vault-go 0.20.0 → 0.22.0

package/dist/grok-awareness.js

@@ -0,0 +1,244 @@
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { loadConfig, loadTokens } from './config.js';
+import { redact } from './capture-privacy.js';
+const AGENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_LOG_BYTES = 1_048_576;
+function credential(home) {
+    return process.env['VAULT_GO_TOKEN'] || loadTokens(home)?.accessToken || '';
+}
+function owner(home) {
+    const token = credential(home);
+    if (!token)
+        return '';
+    const config = loadConfig(home);
+    return createHash('sha256').update(JSON.stringify([config.apiUrl, config.email ?? '', token])).digest('hex');
+}
+export function awarenessAccountBinding(home) {
+    return createHash('sha256').update(JSON.stringify([owner(home), credential(home)])).digest('hex');
+}
+function defaults(home) { return { owner: owner(home), enabled: false, agentDataRoot: '', agentIds: [], triggerTypes: [], triggerConcepts: [] }; }
+function load(home) {
+    try {
+        const file = join(home, 'grok-awareness.json');
+        if (statSync(file).size > 64_000)
+            return defaults(home);
+        const value = JSON.parse(readFileSync(file, 'utf8'));
+        if (value.owner !== owner(home) || typeof value.agentDataRoot !== 'string' || ![value.agentIds, value.triggerTypes, value.triggerConcepts].every(v => Array.isArray(v) && v.length <= 50 && v.every(s => typeof s === 'string' && s.length <= 100)))
+            return defaults(home);
+        return value;
+    }
+    catch {
+        return defaults(home);
+    }
+}
+function save(home, config) {
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    const file = join(home, 'grok-awareness.json'), temp = `${file}.${randomUUID()}.tmp`;
+    writeFileSync(temp, JSON.stringify(config) + '\n', { mode: 0o600 });
+    renameSync(temp, file);
+    chmodSync(file, 0o600);
+}
+export function awarenessStatus(home) {
+    const { owner: _owner, ...config } = load(home);
+    return { ...config, maxLineChars: 500, maxLogBytes: MAX_LOG_BYTES, transport: 'local-monthly-agent-log', requiresAgentId: true };
+}
+export function configureAwareness(home, input) {
+    const config = load(home);
+    if (input.enabled) {
+        if (input.consent !== true || !owner(home))
+            throw new Error('Ativar awareness exige conta autenticada e consent=true.');
+        const root = input.agentDataRoot ?? config.agentDataRoot;
+        if (!isAbsolute(root) || !statSync(root).isDirectory())
+            throw new Error('Informe uma raiz absoluta existente para os dados dos agentes Grok.');
+        const agentIds = [...new Set(input.agentIds ?? config.agentIds)];
+        const triggerTypes = [...new Set(input.triggerTypes ?? config.triggerTypes)], triggerConcepts = [...new Set(input.triggerConcepts ?? config.triggerConcepts)];
+        if (!agentIds.length || agentIds.length > 50 || agentIds.some(id => !AGENT_ID.test(id)))
+            throw new Error('Informe de 1 a 50 UUIDs de agentes permitidos.');
+        if (![triggerTypes, triggerConcepts].every(v => v.length <= 50 && v.every(s => s.length > 0 && s.length <= 100)) || !triggerTypes.length && !triggerConcepts.length)
+            throw new Error('Defina ao menos um filtro de tipo/conceito, com até 50 valores por lista.');
+        Object.assign(config, { owner: owner(home), enabled: true, agentDataRoot: realpathSync(root), agentIds, triggerTypes, triggerConcepts });
+    }
+    else
+        config.enabled = false;
+    delete config.lastError;
+    save(home, config);
+    return awarenessStatus(home);
+}
+function lineFor(observation, now) {
+    if (observation.private || /<(private|vault-private)\b/i.test(JSON.stringify(observation)))
+        return null;
+    const clean = (value) => String(redact(value)).replace(/\s+/g, ' ').trim();
+    const title = [observation.title, observation.subtitle].filter((v) => typeof v === 'string').map(clean).filter(Boolean).join(': ');
+    const detail = [title, clean(observation.facts?.[0] ?? '')].filter(Boolean).join('. ');
+    const line = `- ${now.toISOString().slice(0, 10)} [awareness] ${clean(observation.type)}${detail ? ` — ${detail}` : ''}`;
+    if (line.length <= 500)
+        return line;
+    let prefix = line.slice(0, 499);
+    if (/[\uD800-\uDBFF]$/.test(prefix))
+        prefix = prefix.slice(0, -1);
+    return `${prefix}…`;
+}
+function ensureDirectory(root, parts) {
+    if (realpathSync(root) !== root || !lstatSync(root).isDirectory())
+        throw new Error('Unsafe agent data root');
+    let path = root;
+    for (const part of parts) {
+        path = join(path, part);
+        if (!existsSync(path))
+            mkdirSync(path, { mode: 0o700 });
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink() || !stat.isDirectory() || realpathSync(path) !== path)
+            throw new Error('Unsafe agent directory');
+    }
+    return path;
+}
+async function lock(home) {
+    const file = join(home, 'grok-awareness.lock'), token = randomUUID();
+    for (let attempt = 0; attempt < 100; attempt++) {
+        try {
+            writeFileSync(file, JSON.stringify({ pid: process.pid, token }), { flag: 'wx', mode: 0o600 });
+            return () => { try {
+                if (JSON.parse(readFileSync(file, 'utf8')).token === token)
+                    rmSync(file);
+            }
+            catch { /* another owner */ } };
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const before = statSync(file);
+                if (before.size > 1024)
+                    throw new Error('Invalid lock');
+                const pid = Number(JSON.parse(readFileSync(file, 'utf8')).pid);
+                if (Number.isInteger(pid) && pid > 0) {
+                    try {
+                        process.kill(pid, 0);
+                    }
+                    catch (probe) {
+                        if (probe.code === 'ESRCH') {
+                            const after = statSync(file);
