
+        }
+        if (handled) {
+            // Drop duplicate occurrences of the same key.
+            continue;
+        }
+        handled = true;
+        if (value === null) {
+            // Drop the line for a null deletion.
+            continue;
+        }
+        out.push(`${key}="${value}"`);
+    }
+    if (!handled && value !== null) {
+        out.push(`${key}="${value}"`);
+    }
+    return out;
+};
+/** Atomically replace the env file using a same-directory temporary file. */
+const atomicWriteEnvFile = (envPath, lines) => {
+    let content = lines.join("\n");
+    if (!content.endsWith("\n"))
+        content += "\n";
+    const newBytes = Buffer.from(content, "utf-8");
+    const dir = path.dirname(envPath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    const tmp = path.join(dir, `.vault-mind.env.tmp-${crypto.randomBytes(8).toString("hex")}`);
+    try {
+        fs.writeFileSync(tmp, newBytes, { mode: process.platform === "win32" ? undefined : 0o600 });
+        fs.renameSync(tmp, envPath);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            // best-effort cleanup
+        }
+        throw err;
+    }
+    try {
+        if (process.platform !== "win32")
+            fs.chmodSync(envPath, 0o600);
+    }
+    catch {
+        // best-effort; no-op on win32 or when chmod is unavailable
+    }
+};
+/** Best-effort restore of previous env bytes on rollback. */
+const restoreEnv = (envPath, bytes) => {
+    try {
+        fs.writeFileSync(envPath, bytes);
+    }
+    catch {
+        // rollback is best-effort; if it fails the caller sees the original error
+    }
+};
+/**
+ * Update a single env entry in `<vault>/.vault-mind/vault-mind.env` atomically,
+ * preserving all other entries and comments. This is the entry-preserving
+ * primitive reused by callers that only need to write one variable.
+ */
+export const writeEnvEntry = (key, value, opts) => {
+    const envPath = getEnvPath(opts);
+    const lines = updateEnvLine(readEnvLines(envPath), key, value);
+    atomicWriteEnvFile(envPath, lines);
+};
+/**
+ * Update the embedding secret store. Validation runs before any mutation. The
+ * env file is replaced atomically; if the matching legacy JSON config cleanup
+ * fails, the previous env file bytes are restored.
+ */
+export const writeEmbeddingSecrets = (request, opts) => {
+    const cwd = opts?.cwd ?? process.cwd();
+    const envPath = getTokenEnvPath(cwd);
+    const configPath = path.join(path.dirname(envPath), "vault-mind.config.json");
+    // Reject empty-string values before touching disk.
+    for (const [kind, value] of Object.entries(request)) {
+        if (isEmptyString(value)) {
+            return {
+                ok: false,
+                secrets: readEmbeddingSecretStatus(readVaultMindConfig(configPath), opts).secrets,
+                error: `Empty value rejected for ${kind}`,
+            };
+        }
+    }
+    const previousBytes = fs.existsSync(envPath) ? fs.readFileSync(envPath) : Buffer.from("");
+    let currentConfig = readVaultMindConfig(configPath);
+    // Apply each requested mutation while preserving unrelated lines.
+    let updatedLines = previousBytes.toString("utf-8").split(/\r?\n/);
+    for (const kind of Object.keys(DEFINITIONS)) {
+        const value = request[kind];
+        if (value !== undefined) {
+            updatedLines = updateEnvLine(updatedLines, DEFINITIONS[kind].env, value);
+        }
+    }
+    try {
+        atomicWriteEnvFile(envPath, updatedLines);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            secrets: readEmbeddingSecretStatus(currentConfig, opts).secrets,
+            error: `Failed to write secret store: ${err}`,
+        };
+    }
+    // Clean matching legacy fields from the JSON config, if a config file exists.
+    try {
+        if (fs.existsSync(configPath)) {
+            const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+            let dirty = false;
+            for (const kind of Object.keys(DEFINITIONS)) {
+                const value = request[kind];
+                if (value === undefined)
+                    continue;
+                const legacyKey = DEFINITIONS[kind].legacy;
+                if (raw.vaultMind?.embedding?.[legacyKey] !== undefined) {
+                    delete raw.vaultMind.embedding[legacyKey];
+                    dirty = true;
+                }
+            }
+            if (dirty) {
+                fs.writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf-8");
+            }
+            if (raw.vaultMind) {
+                currentConfig = raw.vaultMind;
+            }
+        }
+    }
+    catch (err) {
+        restoreEnv(envPath, previousBytes);
+        return {
+            ok: false,
+            secrets: readEmbeddingSecretStatus(currentConfig, opts).secrets,
+            error: `Failed to clean legacy config: ${err}`,
+        };
+    }
+    return {
+        ok: true,
+        secrets: readEmbeddingSecretStatus(currentConfig, opts).secrets,
+        error: null,
+    };
+};
+/**
+ * Return a deep copy of `config` with all legacy provider credential fields
+ * replaced by the fixed mask. The original config is not mutated.
+ */
+export const redactEmbeddingSecrets = (config) => {
+    const redacted = JSON.parse(JSON.stringify(config));
+    const emb = redacted.vaultMind.embedding;
+    for (const kind of Object.keys(DEFINITIONS)) {
+        const legacyKey = DEFINITIONS[kind].legacy;
+        if (emb[legacyKey] !== undefined) {
+            emb[legacyKey] = EMBEDDING_SECRET_MASK;
+        }
+    }
+    return redacted;
+};

