total-recall-brain 3.18.2 → 3.19.0

package/src/cli/ingest.mjs

@@ -16,8 +16,9 @@
 import path from 'node:path';
 import { resolveAgentDir, resolveBrainDir } from './agent-dir.mjs';
 
-const AGENT_DIR = resolveAgentDir();
-const BRAIN_DIR = resolveBrainDir();
+// Session ingest lands in the global brain by default.
+const AGENT_DIR = resolveAgentDir('global');
+const BRAIN_DIR = resolveBrainDir('global');
 
 function parseArgs(args) {
   const opts = { sources: null, watch: false, help: false };

package/src/cli/lint.mjs

@@ -17,11 +17,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { resolveAgentDir, resolveBrainDir } from './agent-dir.mjs';
+import { resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const AGENT_DIR = resolveAgentDir();
-const BRAIN_DIR = resolveBrainDir();
 
 function parseArgs(args) {
   const opts = { vault: null, strict: false, json: false, help: false, okf: false };
@@ -47,7 +45,9 @@ function printHelp() {
   Usage: total-recall lint [options]
 
   Options:
-    --vault <path>     Override vault directory (default: ~/.agent/memory-vault)
+    --vault <path>     Override vault directory (default: global brain vault)
+    --global           Lint the global vault (default)
+    --project          Lint the project vault for the current repo
     --strict           Treat warnings as errors (exit 1 on any issue)
     --okf              Verify OKF v0.1 draft metadata compliance
     --json             Output results as JSONL
@@ -60,10 +60,13 @@ function printHelp() {
 }
 
 export default async function lint(args) {
-  const opts = parseArgs(args);
+  const { layer, remainingArgs } = parseLayerFlag(args);
+  // Default layer is global when no --project/--global (matches help text)
+  const effectiveLayer = layer === 'auto' ? 'global' : layer;
+  const opts = parseArgs(remainingArgs);
   if (opts.help) { printHelp(); return; }
 
-  const vaultDir = opts.vault || path.join(BRAIN_DIR, 'memory-vault');
+  const vaultDir = opts.vault || path.join(resolveBrainDir(effectiveLayer), 'memory-vault');
 
   if (opts.okf) {
     const { lintOkfCompliance } = await import('../core/okf-adapter.mjs');

package/src/cli/rebuild.mjs

@@ -2,7 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { compileSurface } from '../core/surface.mjs';
 import { detectIndexDrift } from '../core/drift-detector.mjs';
-import { resolveAgentDir, resolveBrainDir } from './agent-dir.mjs';
+import { resolveAgentDir, resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 import { logger } from '../core/logger.mjs';
 
 /**
@@ -14,8 +14,9 @@ import { logger } from '../core/logger.mjs';
  */
 
 export async function runRebuild(options = {}) {
-  const agentDir = resolveAgentDir();
-  const brainDir = resolveBrainDir();
+  const layer = options.layer || 'auto';
+  const agentDir = resolveAgentDir(layer);
+  const brainDir = resolveBrainDir(layer);
   const vaultDir = path.join(brainDir, 'memory-vault');
   const skillsDir = path.join(agentDir, 'skills');
   const derivedDir = path.join(brainDir, 'memory-derived');
@@ -82,7 +83,11 @@ export async function runRebuild(options = {}) {
 }
 
 export default async function cli(args) {
-  const options = { check: args.includes('--check') };
+  const { layer, remainingArgs } = parseLayerFlag(args);
+  const options = {
+    check: remainingArgs.includes('--check'),
+    layer,
+  };
   const code = await runRebuild(options);
   process.exit(code);
 }

package/src/cli/remember.mjs

@@ -5,6 +5,7 @@ import matter from 'gray-matter';
 import { resolveAgentDir, resolveBrainDir, parseLayerFlag, getBothBrains, defaultLayerForCategory } from './agent-dir.mjs';
 import { compileSurface } from '../core/surface.mjs';
 import { writeNodeValidatedAsync } from '../core/validated-write.mjs';
+import { defaultTitleFromBody } from '../core/memory-title.mjs';
 
