total-recall-brain 3.18.2 → 3.19.0

package/src/core/source-adapters.mjs

@@ -34,6 +34,31 @@ const USAGE_FILE = path.join(brainDir, 'config', 'search-usage.json');
 // (credit rounds up, so we stay safe). Users on paid plans can raise this.
 const DEFAULT_DAILY_LIMIT = 50;
 
+/**
+ * Pull a secret by any of several env-style names (case-insensitive).
+ * Avoids "only brave_api_key works" when the vault has BRAVE_SEARCH_API_KEY.
+ */
+function secretPick(secrets, ...names) {
+  if (!secrets || typeof secrets !== 'object') return null;
+  const entries = Object.entries(secrets).filter(([k]) => k !== '__tr_secrets_meta');
+  const upperMap = new Map(entries.map(([k, v]) => [String(k).toUpperCase(), v]));
+  for (const name of names) {
+    const v = upperMap.get(String(name).toUpperCase());
+    if (v != null && String(v).trim() !== '') return String(v);
+  }
+  // fuzzy: any key that contains the brand + KEY/TOKEN
+  for (const name of names) {
+    const brand = String(name).toUpperCase().replace(/_API_KEY$|_API_TOKEN$|_TOKEN$|_KEY$/i, '');
+    if (brand.length < 3) continue;
+    for (const [k, v] of upperMap) {
+      if (k.includes(brand) && /(KEY|TOKEN)$/.test(k) && !/PASSWORD|SECRET|PRIVATE|WEBHOOK|CLIENT_SECRET/i.test(k)) {
+        if (v != null && String(v).trim() !== '') return String(v);
+      }
+    }
+  }
+  return null;
+}
+
 export function loadResearchConfig(configPath = DEFAULT_CONFIG_PATH) {
   let fileConfig = {};
   if (fs.existsSync(configPath)) {
@@ -47,14 +72,67 @@ export function loadResearchConfig(configPath = DEFAULT_CONFIG_PATH) {
     secrets = loadSecretsSync(path.dirname(path.dirname(configPath)));
   } catch {}
 