package/dist/src/engine.d.ts

@@ -63,3 +63,9 @@ export declare function buildIdentityFromRole(role: string, id: string): AgentId
  * an agent.
  */
 export declare function mergeIdentityProfiles(base: AgentIdentity, defaultProfile: IdentityConfig | undefined, roleProfile: IdentityConfig | undefined): AgentIdentity;
+/**
+ * Re-read identities config from disk, re-merge profiles, and re-register
+ * affected roles in the bridge's agentIdentities map. Call after config
+ * writes that touch identities.roles.
+ */
+export declare function refreshAgentIdentities(rolesToReload?: string[]): void;

package/dist/src/engine.js

@@ -140,7 +140,13 @@ export function buildIdentityFromRole(role, id) {
                     "ls",
                     "bash",
                     "vm_search",
-                    "vm_fts_search",
+                    "vault_read",
+                    "vault_search",
+                    "vault_list",
+                    "vault_tags",
+                    "vm_backlinks",
+                    "vm_related",
+                    "vm_codegraph_impact",
                 ],
                 writeCollections: [],
                 canPublish: false,
@@ -157,8 +163,13 @@ export function buildIdentityFromRole(role, id) {
                     "find",
                     "ls",
                     "vm_search",
-                    "vm_fts_search",
                     "vm_append",
+                    "vault_read",
+                    "vault_search",
+                    "vault_list",
+                    "vault_tags",
+                    "vm_backlinks",
+                    "vm_related",
                 ],
                 writeCollections: ["main", "research"],
                 canPublish: false,
@@ -167,7 +178,7 @@ export function buildIdentityFromRole(role, id) {
             return {
                 id,
                 role,
-                allowedTools: ["read", "write", "edit", "vm_search", "vm_fts_search"],
+                allowedTools: ["read", "write", "edit", "vm_search", "vault_read", "vault_search"],
                 writeCollections: [],
                 canPublish: false,
             };
@@ -183,7 +194,6 @@ export function buildIdentityFromRole(role, id) {
                     "find",
                     "ls",
                     "vm_search",
-                    "vm_fts_search",
                     "vm_append",
                     "vm_sync",
                     "vm_promote",
@@ -194,16 +204,58 @@ export function buildIdentityFromRole(role, id) {
                     "vm_export",
                     "vm_ingest",
                     "vm_status",
-                    "vm_graph_query",
+                    "vault_read",
+                    "vault_search",
+                    "vault_list",
+                    "vault_tags",
+                    "vm_backlinks",
+                    "vm_related",
+                    "vm_broken_links",
+                    "vm_codegraph_impact",
+                    "vault_write",
+                    "vault_append",
                 ],
                 writeCollections: ["main", "research", "presentations"],
                 canPublish: true,
             };
+        case "main":
+            return {
+                id,
+                role,
+                allowedTools: [
+                    "read",
+                    "write",
+                    "edit",
+                    "bash",
+                    "grep",
+                    "find",
+                    "ls",
+                    "vm_search",
+                    "vm_query",
+                    "vm_append",
+                    "vm_stats",
+                    "vm_status",
+                    "vm_describe",
+                    "vm_configure",
+                    "vault_read",
+                    "vault_search",
+                    "vault_list",
+                    "vault_tags",
+                    "vm_backlinks",
+                    "vm_related",
+                    "vm_broken_links",
+                    "vm_codegraph_impact",
+                ],
+                readCollections: ["main"],
+                writeCollections: [],
+                canPublish: false,
+                allowedVaultPaths: [],
+            };
         default:
             return {
                 id,
                 role,
-                allowedTools: ["read", "vm_search", "vm_fts_search"],
+                allowedTools: ["read", "vm_search", "vault_search"],
                 writeCollections: [],
                 canPublish: false,
             };
@@ -242,3 +294,23 @@ export function mergeIdentityProfiles(base, defaultProfile, roleProfile) {
     }
     return merged;
 }
+/**
+ * Re-read identities config from disk, re-merge profiles, and re-register
+ * affected roles in the bridge's agentIdentities map. Call after config
+ * writes that touch identities.roles.
+ */
+export function refreshAgentIdentities(rolesToReload) {
+    const cfg = loadConfig(process.cwd());
+    const identitiesCfg = cfg.vaultMind.identities ?? {};
+    const roles = identitiesCfg.roles ?? {};
+    const defaultProfile = identitiesCfg.defaultProfile;
+    const targetRoles = rolesToReload ?? Object.keys(roles);
+    for (const role of targetRoles) {
+        const roleProfile = roles[role];
+        if (!roleProfile)
+            continue;
+        const base = buildIdentityFromRole(role, `agent-${role}`);
+        const identity = mergeIdentityProfiles(base, defaultProfile, roleProfile);
+        registerAgentIdentity(identity);
+    }
+}