 function printHelp() {
   console.log(`
@@ -243,8 +244,12 @@ export default async function remember(args) {
   // Create individual SSSS v2 node in the vault
   const contentHash = crypto.createHash('md5').update(bodyContent).digest('hex').slice(0, 8);
   const finalSlug = slug || `${category}-${contentHash}`;
-  const truncatedContent = bodyContent.slice(0, 50) + (bodyContent.length > 50 ? '...' : '');
-  const finalTitle = title || `Self-captured memory: ${truncatedContent.replace(/\n/g, ' ')}`;
+  // Provenance lives in source.type + tags — not a title prefix
+  const finalTitle = title || defaultTitleFromBody(bodyContent);
+  const finalTags = Array.isArray(tags) ? [...tags] : [];
+  if (!finalTags.includes('self-captured') && !title) {
+    finalTags.push('self-captured');
+  }
 
   const now = new Date().toISOString();
   
@@ -264,12 +269,13 @@ export default async function remember(args) {
     source: {
       type: 'remember-cli',
       session_id: process.env.TR_SESSION_ID || 'remember-session',
-      evidence_count: 1
+      evidence_count: 1,
+      capture: 'self',
     },
     supersedes: [],
     superseded_by: null,
     contradicts: [],
-    tags,
+    tags: finalTags,
     related,
     routes_to_skills: [],
     sentiment_polarity: type.toLowerCase() === 'preference' ? 'preference' : 'descriptive',
@@ -309,8 +315,9 @@ export default async function remember(args) {
             const oldTitle = (data.title || '').trim().toLowerCase();
             const newTitle = finalTitle.trim().toLowerCase();
             
-            const words1 = new Set(bodyContent.toLowerCase().match(/\\b\\w+\\b/g) || []);
-            const words2 = new Set((oldContent || '').toLowerCase().match(/\\b\\w+\\b/g) || []);
+            // Word tokens for Jaccard similarity (must be real \b/\w, not double-escaped literals)
+            const words1 = new Set(bodyContent.toLowerCase().match(/\b\w+\b/g) || []);
+            const words2 = new Set((oldContent || '').toLowerCase().match(/\b\w+\b/g) || []);
             const intersection = new Set([...words1].filter(x => words2.has(x)));
             const union = new Set([...words1, ...words2]);
             const similarity = union.size === 0 ? 0 : intersection.size / union.size;
@@ -325,14 +332,10 @@ export default async function remember(args) {
               data.superseded_by = finalSlug;
               data.updated = now;
               node.supersedes = [...(node.supersedes || []), data.slug];
-              
-              const lines = ['---'];
-              for (const key of Object.keys(data)) {
-                lines.push(`${key}: ${JSON.stringify(data[key])}`);
-              }
-              lines.push('---');
-              lines.push(oldContent);
-              fs.writeFileSync(p, lines.join('\n'));
+
+              // Use gray-matter so nested objects/arrays stay valid YAML
+              const bodyOut = (oldContent || '').trim();
+              fs.writeFileSync(p, matter.stringify(bodyOut ? `${bodyOut}\n` : '', data), 'utf8');
             }
           }
         }
@@ -360,7 +363,10 @@ export default async function remember(args) {
   console.log('  ⏳ Recompiling active memory surfaces and indexes in the background...');
   try {
     const { spawn } = await import('node:child_process');
-    const child = spawn(process.argv[0], [process.argv[1], 'compile'], {
+    const compileArgs = [process.argv[1], 'compile'];
+    if (layer === 'project') compileArgs.push('--project');
+    else if (layer === 'global') compileArgs.push('--global');
+    const child = spawn(process.argv[0], compileArgs, {
       detached: true,
       stdio: 'ignore'
     });