+  // SearXNG instance base URL (no trailing path). Prefer self-hosted.
+  // Examples: http://127.0.0.1:8080  https://searx.example.com
+  const searxUrlRaw =
+    process.env.SEARX_URL ||
+    process.env.SEARXNG_URL ||
+    process.env.TR_SEARX_URL ||
+    secretPick(secrets, 'SEARX_URL', 'SEARXNG_URL', 'TR_SEARX_URL') ||
+    fileConfig.searx_url ||
+    fileConfig.searxng_url ||
+    null;
+  const searxUrl = searxUrlRaw ? String(searxUrlRaw).replace(/\/+$/, '') : null;
+  // When true (default if URL set), webSearch tries SearX before paid APIs
+  const preferSearx =
+    fileConfig.prefer_searx !== undefined
+      ? !!fileConfig.prefer_searx
+      : process.env.TR_PREFER_SEARX !== '0';
+
   return {
-    // ── Paid search providers (fallback chain: Brave → Tavily → Exa → Serper) ──
-    braveApiKey:  process.env.BRAVE_SEARCH_API_KEY || process.env.BRAVE_API_KEY || secrets.brave_api_key || fileConfig.brave_api_key  || defaultBraveKey || defaultBraveSearchKey || null,
-    tavilyApiKey: process.env.TAVILY_API_KEY                                    || secrets.tavily_api_key || fileConfig.tavily_api_key || defaultTavilyKey || null,
-    exaApiKey:    process.env.EXA_API_KEY                                       || secrets.exa_api_key    || fileConfig.exa_api_key    || defaultExaKey || null,
-    serperApiKey: process.env.SERPER_API_KEY                                    || secrets.serper_api_key || fileConfig.serper_api_key || defaultSerperKey || null,
+    // ── Free metasearch (preferred when configured) ──
+    searxUrl,
+    preferSearx: !!searxUrl && preferSearx,
+    // Optional: categories CSV for SearX (default: general)
+    searxCategories: fileConfig.searx_categories || process.env.SEARX_CATEGORIES || 'general',
+    // Optional: language code (en, en-US, all)
+    searxLanguage: fileConfig.searx_language || process.env.SEARX_LANGUAGE || 'en',
+    // ── Paid search providers (fallback: Brave → Tavily → Exa → Serper) ──
+    // Resolve from env, then any vault alias (BRAVE_SEARCH_API_KEY, DEVELOPER_*, …), then defaults.
+    braveApiKey:
+      process.env.BRAVE_SEARCH_API_KEY ||
+      process.env.BRAVE_API_KEY ||
+      secretPick(secrets, 'BRAVE_SEARCH_API_KEY', 'BRAVE_API_KEY', 'brave_api_key', 'DEVELOPER_BRAVE_SEARCH_API_KEY') ||
+      fileConfig.brave_api_key ||
+      defaultBraveKey ||
+      defaultBraveSearchKey ||
+      null,
+    tavilyApiKey:
+      process.env.TAVILY_API_KEY ||
+      secretPick(secrets, 'TAVILY_API_KEY', 'tavily_api_key') ||
+      fileConfig.tavily_api_key ||
+      defaultTavilyKey ||
+      null,
+    exaApiKey:
+      process.env.EXA_API_KEY ||
+      secretPick(secrets, 'EXA_API_KEY', 'exa_api_key') ||
+      fileConfig.exa_api_key ||
+      defaultExaKey ||
+      null,
+    serperApiKey:
+      process.env.SERPER_API_KEY ||
+      secretPick(secrets, 'SERPER_API_KEY', 'serper_api_key', 'DEVELOPER_SERPER_API_KEY') ||
+      fileConfig.serper_api_key ||
+      defaultSerperKey ||
+      null,
     // GitHub: personal access token for higher rate limits (60→5000 req/hr)
-    githubToken: process.env.GITHUB_TOKEN || secrets.github_token || fileConfig.github_token || defaultGithubToken || null,
+    githubToken:
+      process.env.GITHUB_TOKEN ||
+      process.env.GH_TOKEN ||
+      secretPick(secrets, 'GITHUB_TOKEN', 'GH_TOKEN', 'github_token') ||
+      fileConfig.github_token ||
+      defaultGithubToken ||
+      null,
     fetchTimeoutMs: fileConfig.fetch_timeout_ms || 10000,
     maxResultsPerSource: fileConfig.max_results_per_source || 5,
     userAgent:
@@ -63,7 +141,7 @@ export function loadResearchConfig(configPath = DEFAULT_CONFIG_PATH) {
       'TotalRecall/1.0 (knowledge-acquisition)',
     // Daily cap: protects free-tier users from unexpected overage charges.
     // Default 50/day ≈ 1,500/month — within Brave/Tavily/Exa free tiers (~1,000/month each).
-    // Set to 0 to disable (paid plans with high volume).
+    // Set to 0 to disable (paid plans with high volume). SearX does NOT count against this cap.
     dailyWebSearchLimit: Number(fileConfig.daily_web_search_limit ?? process.env.TR_DAILY_SEARCH_LIMIT ?? DEFAULT_DAILY_LIMIT),
   };
 }
@@ -323,24 +401,144 @@ export async function exaSearch(query, config, count = 5) {
 
 /**
  * Web search with automatic fallback chain:
- *   Brave → Tavily → Exa → Serper → DuckDuckGo (free, always on)
+ *   SearXNG (preferred free) → Brave → Tavily → Exa → Serper → DuckDuckGo
  *
- * Respects the daily paid-search cap (default 50/day ≈ 1,500/month).
- * When the cap is hit, falls back to free DuckDuckGo — research never stops.
+ * Paid providers respect the daily paid-search cap (default 50/day).
+ * SearXNG is free/self-hosted and does not count against the paid cap.
  */
 export async function webSearch(query, config, count = 5) {
+  // isDailyCapReached increments the paid counter when still under limit
   const capReached = isDailyCapReached(config);
+  const errors = [];
+
+  const tryProvider = async (name, fn) => {
+    try {
+      const results = await fn();
+      if (Array.isArray(results) && results.length > 0) return results;
+      errors.push(`${name}: empty results`);
+    } catch (err) {
+      errors.push(`${name}: ${err.message}`);
+    }
+    return null;
+  };
+
+  // 1) SearXNG first when configured (prefer_searx default true when URL set)
+  if (config.searxUrl && config.preferSearx !== false) {
+    const hit = await tryProvider('searx', () => searxSearch(query, config, count));
+    if (hit) return hit;
+  }
 