package/dist/src/events.js

@@ -55,15 +55,12 @@ export const handleBeforeAgentStart = async (pi, event, ctx) => {
         // pi-context is disabled or unavailable — skip integration silently.
     }
     else {
-        if (piContextCfg.autoEnableAcm) {
-            pi.sendMessage({
-                customType: "pi-context",
-                content: "/acm",
-                display: false,
-            }, {
-                deliverAs: "followUp",
-            });
-        }
+        // ACM auto-enable is handled exactly once at session_start (see index.ts)
+        // via pi.sendUserMessage("/acm"), gated on isVaultMindReady. A hidden
+        // sendMessage({ customType: "pi-context", content: "/acm" }) here does NOT
+        // enable compaction — pi-context only enables ACM from its own `/acm`
+        // command handler (which captures the command context), so this dead path
+        // was removed.
         if (piContextCfg.tagPatterns && piContextCfg.tagPatterns.length > 0) {
             try {
                 const allTools = pi.getAllTools();
@@ -150,7 +147,7 @@ export const handleTurnEnd = async (pi, _event, ctx) => {
         }
         // Get current session history
         const logs = await contextLogTool.execute?.(null, { limit: 100, verbose: true }, null, null, ctx);
-        if (!logs || !logs.content || !logs.content[0]?.text) {
+        if (!logs?.content?.[0]?.text) {
             return;
         }
         const logText = logs.content[0].text;

package/dist/src/extension-packages.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Canonical list of pi extensions required/optional for vault-mind.
+ *
+ * This is the SINGLE SOURCE OF TRUTH. Shell scripts and the Obsidian plugin
+ * consume generated JSON (see scripts/generate-extension-packages-json.mjs).
+ * When adding/removing a package, edit ONLY this file and regenerate.
+ */
+export declare const PI_REQUIRED_EXTENSIONS: readonly ["npm:pi-vault-mind", "npm:pi-context", "npm:@kylebrodeur/pi-model-discovery", "npm:@kylebrodeur/pi-model-router"];
+export declare const PI_OPTIONAL_EXTENSIONS: readonly ["npm:pi-1password"];