package/src/cli/secret.mjs

@@ -28,6 +28,7 @@ import {
   getSecretsCatalog,
   updateSecretMeta,
   listRotationDue,
+  getSharedValueHealth,
 } from '../core/secrets-store.mjs';
 import {
   scanEnvSources,
@@ -79,9 +80,22 @@ function printHelp() {
       --dry-run           Show keys that would be written
     import-env            One-time migrate: scan local .env → store (not the steady-state path)
       --all / --file / --overwrite / --dry-run
-    catalog               Full catalog: keys, providers, usage, rotation, cost
+    catalog               Full catalog: keys, providers, usage, rotation, cost, tracking
     providers             List provider registry (docs/schema/tiers)
+    account-sync [key]    Live-probe vendor account/usage/subscription APIs
+      --all               Sync every set secret (default if no key)
+      --strict            partial (no $ API) → ERROR (default)
+      --no-strict         Allow partial status
+      --use-ai            AI-classify unknown keys (slow)
+      --exempt            Mark key tracking_exempt (with optional --monthly-cost)
+    tracking-health       Fail (exit 1) if any set secret is untracked
+    shared                List credential values reused across keys/apps (exit 1 if any)
+      --shared-ok         Mark key as intentional share (waive) — use with meta
     meta <key>            Update metadata (no value change)
+      --tracking-exempt   Waive live account API requirement
+      --no-tracking-exempt
+      --shared-ok         Allow this key to share its value with other secret names
+      --no-shared-ok
       --repo <name>       Bind to exactly ONE product repo (not multi)
       --repos <name>      Same as --repo (single name only; multi rejected)
       --tier <id>         Subscription tier
@@ -167,6 +181,11 @@ function parseArgs(args) {
     enqueue: false,
     bytes: 32,
     format: 'base64url',
+    strict: true,
+    use_ai: false,
+    exempt: false,
+    tracking_exempt: null,
+    shared_ok: null,
   };
   if (!args.length || args[0] === '--help' || args[0] === '-h') {
     out.help = true;
@@ -175,7 +194,9 @@ function parseArgs(args) {
   out.command = args[0];
   let i = 1;
   if (
-    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate'].includes(out.command) &&
+    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate', 'account-sync'].includes(
+      out.command,
+    ) &&
     args[i] &&
     !args[i].startsWith('--')
   ) {
@@ -301,6 +322,30 @@ function parseArgs(args) {
       case '--format':
         out.format = args[++i] || 'base64url';
         break;
+      case '--strict':
+        out.strict = true;
+        break;
+      case '--no-strict':
+        out.strict = false;
+        break;
+      case '--use-ai':
+        out.use_ai = true;
+        break;
+      case '--exempt':
+        out.exempt = true;
+        break;
+      case '--tracking-exempt':
+        out.tracking_exempt = true;
+        break;
+      case '--no-tracking-exempt':
+        out.tracking_exempt = false;
+        break;
+      case '--shared-ok':
+        out.shared_ok = true;
+        break;
+      case '--no-shared-ok':
+        out.shared_ok = false;
+        break;
       case '--help':
       case '-h':
         out.help = true;
@@ -457,6 +502,121 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'account-sync' || opts.command === 'sync-accounts') {
+      const {
+        syncSecretAccount,
+        syncAllSecretAccounts,
+        getTrackingHealth,
+      } = await import('../core/provider-account-sync.mjs');
+      const syncOpts = {
+        strict: opts.strict !== false,
+        use_ai: !!opts.use_ai,
+        force_exempt: !!opts.exempt,
+      };
+      if (opts.key) {
+        if (opts.exempt) {
+          await updateSecretMeta(
+            brainDir,
+            opts.key,
+            {
+              tracking_exempt: true,
+              monthly_cost_usd: opts.monthly_cost ?? undefined,
+            },
+            { actor: 'cli' },
+          );
+        }
+        const r = await syncSecretAccount(brainDir, opts.key, syncOpts);
+        const icon =
+          r.tracking_status === 'ok' ? '✅' : r.tracking_status === 'exempt' ? '⏭' : '❌';
+        console.log(`\n  ${icon} ${r.key}  status=${r.tracking_status}  provider=${r.provider || '-'}`);
+        if (r.probe) console.log(`     probe: ${r.probe}`);
+        if (r.error) console.log(`     error: ${r.error}`);
+        if (r.account) console.log(`     account: ${JSON.stringify(r.account)}`);
+        if (r.usage) console.log(`     usage: ${JSON.stringify(r.usage)}`);
+        if (r.subscription) console.log(`     subscription: ${JSON.stringify(r.subscription)}`);
+        console.log('');
+        if (r.tracking_status === 'error') process.exit(1);
+        return;
+      }
+      console.log('\n  🔄 Live provider account/usage sync (all set secrets)…\n');
+      const report = await syncAllSecretAccounts(brainDir, syncOpts);
+      console.log(`  total=${report.total}  ok/exempt=${report.ok}  errors=${report.errors}`);
+      console.log(`  ${report.healthy ? '✅' : '❌'} ${report.message}`);
+      if (report.error_keys?.length) {
+        console.log('\n  Untracked / failed:');
+        for (const e of report.error_keys.slice(0, 50)) {
+          console.log(`    • ${e.key}: ${e.error}`);
+        }
+        if (report.error_keys.length > 50) {
+          console.log(`    … and ${report.error_keys.length - 50} more`);
+        }
+      }
+      const health = await getTrackingHealth(brainDir);
+      console.log(