+                            if (before.ino === after.ino && before.mtimeMs === after.mtimeMs)
+                                rmSync(file);
+                        }
+                    }
+                }
+            }
+            catch { /* changed or invalid lock: do not remove another writer */ }
+            await new Promise(r => setTimeout(r, 10));
+        }
+    }
+    throw new Error('Awareness writer is busy');
+}
+export async function pushAwareness(home, input, now = new Date(), io = fs) {
+    const initial = load(home), identity = owner(home);
+    let release;
+    const result = { written: 0, skipped: input.observations.length };
+    if (!identity || !initial.enabled || !input.agentId || !AGENT_ID.test(input.agentId) || !initial.agentIds.includes(input.agentId))
+        return result;
+    try {
+        if (input.observations.length > 100)
+            throw new Error('Batch exceeds 100 observations');
+        release = await lock(home);
+        const config = load(home);
+        if (!config.enabled || owner(home) !== identity || config.agentDataRoot !== initial.agentDataRoot || !config.agentIds.includes(input.agentId))
+            return result;
+        const lines = input.observations.filter(obs => config.triggerTypes.includes(obs.type) || obs.concepts?.some(concept => config.triggerConcepts.includes(concept))).map(obs => lineFor(obs, now)).filter((line) => Boolean(line));
+        if (!lines.length)
+            return result;
+        const parts = ['agents', input.agentId, 'memory', 'log'], directory = ensureDirectory(config.agentDataRoot, parts), file = join(directory, `${now.toISOString().slice(0, 7)}.md`);
+        const body = (line) => { const index = line.indexOf('[awareness]'); return (index < 0 ? line : line.slice(index)).trim(); };
+        const unique = (text, candidates) => {
+            const seen = new Set(text.split('\n').map(body)), additions = [];
+            for (const line of candidates)
+                if (!seen.has(body(line))) {
+                    seen.add(body(line));
+                    additions.push(line);
+                }
+            return additions;
+        };
+        const compose = (text, additions) => text + (text && !text.endsWith('\n') ? '\n' : '') + additions.join('\n') + '\n';
+        if (!existsSync(file)) {
+            const additions = unique('', lines);
+            if (additions.length) {
+                const next = compose('', additions);
+                if (Buffer.byteLength(next) > MAX_LOG_BYTES)
+                    throw new Error('Monthly log too large');
+                const temp = join(directory, `.awareness-${randomUUID()}.tmp`);
+                try {
+                    writeFileSync(temp, next, { mode: 0o600, flag: 'wx' });
+                    ensureDirectory(config.agentDataRoot, parts);
+                    renameSync(temp, file);
+                    chmodSync(file, 0o600);
+                }
+                finally {
+                    rmSync(temp, { force: true });
+                }
+                result.written = additions.length;
+                result.skipped -= additions.length;
+            }
+        }
+        else {
+            const stat = lstatSync(file);
+            if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1 || stat.size > MAX_LOG_BYTES)
+                throw new Error('Unsafe monthly log');
+            let existing = io.readFileSync(file, 'utf8');
+            if (Buffer.byteLength(existing) > MAX_LOG_BYTES)
+                throw new Error('Monthly log too large');
+            const fd = fs.openSync(file, 'r+');
+            try {
+                const current = fs.fstatSync(fd), pathStat = lstatSync(file);
+                if (current.ino !== stat.ino || pathStat.ino !== stat.ino || current.nlink !== 1 || !current.isFile() || pathStat.isSymbolicLink())
+                    throw new Error('Monthly log rotated');
+                if (current.size > MAX_LOG_BYTES)
+                    throw new Error('Monthly log too large');
+                if (current.size !== Buffer.byteLength(existing)) {
+                    const buf = Buffer.alloc(current.size);
+                    existing = buf.subarray(0, io.readSync(fd, buf, 0, current.size, 0)).toString('utf8');
+                    const after = fs.fstatSync(fd);
+                    if (after.ino !== stat.ino || lstatSync(file).ino !== stat.ino)
+                        throw new Error('Monthly log rotated');
+                    if (after.size > MAX_LOG_BYTES || Buffer.byteLength(existing) > MAX_LOG_BYTES)
+                        throw new Error('Monthly log too large');
+                }
+                const additions = unique(existing, lines);
+                if (additions.length) {
+                    const next = compose(existing, additions);
+                    if (Buffer.byteLength(next) > MAX_LOG_BYTES)
+                        throw new Error('Monthly log too large');
+                    const encoded = Buffer.from(next, 'utf8');
+                    fs.writeSync(fd, encoded, 0, encoded.length, 0);
+                    fs.ftruncateSync(fd, encoded.length);
+                    fs.fsyncSync(fd);
+                    result.written = additions.length;
+                    result.skipped -= additions.length;
+                }
+            }
+            finally {
+                fs.closeSync(fd);
+            }
+            chmodSync(file, 0o600);
+        }
+        config.lastPush = Date.now();
+        delete config.lastError;
+        save(home, config);
+    }
+    catch {
+        result.error = 'awareness_write_failed';
+        const config = load(home);
+        if (config.owner === identity) {
+            config.lastError = result.error;
+            try {
+                save(home, config);
+            }
+            catch { /* status cannot be persisted when storage is unavailable */ }
+        }
+    }
+    finally {
+        release?.();
+    }
+    return result;
+}