+  // 2) Paid providers — on 429/timeout/error, continue to next
   if (!capReached) {
-    if (config.braveApiKey)  return braveSearch(query, config, count);
-    if (config.tavilyApiKey) return tavilySearch(query, config, count);
-    if (config.exaApiKey)    return exaSearch(query, config, count);
-    if (config.serperApiKey) return serperSearch(query, config, count);
+    if (config.braveApiKey) {
+      const hit = await tryProvider('brave-search', () => braveSearch(query, config, count));
+      if (hit) return hit;
+    }
+    if (config.tavilyApiKey) {
+      const hit = await tryProvider('tavily', () => tavilySearch(query, config, count));
+      if (hit) return hit;
+    }
+    if (config.exaApiKey) {
+      const hit = await tryProvider('exa', () => exaSearch(query, config, count));
+      if (hit) return hit;
+    }
+    if (config.serperApiKey) {
+      const hit = await tryProvider('serper', () => serperSearch(query, config, count));
+      if (hit) return hit;
+    }
   }
 
-  // No paid key or daily cap reached — free fallback, always available
-  const ddg = await duckduckgoInstant(query, config).catch(() => null);
-  return ddg ? [ddg] : [];
+  // 3) SearX again if de-prioritized (prefer_searx: false) but URL is set
+  if (config.searxUrl && config.preferSearx === false) {
+    const hit = await tryProvider('searx', () => searxSearch(query, config, count));
+    if (hit) return hit;
+  }
+
+  // 4) Free DDG Instant Answer — last resort
+  const ddg = await duckduckgoInstant(query, config).catch((err) => {
+    errors.push(`duckduckgo: ${err.message}`);
+    return null;
+  });
+  if (ddg) return Array.isArray(ddg) ? ddg : [ddg];
+
+  if (errors.length) {
+    throw new Error(`All web search providers failed: ${errors.join(' | ')}`);
+  }
+  return [];
+}
+
+/**
+ * Search via SearXNG (or classic SearX) JSON API.
+ *
+ * Instance must enable JSON format (settings.yml: search.formats includes json).
+ * Self-host recommended — many public instances disable JSON / rate-limit bots.
+ *
+ * @param {string} query
+ * @param {object} config - from loadResearchConfig()
+ * @param {number} [count=5]
+ * @returns {Promise<SourceResult[]>}
+ */
+export async function searxSearch(query, config, count = 5) {
+  if (!config.searxUrl) {
+    throw new Error('SEARX_URL / searx_url not set (SearXNG instance base URL)');
+  }
+
+  const base = String(config.searxUrl).replace(/\/+$/, '');
+  // Accept either bare host or host already ending in /search
+  const searchPath = base.endsWith('/search') ? base : `${base}/search`;
+  const url = new URL(searchPath);
+  url.searchParams.set('q', query);
+  url.searchParams.set('format', 'json');
+  url.searchParams.set('categories', config.searxCategories || 'general');
+  if (config.searxLanguage) {
+    url.searchParams.set('language', config.searxLanguage);
+  }
+
+  const response = await safeFetch(
+    url.toString(),
+    {
+      headers: {
+        Accept: 'application/json',
+        'User-Agent': config.userAgent || 'TotalRecall/1.0 (knowledge-acquisition)',
+      },
+    },
+    config.fetchTimeoutMs || 15000,
+  );
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => '');
+    throw new Error(`SearX API error ${response.status}: ${body.slice(0, 200)}`);
+  }
+
+  const contentType = response.headers.get('content-type') || '';
+  const text = await response.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `SearX returned non-JSON (content-type=${contentType}). Enable JSON in instance settings.yml: search.formats: [html, json]`,
+    );
+  }
+
+  const results = Array.isArray(data.results) ? data.results : [];
+  return results
+    .slice(0, count)
+    .map((r, i) => ({
+      source: 'searx',
+      type: 'web',
+      title: r.title || 'Untitled',
+      url: r.url || r.pretty_url || '',
+      snippet: (r.content || r.description || r.snippet || '').slice(0, 500),
+      published: normalizePublishedDate(r.publishedDate || r.pubdate || null),
+      relevance: Math.max(0.3, 1 - i * 0.08),
+      extra: {
+        engine: r.engine || (Array.isArray(r.engines) ? r.engines.join(',') : null),
+        category: r.category || null,
+        score: r.score ?? null,
+      },
+    }))
+    .filter((r) => r.url);
 }
 
 // ─── arXiv API ─────────────────────────────────────────────────────────────────
@@ -746,21 +944,48 @@ export function checkSourceAvailability(config) {
   // Always available (no auth)
   available.push('arxiv', 'npm', 'wikipedia', 'duckduckgo', 'web-fetch');
 