+        `\n  tracking-health: healthy=${health.healthy} ok=${health.ok} exempt=${health.exempt} errors=${health.errors}\n`,
+      );
+      if (!report.healthy) process.exit(1);
+      return;
+    }
+
+    if (opts.command === 'tracking-health' || opts.command === 'tracking') {
+      const { getTrackingHealth } = await import('../core/provider-account-sync.mjs');
+      const health = await getTrackingHealth(brainDir);
+      console.log(`\n  ${health.healthy ? '✅' : '❌'} ${health.message}`);
+      console.log(`     ok=${health.ok}  exempt=${health.exempt}  errors=${health.errors}`);
+      if (health.error_keys?.length) {
+        console.log('');
+        for (const e of health.error_keys) {
+          console.log(`    • ${e.key.padEnd(28)} ${(e.provider || '-').padEnd(14)} ${e.error}`);
+        }
+      }
+      const shared = await getSharedValueHealth(brainDir);
+      console.log(`\n  ${shared.healthy ? '✅' : '❌'} ${shared.message}`);
+      if (shared.errors?.length) {
+        for (const e of shared.errors) {
+          console.log(`    • fp=${e.fingerprint} apps=[${e.apps.join(', ')}]`);
+          console.log(`      keys: ${e.keys.join(', ')}`);
+        }
+      }
+      console.log('');
+      if (!health.healthy || !shared.healthy) process.exit(1);
+      return;
+    }
+
+    if (opts.command === 'shared' || opts.command === 'shared-values' || opts.command === 'duplicates') {
+      const shared = await getSharedValueHealth(brainDir);
+      console.log(`\n  ${shared.healthy ? '✅' : '❌'} ${shared.message}`);
+      console.log(
+        `     groups=${shared.groups.length}  error_groups=${shared.error_groups}  multi_app=${shared.multi_app_groups}  keys_in_error=${shared.shared_keys}`,
+      );
+      if (shared.groups.length) {
+        console.log('');
+        for (const g of shared.groups) {
+          const icon = g.severity === 'error' ? '❌' : '⏭';
+          console.log(
+            `  ${icon} fingerprint ${g.fingerprint}  ×${g.count}  apps=[${g.apps.join(', ')}]`,
+          );
+          for (const m of g.members) {
+            console.log(
+              `      • ${m.key.padEnd(36)} app=${String(m.app).padEnd(16)} provider=${m.provider || '-'}  ${m.masked || ''}`,
+            );
+          }
+          if (g.error) console.log(`      → ${g.error}`);
+          console.log(
+            `      fix: rotate each key to a unique value, then: secret rotate <key> <new> --export-env`,
+          );
+          console.log(
+            `      waive (rare): secret meta <key> --shared-ok   # only if intentional mirror`,
+          );
+          console.log('');
+        }
+      } else {
+        console.log('\n  No shared credential values detected.\n');
+      }
+      if (!shared.healthy) process.exit(1);
+      return;
+    }
+
     if (opts.command === 'meta') {
       if (!opts.key) {
         console.error('Usage: total-recall secret meta <key> [--repo ...] [--tier ...]');
@@ -475,6 +635,11 @@ export default async function secretCli(argv) {
       if (opts.project) patch.project_path = opts.project;
       if (opts.provider) patch.provider = opts.provider;
       if (opts.scope) patch.scope = opts.scope;
+      if (opts.tracking_exempt != null) {
+        patch.tracking_exempt = opts.tracking_exempt;
+        if (opts.tracking_exempt) patch.tracking_status = 'exempt';
+      }
+      if (opts.shared_ok != null) patch.shared_value_ok = opts.shared_ok;
       // Fill docs from catalog if provider set and no docs
       if (patch.provider && !patch.api_docs_url) {
         const p = getProvider(patch.provider);
@@ -538,10 +703,22 @@ export default async function secretCli(argv) {
       console.log(`\n  Secrets metadata — ${resolveSecretsPath(brainDir)}\n`);
       for (const r of rows) {
         const repos = r.repos?.length ? r.repos.join(',') : '-';
+        const tr = r.tracking_status || 'never';
+        const trIcon = tr === 'ok' ? '✅' : tr === 'exempt' ? '⏭' : '❌';
+        const share = r.shared_value ? ' 🔗SHARED' : '';
         console.log(
-          `  • ${r.key.padEnd(28)} len=${String(r.length).padStart(4)}  ${(r.provider || '-').padEnd(12)} tier=${r.subscription_tier || '-'}  $${r.monthly_cost_usd ?? '-'}  repos=${repos}`,
+          `  • ${r.key.padEnd(28)} len=${String(r.length).padStart(4)}  ${(r.provider || '-').padEnd(12)} ${trIcon}${tr.padEnd(7)} tier=${r.subscription_tier || '-'}  $${r.monthly_cost_usd ?? '-'}  repos=${repos}${share}`,
         );
         if (r.api_docs_url) console.log(`      docs: ${r.api_docs_url}`);
+        if (r.tracking_error && tr === 'error') console.log(`      tracking: ${r.tracking_error}`);
+        if (r.shared_value_error) {
+          console.log(`      shared: ${r.shared_value_error}`);
+          if (r.shared_with?.length) {
+            console.log(
+              `      same value as: ${r.shared_with.map((s) => `${s.key}(${s.app})`).join(', ')}`,
+            );
+          }
+        }
       }
       console.log('');
       return;
@@ -808,9 +985,12 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'check-surfaces') {
       const texts = [];
+      const agentRoot = path.dirname(path.dirname(brainDir)); // …/skills/total-recall → …/.agent (or similar)
       const candidates = [
-        path.join(brainDir, 'INSTRUCTIONS.md'),
         path.join(process.cwd(), 'INSTRUCTIONS.md'),
+        path.join(process.cwd(), 'AGENTS.md'),
+        path.join(agentRoot, 'INSTRUCTIONS.md'),
+        path.join(brainDir, 'INSTRUCTIONS.md'), // legacy
         path.join(brainDir, 'openwiki'),
       ];
       for (const c of candidates) {