package/dist/hook-install.d.ts

@@ -9,6 +9,11 @@ export declare const HOOK_EVENTS: {
 export declare function quoteShell(value: string): string;
 export declare function hookEntryPath(configHome?: string): string;
 export declare function hookCommand(adapter: string, event: string, configHome?: string): string;
-export type HookClient = "claude" | "codex" | "grok" | "agy";
+export type HookClient = "claude" | "codex" | "grok" | "agy" | "gemini";
 export declare function installClientHooks(client: HookClient, userHome?: string, configHome?: string): void;
-export declare function repairClientHooks(userHome?: string, configHome?: string): void;
+export declare function installOpenCodePlugin(userHome?: string, configHome?: string): void;
+/** Repairs only clients explicitly connected to Vault; never installs a CLI. */
+export declare function repairAdditionalClientHooks(userHome?: string, configHome?: string, report?: typeof reportRepairWarning): void;
+declare function reportRepairWarning(message: string): void;
+export declare function repairClientHooks(userHome?: string, configHome?: string, report?: typeof reportRepairWarning): void;
+export {};

package/dist/hook-install.js

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { vaultHome } from "./config.js";
 function readJsonObject(path) {
     if (!existsSync(path))
@@ -21,9 +21,12 @@ function readJsonObject(path) {
     return parsed;
 }
 function atomicWriteJson(path, value) {
+    atomicWriteText(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+function atomicWriteText(path, text) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.tmp`);
-    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+    writeFileSync(temporary, text, {
         mode: 0o600,
     });
     renameSync(temporary, path);
@@ -37,6 +40,12 @@ export const HOOK_EVENTS = {
     PostToolUse: "observation",
     Stop: "summarize",
 };
+const GEMINI_EVENTS = {
+    SessionStart: "context",
+    BeforeAgent: "session-init",
+    AfterTool: "observation",
+    AfterAgent: "summarize",
+};
 export function quoteShell(value) {
     return "'" + value.replaceAll("'", "'\\''") + "'";
 }
@@ -51,7 +60,7 @@ export function hookCommand(adapter, event, configHome = vaultHome()) {
 }
 function hookManifest(adapter, configHome = vaultHome()) {
     return {
-        hooks: Object.fromEntries(Object.entries(HOOK_EVENTS).map(([name, event]) => [
+        hooks: Object.fromEntries(Object.entries(adapter === "gemini" ? GEMINI_EVENTS : HOOK_EVENTS).map(([name, event]) => [
             name,
             [
                 {
@@ -59,10 +68,15 @@ function hookManifest(adapter, configHome = vaultHome()) {
                         {
                             type: "command",
                             command: hookCommand(adapter, event, configHome),
-                            timeout: event === "context" ? 60 : 20,
-                            statusMessage: HOOK_OWNER,
-                            ...(event === "observation" ||
-                                event === "summarize"
+                            ...(adapter === "gemini" ? {
+                                timeout: event === "context" ? 60000 : 20000,
+                                name: `vault-go:${event}`,
+                                description: HOOK_OWNER,
+                            } : {
+                                timeout: event === "context" ? 60 : 20,
+                                statusMessage: HOOK_OWNER,
+                            }),
+                            ...(adapter !== "gemini" && (event === "observation" || event === "summarize")
                                 ? { async: true }
                                 : {}),
                         },
@@ -100,7 +114,7 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
         atomicWriteJson(path, { ...config, "vault-go": agyHookManifest(configHome) });
         return;
     }
-    const path = join(userHome, client === "claude" ? ".claude/settings.json" : ".codex/hooks.json");
+    const path = join(userHome, client === "claude" ? ".claude/settings.json" : client === "gemini" ? ".gemini/settings.json" : ".codex/hooks.json");
     const config = readJsonObject(path);
     const hooks = {
         ...(config.hooks &&
@@ -110,7 +124,7 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