-  // Web search — Brave primary, Serper fallback
+  // SearXNG / SearX (self-hosted metasearch — preferred free web search)
+  if (config.searxUrl) {
+    available.push('searx');
+  } else {
+    unavailable.push('searx');
+  }
+
+  // Paid web search chain — Brave → Tavily → Exa → Serper
   if (config.braveApiKey) {
     available.push('brave-search');
   } else {
     unavailable.push('brave-search');
-    warnings.push('BRAVE_SEARCH_API_KEY not set — set in env (already in UltraChat .env.local)');
+  }
+
+  if (config.tavilyApiKey) {
+    available.push('tavily');
+  } else {
+    unavailable.push('tavily');
+  }
+
+  if (config.exaApiKey) {
+    available.push('exa');
+  } else {
+    unavailable.push('exa');
   }
 
   if (config.serperApiKey) {
     available.push('serper');
   } else {
     unavailable.push('serper');
-    if (!config.braveApiKey) {
-      warnings.push('SERPER_API_KEY not set — no web search available (set BRAVE_SEARCH_API_KEY or SERPER_API_KEY)');
-    }
+  }
+
+  const hasPaidSearch =
+    config.braveApiKey || config.tavilyApiKey || config.exaApiKey || config.serperApiKey;
+  if (!config.searxUrl && !hasPaidSearch) {
+    warnings.push(
+      'No SearX URL and no paid web-search key. Set SEARX_URL (preferred) or Brave/Tavily/Exa/Serper — otherwise only DuckDuckGo Instant Answer.',
+    );
+  } else if (config.searxUrl) {
+    warnings.push(
+      `SearXNG preferred at ${config.searxUrl} (ensure search.formats includes json).`,
+    );
   }
 
   if (config.githubToken) {

package/src/core/surface.mjs

@@ -186,16 +186,16 @@ function modalityMarker(node) {
  */
 export function heuristicCompact(node) {
   const rawTitle = (node.title || '').trim();
+  // Legacy prefix only — provenance is source.type / tags, not title text
   const title = rawTitle.replace(/^Self-captured memory:\s*/i, '').trim();
   const text = (node.body || node.content || '').trim();
   const marker = modalityMarker(node);
   const prefix = marker ? `${marker} ` : '';
 
   // Determine the best display text, avoiding title/body duplication.
-  // When title is auto-generated ("Self-captured memory: ...") it echoes the body —
-  // use the body directly to avoid doubling the same content.
-  const titleIsEcho = rawTitle.startsWith('Self-captured memory:') ||
-    (text && title.length > 20 && text.toLowerCase().startsWith(title.toLowerCase().slice(0, 20)));
+  // Echo titles (legacy "Self-captured…" or title that is just a body prefix) use body only.
+  const titleIsEcho = /^Self-captured memory:/i.test(rawTitle) ||
+    (text && title.length > 20 && text.toLowerCase().startsWith(title.toLowerCase().replace(/\.\.\.$/, '').slice(0, 20)));
 
   if (node.category && ['invariants', 'preferences', 'anti-patterns'].includes(node.category)) {
     if (text) {