package/src/cli/share.mjs

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { parseLayerFlag, resolveBrainDir, getBothBrains, defaultLayerForCategory } from './agent-dir.mjs';
+import { parseLayerFlag, resolveAgentDir, resolveBrainDir, getBothBrains, defaultLayerForCategory } from './agent-dir.mjs';
 import { createMemoryNode } from '../core/vault.mjs';
 import { writeNodeValidatedAsync } from '../core/validated-write.mjs';
 import { addToQueue } from '../core/research-queue.mjs';
@@ -128,10 +128,12 @@ export default async function share(args) {
   }
 
   const resolvedBrainDir = resolveBrainDir(layer);
+  const resolvedAgentDir = resolveAgentDir(layer);
   const vaultDir = path.join(resolvedBrainDir, 'memory-vault');
-  const skillsDir = path.join(resolvedBrainDir, '..', '..');
+  // skillsDir must be <agent>/.agent/skills (or ~/.agent/skills), not the agent root
+  const skillsDir = path.join(resolvedAgentDir, 'skills');
   const derivedDir = path.join(resolvedBrainDir, 'memory-derived');
-  const instructionsFile = path.join(skillsDir, '..', 'INSTRUCTIONS.md');
+  const instructionsFile = path.join(resolvedAgentDir, 'INSTRUCTIONS.md');
 
   const slugBase = category || 'facts';
   const slug = `${slugBase}-${crypto.randomBytes(4).toString('hex')}`;