             : {}),
     };
     const desired = hookManifest(client, configHome).hooks;
-    for (const event of Object.keys(HOOK_EVENTS)) {
+    for (const event of Object.keys(desired)) {
         const current = hooks[event];
         const retained = Array.isArray(current)
             ? current
@@ -121,7 +135,8 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
                     return group;
                 const filtered = group.hooks.filter((hook) => !hook ||
                     typeof hook !== "object" ||
-                    hook.statusMessage !== HOOK_OWNER);
+                    (hook.statusMessage !== HOOK_OWNER &&
+                        !(client === "gemini" && hook.name === `vault-go:${GEMINI_EVENTS[event]}`)));
                 return { ...group, hooks: filtered };
             })
                 .filter((group) => !group ||
@@ -133,15 +148,56 @@ export function installClientHooks(client, userHome = homedir(), configHome = va
     }
     atomicWriteJson(path, { ...config, hooks });
 }
-export function repairClientHooks(userHome = homedir(), configHome = vaultHome()) {
-    installClientHooks("claude", userHome, configHome);
-    installClientHooks("codex", userHome, configHome);
+const OPENCODE_OWNER = "// Managed by vault-go: automatic memory context";
+export function installOpenCodePlugin(userHome = homedir(), configHome = vaultHome()) {
+    const path = join(userHome, ".config", "opencode", "plugins", "vault-go-memory.js");
+    if (existsSync(path) && !readFileSync(path, "utf8").startsWith(OPENCODE_OWNER + "\n")) {
+        throw new Error(`Refusing to replace an unowned plugin: ${path}`);
+    }
+    const runtime = pathToFileURL(join(configHome, "local-runtime", "dist", "opencode-plugin.js")).href;
+    atomicWriteText(path, `${OPENCODE_OWNER}\nexport default async function(input) {\n  try {\n    const runtime = await import(${JSON.stringify(runtime)});\n    return runtime.createOpenCodePlugin(input, { home: ${JSON.stringify(configHome)} });\n  } catch { return {}; }\n}\n`);
+}
+/** Repairs only clients explicitly connected to Vault; never installs a CLI. */
+export function repairAdditionalClientHooks(userHome = homedir(), configHome = vaultHome(), report = reportRepairWarning) {
+    repairClient("gemini", () => {
+        const gemini = readJsonObject(join(userHome, ".gemini", "settings.json"));
+        const server = gemini.mcpServers?.["vault-go"];
+        if (server && server.enabled !== false && server.disabled !== true) {
+            installClientHooks("gemini", userHome, configHome);
+        }
+    }, report);
+    repairClient("opencode", () => {
+        const opencode = readJsonObject(join(userHome, ".config", "opencode", "opencode.json"));
+        const server = opencode.mcp?.["vault-go"];
+        if (server && server.enabled !== false)
+            installOpenCodePlugin(userHome, configHome);
+    }, report);
+}
+function reportRepairWarning(message) {
+    process.stderr.write(message + "\n");
+}
+function repairClient(client, repair, report) {
+    try {
+        repair();
+    }
+    catch {
+        // Client configuration failures must not stop another client's repair or reveal its contents.
+        try {
+            report(`Vault Go: reparo de ${client} pendente; configuração existente preservada.`);
+        }
+        catch { }
+    }
+}
+export function repairClientHooks(userHome = homedir(), configHome = vaultHome(), report = reportRepairWarning) {
+    repairAdditionalClientHooks(userHome, configHome, report);
+    repairClient("claude", () => installClientHooks("claude", userHome, configHome), report);
+    repairClient("codex", () => installClientHooks("codex", userHome, configHome), report);
     if (existsSync(join(userHome, ".grok"))) {
-        installClientHooks("grok", userHome, configHome);
+        repairClient("grok", () => installClientHooks("grok", userHome, configHome), report);
     }
     if (existsSync(join(userHome, ".gemini", "config")) ||
         existsSync(join(userHome, ".gemini", "antigravity")) ||
         existsSync(join(userHome, ".gemini", "antigravity-cli"))) {
-        installClientHooks("agy", userHome, configHome);
+        repairClient("agy", () => installClientHooks("agy", userHome, configHome), report);
     }
 }