package/dist/src/extension-packages.js

@@ -0,0 +1,14 @@
+/**
+ * Canonical list of pi extensions required/optional for vault-mind.
+ *
+ * This is the SINGLE SOURCE OF TRUTH. Shell scripts and the Obsidian plugin
+ * consume generated JSON (see scripts/generate-extension-packages-json.mjs).
+ * When adding/removing a package, edit ONLY this file and regenerate.
+ */
+export const PI_REQUIRED_EXTENSIONS = [
+    "npm:pi-vault-mind",
+    "npm:pi-context",
+    "npm:@kylebrodeur/pi-model-discovery",
+    "npm:@kylebrodeur/pi-model-router",
+];
+export const PI_OPTIONAL_EXTENSIONS = ["npm:pi-1password"];

package/dist/src/git.d.ts

@@ -0,0 +1,19 @@
+export interface GitStatus {
+    isRepo: boolean;
+    branch: string | null;
+    dirty: boolean;
+    ahead: number;
+    behind: number;
+    detached: boolean;
+}
+export interface GitBranches {
+    isRepo: boolean;
+    branches: string[];
+    current: string | null;
+}
+export declare function getGitStatus(cwd: string): Promise<GitStatus>;
+export declare function getGitBranches(cwd: string): Promise<GitBranches>;
+export declare function gitCheckout(cwd: string, branch: string): Promise<{
+    ok: boolean;
+    branch: string;
+}>;

package/dist/src/git.js

@@ -0,0 +1,78 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+async function git(cwd, args) {
+    const { stdout } = await execFileAsync("git", args, { cwd, timeout: 5000 });
+    return stdout.trim();
+}
+export async function getGitStatus(cwd) {
+    let isRepo = false;
+    try {
+        const out = await git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        isRepo = out === "true";
+    }
+    catch {
+        isRepo = false;
+    }
+    if (!isRepo) {
+        return { isRepo: false, branch: null, dirty: false, ahead: 0, behind: 0, detached: false };
+    }
+    const branch = await git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const detached = branch === "HEAD";
+    let dirty = false;
+    try {
+        const status = await git(cwd, ["status", "--porcelain"]);
+        dirty = status.length > 0;
+    }
+    catch {
+        dirty = false;
+    }
+    let ahead = 0;
+    let behind = 0;
+    try {
+        const counts = await git(cwd, ["rev-list", "--left-right", "--count", "HEAD...@{upstream}"]);
+        const parts = counts.split(/\s+/);
+        ahead = Number(parts[0]) || 0;
+        behind = Number(parts[1]) || 0;
+    }
+    catch {
+        ahead = 0;
+        behind = 0;
+    }
+    return {
+        isRepo: true,
+        branch: detached ? null : branch,
+        dirty,
+        ahead,
+        behind,
+        detached,
+    };
+}
+export async function getGitBranches(cwd) {
+    let isRepo = false;
+    try {
+        const out = await git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        isRepo = out === "true";
+    }
+    catch {
+        isRepo = false;
+    }
+    if (!isRepo) {
+        return { isRepo: false, branches: [], current: null };
+    }
+    const raw = await git(cwd, ["branch", "--format=%(refname:short)"]);
+    const branches = raw
+        .split("\n")
+        .map((b) => b.trim())
+        .filter((b) => b.length > 0);
+    const branch = await git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    const current = branch === "HEAD" ? null : branch;
+    return { isRepo: true, branches, current };
+}
+export async function gitCheckout(cwd, branch) {
+    if (!/^(?!-)[A-Za-z0-9._/-]+$/.test(branch)) {
+        throw new Error("Invalid branch name");
+    }
+    await git(cwd, ["checkout", branch]);
+    return { ok: true, branch };
+}

package/dist/src/graph.d.ts

@@ -1,3 +1,4 @@
+import type { AgentIdentity } from "./bridge.js";
 import type { VaultMindConfig } from "./types.js";
 export declare const graphUpsert: (dataDir: string, cfg: VaultMindConfig, entry: Record<string, string>) => Promise<void>;
-export declare const queryGraph: (dataDir: string, cfg: VaultMindConfig, entityQuery: string, depth: number) => Promise<unknown>;
+export declare const queryGraph: (dataDir: string, cfg: VaultMindConfig, entityQuery: string, depth: number, identity?: AgentIdentity) => Promise<unknown>;