package/src/cli/skill-projection.mjs

@@ -70,6 +70,22 @@ function pathExists(filePath) {
   }
 }
 
+// Marker written by tools like repo-expert-generate.mjs into any SKILL.md
+// they produce. A real (non-symlink) directory carrying this marker is
+// leftover tool output, not a user's hand-authored skill — it is always safe
+// to heal back onto the canonical source, even without --force.
+const AUTO_GENERATED_MARKER = '**Auto-generated** by `npx total-recall';
+
+function isStaleGeneratedDir(entryPath) {
+  try {
+    if (!fs.statSync(entryPath).isDirectory()) return false;
+    const content = fs.readFileSync(path.join(entryPath, 'SKILL.md'), 'utf8');
+    return content.includes(AUTO_GENERATED_MARKER);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Skill source roots, in priority order. The canonical Total Recall location
  * (.agent/skills, singular) wins, but we also scan the Antigravity-native
@@ -115,7 +131,10 @@ export function discoverRepoSkills(agentDir) {
  * Idempotent, self-healing, and strictly additive: a symlink that is broken or
  * stale is refreshed even without --force; a *real* (non-symlink) entry is
  * never clobbered unless --force (so a user's own skill always wins a name
- * collision); a skill whose source already *is* the destination is left alone.
+ * collision) — UNLESS that real entry is itself stale tool output (carries
+ * the auto-generated marker), in which case it is healed back onto the
+ * canonical source; a skill whose source already *is* the destination is
+ * left alone.
  */
 export function projectSkillsAsCommands(destDir, skills, opts = {}) {
   fs.mkdirSync(destDir, { recursive: true });
@@ -138,7 +157,7 @@ export function projectSkillsAsCommands(destDir, skills, opts = {}) {
           continue;
         }
         fs.unlinkSync(linkPath); // stale, broken, or --force → refresh
-      } else if (!opts.force) {
+      } else if (!opts.force && !isStaleGeneratedDir(linkPath)) {
         written.push({ name: skill.name, action: 'skipped' }); // user's real file/dir wins
         continue;
       } else {

package/src/cli/snapshot.mjs

@@ -1,5 +1,5 @@
 import { createSnapshot, listSnapshots, rollbackVault } from '../core/snapshot.mjs';
-import { resolveAgentDir, resolveBrainDir } from './agent-dir.mjs';
+import { resolveAgentDir, resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 import { compileSurface } from '../core/surface.mjs';
 import path from 'path';
 
@@ -24,20 +24,22 @@ function printHelp() {
     rollback <id>      Restore the vault to a specific snapshot ID
 
   Options:
-    --help, -h         Show this help
+    --global / --project  Target brain layer (default: auto — project if present)
+    --help, -h            Show this help
 `);
 }
 
 export default async function snapshotCli(args) {
-  if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
+  const { layer, remainingArgs } = parseLayerFlag(args);
+  if (remainingArgs.length === 0 || remainingArgs.includes('--help') || remainingArgs.includes('-h')) {
     printHelp();
     return;
   }
 
-  const command = args[0];
+  const command = remainingArgs[0];
 
   if (command === 'create') {
-    const reason = args.slice(1).join(' ') || 'manual';
+    const reason = remainingArgs.slice(1).join(' ') || 'manual';
     console.log('📸 Creating snapshot...');
     const result = createSnapshot(reason);
     if (result.success) {
@@ -69,7 +71,7 @@ export default async function snapshotCli(args) {
   }
 
   else if (command === 'rollback') {
-    const id = args[1];
+    const id = remainingArgs[1];
     if (!id) {
       console.error('❌ You must provide a snapshot ID to rollback to.');
       console.error('Usage: total-recall snapshot rollback <id>');
@@ -84,8 +86,8 @@ export default async function snapshotCli(args) {
       console.log(`✅ Rollback successful.`);
       console.log(`🔄 Recompiling derived indexes from restored vault...`);
       
-      const agentDir = resolveAgentDir();
-      const brainDir = resolveBrainDir();
+      const agentDir = resolveAgentDir(layer);
+      const brainDir = resolveBrainDir(layer);
       await compileSurface({
         vaultDir: path.join(brainDir, 'memory-vault'),
         skillsDir: path.join(agentDir, 'skills'),

package/src/cli/update.mjs

@@ -16,7 +16,8 @@ import {
 } from '../core/package-auto-update.mjs';
 import { brainDir } from '../core/config.mjs';
 