package/dist/hook-queue.d.ts

@@ -1,9 +1,11 @@
 import { VaultCloudClient } from './cloud.js';
 import { generateContext, type ContextResult } from './context-engines.js';
+import { type TelegramObservation } from './telegram.js';
 export interface GenerationJob {
     id: string;
     projectId: string;
     sessionId?: string;
+    agentId?: string;
     text: string;
     title?: string;
     kind: 'observation' | 'summary' | 'prompt';
@@ -15,7 +17,7 @@ export interface GenerationJob {
     attempts?: number;
     nextAttemptAt?: number;
     lastError?: string;
-    result?: Pick<ContextResult, 'title' | 'content' | 'facts' | 'concepts'>;
+    result?: Pick<ContextResult, 'title' | 'content' | 'facts' | 'concepts' | 'type'>;
 }
 export declare function enqueueGeneration(home: string, job: GenerationJob): Promise<void>;
 export declare function generationQueueStatus(home?: string): {
@@ -24,4 +26,6 @@ export declare function generationQueueStatus(home?: string): {
     legacyAwaitingOwnership: number;
     heldForOtherAccount: number;
 };
-export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContext): Promise<boolean>;
+export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContext, options?: {
+    notifyObservation?: (observation: TelegramObservation) => Promise<unknown>;
+}): Promise<boolean>;