package/src/core/task-executors.mjs

@@ -369,6 +369,45 @@ async function runResearchLegacy(task, ctx) {
     String(task.slug || '').includes('fact-seeker') ||
     String(task.slug || '').includes('knowledge-acquisition')
   ) {
+    // Prefer deep multi-source research when this came from the research queue
+    const deep =
+      String(task.slug || '').startsWith('research-acquisition-') ||
+      task.created_by === 'research-queue' ||
+      task._research_id;
+
+    if (deep) {
+      try {
+        const { handleProactiveResearch } = await import('./research.mjs');
+        const deepResult = await handleProactiveResearch(
+          {
+            target: task.target || task.title || 'Unknown',
+            body: task.body || task.reason || '',
+          },
+          { runtimeConfig },
+        );
+        const draftSlug =
+          deepResult?.factSlug ||
+          findLatestResearchDraftSlug(inboxDir, task.target);
+        if (draftSlug) {
+          return {
+            success: true,
+            output: `Deep researched "${task.target}" → ${draftSlug} (${deepResult?.sources || 0} sources)`,
+            factSlug: draftSlug,
+            executor: 'research',
+          };
+        }
+        logger.info({
+          subsystem: 'task-executors',
+          message: 'Deep research returned no draft slug — falling back to knowledge acquisition',
+        });
+      } catch (err) {
+        logger.info({
+          subsystem: 'task-executors',
+          message: `Deep research failed (${err.message}) — falling back to knowledge acquisition`,
+        });
+      }
+    }
+
     const { runKnowledgeAcquisitionCycle } = await import('./fact-seeker.mjs');
     const result = await runKnowledgeAcquisitionCycle({
       vaultDir: VAULT_DIR,
@@ -380,8 +419,20 @@ async function runResearchLegacy(task, ctx) {
       instructionsFile: INSTRUCTIONS_FILE,
       runtimeConfig,
     });
+    // CRITICAL: skipped/no-results is NOT success — otherwise phases advance empty forever
     if (result.skipped) {
-      return { success: true, output: `Knowledge acquisition: ${result.skipped}`, executor: 'research' };
+      return {
+        success: false,
+        error: `Knowledge acquisition skipped: ${result.skipped}${result.errors?.length ? ` (${result.errors.map((e) => e.error || e.source).join('; ')})` : ''}`,
+        executor: 'research',
+      };
+    }
+    if (!result.factSlug) {
+      return {
+        success: false,
+        error: `Knowledge acquisition produced no memory node for "${result.topic || task.target}"`,
+        executor: 'research',
+      };
     }
     return {
       success: true,
@@ -391,51 +442,104 @@ async function runResearchLegacy(task, ctx) {
     };
   }
 
+  // Later phases require a real node from acquisition — never no-op success
+  const requireNode = (label) => {
+    const slug = task._node_slug;
+    if (!slug || slug === 'pending') {
+      return {
+        success: false,
+        error: `${label} requires node_slug from acquisition (got ${slug || 'null'}). Reset phase to acquisition.`,
+        executor: 'research',
+      };
+    }
+    return null;
+  };
+
   if (String(task.slug || '').startsWith('research-deliberation-')) {
+    const missing = requireNode('Deliberation');
+    if (missing) return missing;
     const { runResearchDeliberationCycle } = await import('./fact-seeker.mjs');
-    await runResearchDeliberationCycle({
+    const result = await runResearchDeliberationCycle({
       vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug || 'pending',
+      nodeSlug: task._node_slug,
       topic: task.title || task.target || 'Unknown Topic',
       runtimeConfig,
     });
-    return { success: true, output: 'Deliberation complete', executor: 'research' };
+    if (result?.success === false) {
+      return { success: false, error: result.error || 'Deliberation failed', executor: 'research' };
+    }
+    return {
+      success: true,
+      output: result?.output || 'Deliberation complete',
+      factSlug: result?.factSlug || task._node_slug,
+      executor: 'research',
+    };
   }
 
   if (String(task.slug || '').startsWith('research-improvement-')) {
+    const missing = requireNode('Improvement');
+    if (missing) return missing;
     const { runResearchImprovementCycle } = await import('./fact-seeker.mjs');
-    await runResearchImprovementCycle({
+    const result = await runResearchImprovementCycle({
       vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug || 'pending',
+      nodeSlug: task._node_slug,
       topic: task.title || task.target || 'Unknown Topic',
       runtimeConfig,
     });
-    return { success: true, output: 'Improvement complete', executor: 'research' };
+    if (result?.success === false) {
+      return { success: false, error: result.error || 'Improvement failed', executor: 'research' };
+    }
+    return {
+      success: true,
+      output: result?.output || 'Improvement complete',
+      factSlug: result?.factSlug || task._node_slug,
+      executor: 'research',
+    };
   }
 
   if (String(task.slug || '').startsWith('research-monitoring-')) {
+    const missing = requireNode('Monitoring');
+    if (missing) return missing;
     const { runResearchMonitoringCycle } = await import('./fact-seeker.mjs');
-    await runResearchMonitoringCycle({
+    const result = await runResearchMonitoringCycle({
       vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug || 'pending',
+      nodeSlug: task._node_slug,
       topic: task.title || task.target || 'Unknown Topic',
       runtimeConfig,
       skillsDir: SKILLS_DIR,
       derivedDir: DERIVED_DIR,
       instructionsFile: INSTRUCTIONS_FILE,
     });
-    return { success: true, output: 'Monitoring complete', executor: 'research' };
+    if (result?.success === false) {
+      return { success: false, error: result.error || 'Monitoring failed', executor: 'research' };
+    }
+    return {
+      success: true,
+      output: result?.output || 'Monitoring complete',
+      factSlug: result?.factSlug || task._node_slug,
+      executor: 'research',
+    };
   }
 