-function parseArgs(args) {
+/** @param {string[]} args */
+export function parseArgs(args) {
   const opts = {
     apply: false,
     force: false,

package/src/core/clarity-rewriter.mjs

@@ -567,24 +567,42 @@ export async function runCutoffAudit({ vaultDir, queueDir, runtimeConfig }) {
   return { audited: batch.length, flagged, critical };
 }
 
+/** Resolve vault dir from node file path (…/memory-vault/category/slug.md). */
+function vaultDirFromNodeFile(filePath) {
+  if (!filePath) return null;
+  let cur = path.dirname(filePath);
+  while (cur && cur !== path.dirname(cur)) {
+    if (path.basename(cur) === 'memory-vault') return cur;
+    cur = path.dirname(cur);
+  }
+  // Fallback: parent of category dir
+  return path.dirname(path.dirname(filePath));
+}
+
+function nodeFilePath(node) {
+  return node?._filepath || node?._filePath || null;
+}
+
 async function stampVerified(node) {
-  if (!node._filepath) return;
+  const fp = nodeFilePath(node);
+  if (!fp) return;
   try {
-    const raw = fs.readFileSync(node._filepath, 'utf8');
+    const raw = fs.readFileSync(fp, 'utf8');
     const { data, content } = matter(raw);
     data.x_cutoff_verified_at = new Date().toISOString();
     data.x_cutoff_risk = 'none';
-    atomicWrite(node._filepath, safeStringify(content, data));
-    invalidate(path.dirname(node._filepath));
+    atomicWrite(fp, safeStringify(content, data));
+    invalidate(vaultDirFromNodeFile(fp));
   } catch (err) {
     logger.debug('clarity-rewriter: stampCutoffRiskNone failed', { err: err.message });
   }
 }
 
 async function stampCutoffRisk(node, riskLevel, claimCount) {
-  if (!node._filepath) return;
+  const fp = nodeFilePath(node);
+  if (!fp) return;
   try {
-    const raw = fs.readFileSync(node._filepath, 'utf8');
+    const raw = fs.readFileSync(fp, 'utf8');
     const { data, content } = matter(raw);
     data.x_cutoff_risk = riskLevel;
     data.x_cutoff_claim_count = claimCount;
@@ -592,8 +610,8 @@ async function stampCutoffRisk(node, riskLevel, claimCount) {
     // Lower confidence to reflect that claims are unverified
     const confidencePenalty = riskLevel === 'critical' ? 0.3 : riskLevel === 'high' ? 0.2 : 0.1;
     data.confidence = Math.max(0.1, (data.confidence || 0.5) - confidencePenalty);
-    atomicWrite(node._filepath, safeStringify(content, data));
-    invalidate(path.dirname(node._filepath));
+    atomicWrite(fp, safeStringify(content, data));
+    invalidate(vaultDirFromNodeFile(fp));
   } catch (err) {
     logger.debug('clarity-rewriter: stampCutoffRisk failed', { err: err.message });
   }
@@ -756,9 +774,10 @@ export async function writeCorrection(originalSlug, researchEvidence, { vaultDir
 }
 
 async function stampNodeForCorrection(node, correctionSlug, disposition) {
-  if (!node._filepath) return;
+  const fp = nodeFilePath(node);
+  if (!fp) return;
   try {
-    const raw = fs.readFileSync(node._filepath, 'utf8');
+    const raw = fs.readFileSync(fp, 'utf8');
     const { data, content } = matter(raw);
     data.status = disposition === 'deleted' ? 'archived' : 'superseded';
     data.superseded_by = correctionSlug;
@@ -766,8 +785,8 @@ async function stampNodeForCorrection(node, correctionSlug, disposition) {
     // Lower confidence significantly — this fact has been proven wrong
     data.confidence = Math.max(0.05, (data.confidence || 0.5) * 0.3);
     data.updated = new Date().toISOString();
-    atomicWrite(node._filepath, safeStringify(content, data));
-    invalidate(path.dirname(node._filepath));
+    atomicWrite(fp, safeStringify(content, data));
+    invalidate(vaultDirFromNodeFile(fp));
   } catch (err) {
     logger.debug('clarity-rewriter: stampNodeForCorrection failed', { err: err.message });
   }