package/dist/hook-queue.js

@@ -4,10 +4,12 @@ import { join } from 'node:path';
 import { VaultCloudClient } from './cloud.js';
 import { loadConfig, loadTokens, vaultHome } from './config.js';
 import { generateContext, selectedContextEngine } from './context-engines.js';
+import { notifyTelegramObservation } from './telegram.js';
+import { pushAwareness } from './grok-awareness.js';
 const queuePath = (home) => join(home, 'generation-queue.json');
 function ownerKey(home) {
     const config = loadConfig(home);
-    return createHash('sha256').update(JSON.stringify([config.apiUrl, process.env['VAULT_GO_TOKEN'] ?? config.email ?? loadTokens(home)?.accessToken ?? 'anonymous'])).digest('hex');
+    return createHash('sha256').update(JSON.stringify([config.apiUrl, process.env['VAULT_GO_TOKEN'] || config.email || loadTokens(home)?.accessToken || 'anonymous'])).digest('hex');
 }
 function readQueue(home) {
     if (!existsSync(queuePath(home)))
@@ -93,7 +95,7 @@ export function generationQueueStatus(home = vaultHome()) {
     const jobs = readQueue(home), owner = ownerKey(home);
     return { pending: jobs.filter(j => j.owner === owner || !j.owner).length, failed: jobs.filter(j => j.owner === owner && j.lastError).length, legacyAwaitingOwnership: jobs.filter(j => !j.owner).length, heldForOtherAccount: jobs.filter(j => j.owner && j.owner !== owner).length };
 }
-export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContext) {
+export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContext, options = {}) {
     const release = await lock(home, 'generation-worker', false);
     if (!release)
         return false;
@@ -113,23 +115,40 @@ export async function processGenerationQueue(home = vaultHome(), cloud = new Vau
             return false;
         try {
             const result = job.result ?? (job.generate === false ? { title: job.title ?? 'Memória', content: job.text, facts: [], concepts: [] } : await generate(home, selectedContextEngine(home), job.text, {
-                ...(cloud.observerGenerate ? { managedGenerate: (text, options) => cloud.observerGenerate(text, options.signal) } : {}),
+                ...(cloud.observerGenerate ? { managedGenerate: (text, options) => cloud.observerGenerate(text, options.signal, options.modeGuidance ? { modeGuidance: options.modeGuidance } : undefined) } : {}),
             }));
             if (owner !== ownerKey(home))
                 throw new Error('Account changed.');
             // Cache successful generation before persistence, so a network retry does not pay for the model twice.
             await mutate(home, jobs => jobs.map(item => item.id === job.id ? { ...item, result } : item));
+            const memoryType = result.type ?? 'discovery';
             await cloud.importMemories({ projectId: job.projectId, records: [{
                         sourceId: `vault-go:event:${job.id}`,
                         ...(job.sessionId ? { sessionId: job.sessionId } : {}),
                         kind: job.kind,
-                        memoryType: 'discovery',
+                        memoryType,
                         title: result.title || job.title,
                         content: result.content.slice(0, job.maxChars ?? 4000),
                         facts: result.facts, concepts: result.concepts,
                         filesRead: job.filesRead ?? [], filesModified: job.filesModified ?? [],
                     }] });
+            if (owner !== ownerKey(home))
+                throw new Error('Account changed.');
+            const awareness = await pushAwareness(home, { ...(job.agentId ? { agentId: job.agentId } : {}), observations: [{ type: memoryType, title: result.title || job.title || 'Memória', facts: result.facts, concepts: result.concepts }] });
+            if (awareness.error)
+                throw new Error('Awareness delivery failed; retry with cached generation.');
             await mutate(home, jobs => jobs.filter(item => item.id !== job.id));
+            if (job.kind === 'observation' && owner === ownerKey(home)) {
+                try {
+                    await (options.notifyObservation ?? ((observation) => notifyTelegramObservation(home, observation)))({
+                        id: job.id,
+                        type: memoryType,
+                        title: result.title,
+                        concepts: result.concepts,
+                    });
+                }
+                catch { /* notification delivery never retries an already persisted memory */ }
+            }
         }
         catch {
             await mutate(home, jobs => jobs.map(item => item.id !== job.id ? item : {

package/dist/hooks.d.ts

@@ -1,11 +1,12 @@
+export { redact } from './capture-privacy.js';
 import { type VaultMemoryApi } from "./cloud.js";
 export declare const HOOK_EVENTS: readonly ["context", "session-init", "observation", "file-context", "summarize"];
 export type HookEvent = (typeof HOOK_EVENTS)[number];
 type RecordValue = Record<string, unknown>;
-export declare function redact(value: unknown): unknown;
 export declare function normalizeHookInput(adapter: string, value: unknown): RecordValue;
 export declare function hookOutput(event: HookEvent, context?: string, adapter?: string): RecordValue;
-export declare function executeHook(adapter: string, event: HookEvent, value: unknown, cloud?: VaultMemoryApi, home?: string): Promise<RecordValue>;
+export declare function executeHook(adapter: string, event: HookEvent, value: unknown, cloud?: VaultMemoryApi, home?: string, options?: {
+    transcript?: boolean;
+}): Promise<RecordValue>;
 export declare function readHookInput(stream?: NodeJS.ReadableStream): Promise<unknown>;
 export declare function runHook(adapter: string, event: string): Promise<void>;
-export {};