   if (String(task.slug || '').startsWith('research-expansion-')) {
+    const missing = requireNode('Expansion');
+    if (missing) return missing;
     const { runResearchExpansionCycle } = await import('./fact-seeker.mjs');
-    await runResearchExpansionCycle({
+    const result = await runResearchExpansionCycle({
       vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug || 'pending',
+      nodeSlug: task._node_slug,
       topic: task.title || task.target || 'Unknown Topic',
       runtimeConfig,
     });
-    return { success: true, output: 'Expansion complete', executor: 'research' };
+    if (result?.success === false) {
+      return { success: false, error: result.error || 'Expansion failed', executor: 'research' };
+    }
+    return {
+      success: true,
+      output: result?.output || 'Expansion complete',
+      factSlug: result?.factSlug || task._node_slug,
+      executor: 'research',
+    };
   }
 
   if (String(task.slug || '').includes('validate')) {
@@ -455,7 +559,50 @@ async function runResearchLegacy(task, ctx) {
     };
   }
 
-  return { success: true, output: 'No-op research task', executor: 'research' };
+  return {
+    success: false,
+    error: `No research handler matched slug=${task.slug} category=${task.category}`,
+    executor: 'research',
+  };
+}
+
+/**
+ * Locate the newest consolidated research draft for a topic in memory-inbox/pending.
+ */
+function findLatestResearchDraftSlug(inboxDir, topic) {
+  try {
+    if (!fs.existsSync(inboxDir)) return null;
+    const needle = String(topic || '')
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, '-')
+      .replace(/^-|-$/g, '')
+      .slice(0, 40);
+    const files = fs
+      .readdirSync(inboxDir)
+      .filter((f) => f.endsWith('.md'))
+      .map((f) => {
+        const full = path.join(inboxDir, f);
+        const st = fs.statSync(full);
+        return { slug: f.replace(/\.md$/, ''), mtime: st.mtimeMs, name: f.toLowerCase() };
+      })
+      .sort((a, b) => b.mtime - a.mtime);
+    if (!files.length) return null;
+    if (needle) {
+      const hit = files.find(
+        (f) =>
+          f.name.includes(needle) ||
+          f.name.includes('research') ||
+          f.name.includes('deep-research') ||
+          f.name.includes('consolidated'),
+      );
+      if (hit) return hit.slug;
+    }
+    // Prefer research-looking drafts, else newest
+    const researchish = files.find((f) => /research|fact-|deep-/.test(f.name));
+    return (researchish || files[0]).slug;
+  } catch {
+    return null;
+  }
 }
 
 // ─── Registry ───────────────────────────────────────────────────────────────────

package/src/core/throttled-fetch.mjs

@@ -140,6 +140,9 @@ export async function loadFirewallPolicy(brainDir) {
       policyWatcher = fs.watch(policyPath, (eventType) => {
         if (eventType === 'change') applyPolicy();
       });
+      // Unref so this watcher does not prevent one-shot CLI commands (e.g.
+      // `recall`) from exiting cleanly once their work is done.
+      policyWatcher.unref();
     }
 
     // Also watch the parent directory so we pick up the policy file being
@@ -153,8 +156,10 @@ export async function loadFirewallPolicy(brainDir) {
           policyWatcher = fs.watch(policyPath, (evt) => {
             if (evt === 'change') applyPolicy();
           });
+          policyWatcher.unref();
         }
       });
+      parentWatcher.unref();
     }
   } catch (err) {
     logger.error('throttled-fetch', `Failed to load network policy: ${err.message}`);

package/src/core/vault.mjs

@@ -76,7 +76,13 @@ export function loadNodes(vaultDir) {
       const raw = fs.readFileSync(file, 'utf8');
       const { data, content } = matter(raw);
       if (data.type === 'memory') {
-        nodes.push({ ...data, body: content.trim() });
+        // Attach absolute path for stampers/rewriters (both spellings used in codebase)
+        nodes.push({
+          ...data,
+          body: content.trim(),
+          _filePath: file,
+          _filepath: file,
+        });
       }
     } catch (err) {
       logger.warn('vault', `Failed to parse ${file}`, { err: err.message });