vault-go 0.30.0 → 0.31.0

package/README.md

@@ -32,6 +32,18 @@ Credentials are stored in `~/.memvault/auth.json` (`0600`). The directory is `07
 
 ## Install MCP
 
+### Install private skills directly
+
+After `vault-go login`, install private skill packages from the authenticated Vault account with one command:
+
+```sh
+vault-go skills list
+vault-go skills install --skill my-skill
+vault-go skills install --all
+```
+
+Installation defaults to `~/.agents/skills`, shared by Codex and other compatible agents. Use `--target claude` or `--target grok` for those clients' own skill directories. The command downloads the real package through your Vault account and verifies its integrity. With `--all`, existing skills that Vault did not install are preserved and reported as skipped; selecting one of them explicitly returns a conflict. The person with access to the target machine can read the installed files.
+
 ### Full local server (capture + write)
 
 The setup wizard:

package/dist/agent-cost.d.ts

@@ -0,0 +1,11 @@
+export interface AgentCostReport {
+    label: 'ESTIMATED';
+    files: number;
+    inputTokens: number;
+    outputTokens: number;
+    usd: number | null;
+    unavailable: string[];
+    note: string;
+}
+export declare function estimateAgentCost(root: string): AgentCostReport;
+export declare function statuslineText(home: string, version: string): string;

package/dist/agent-cost.js

@@ -0,0 +1,116 @@
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+const INPUT_USD_PER_MILLION = 3;
+const OUTPUT_USD_PER_MILLION = 15;
+const MAX_FILES = 200;
+const MAX_BYTES = 8_000_000;
+function tokens(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const row = value;
+    const input = row.input_tokens ?? row.inputTokens ?? row.prompt_tokens;
+    const output = row.output_tokens ?? row.outputTokens ?? row.completion_tokens;
+    if (typeof input !== 'number' && typeof output !== 'number')
+        return null;
+    return {
+        input: typeof input === 'number' && input >= 0 ? Math.floor(input) : 0,
+        output: typeof output === 'number' && output >= 0 ? Math.floor(output) : 0,
+    };
+}
+function walk(root, dir, files, budget) {
+    if (files.length >= MAX_FILES || budget.bytes >= MAX_BYTES)
+        return;
+    let entries = [];
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries) {
+        if (files.length >= MAX_FILES || budget.bytes >= MAX_BYTES)
+            return;
+        if (name.startsWith('.') || name === 'node_modules')
+            continue;
+        const path = join(dir, name);
+        let stat;
+        try {
+            stat = statSync(path);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isSymbolicLink())
+            continue;
+        if (stat.isDirectory()) {
+            if (relative(root, path).split('/').length > 6)
+                continue;
+            walk(root, path, files, budget);
+        }
+        else if (stat.isFile() && name.endsWith('.jsonl') && stat.size <= MAX_BYTES) {
+            files.push(path);
+            budget.bytes += stat.size;
+        }
+    }
+}
+export function estimateAgentCost(root) {
+    const resolved = resolve(root);
+    const files = [];
+    walk(resolved, resolved, files, { bytes: 0 });
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let measured = 0;
+    for (const file of files) {
+        let text = '';
+        try {
+            text = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of text.split('\n')) {
+            if (!line.trim())
+                continue;
+            let row;
+            try {
+                row = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (!row || typeof row !== 'object')
+                continue;
+            const record = row;
+            const message = record.message && typeof record.message === 'object' ? record.message : {};
+            const usage = tokens(record.usage) ?? tokens(message.usage);
+            if (!usage)
+                continue;
+            inputTokens += usage.input;
+            outputTokens += usage.output;
+            measured += 1;
+        }
+    }
+    const usd = measured
+        ? Math.round(((inputTokens * INPUT_USD_PER_MILLION) + (outputTokens * OUTPUT_USD_PER_MILLION)) / 1_000_000 * 100) / 100
+        : null;
+    return {
+        label: 'ESTIMATED',
+        files: files.length,
+        inputTokens,
+        outputTokens,
+        usd,
+        unavailable: measured ? [] : ['No usage fields were found in the scanned transcripts.'],
+        note: 'Dollars use a public list rate of $3 / million input tokens and $15 / million output tokens. This is an estimate, not an invoice. Observer cost is not included. Vault search remains the semantic index; this report does not read memory content into the total.',
+    };
+}
+export function statuslineText(home, version) {
+    let queued = 0;
+    try {
+        const value = JSON.parse(readFileSync(join(home, 'generation-queue.json'), 'utf8'));
+        queued = Array.isArray(value) ? value.length : 0;
+    }
+    catch {
+        queued = 0;
+    }
+    return `vault-go ${version} queue:${queued}`;
+}

package/dist/auth.js

@@ -3,11 +3,20 @@ import { copy, resolveLocale } from './locale.js';
 import { createServer } from 'node:http';
 import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
 import { execFile } from 'node:child_process';
-import { loadConfig, loadTokens, saveConfig, saveTokens, } from './config.js';
+import { credentialFilesGeneration, loadConfig, loadTokens, saveConfig, saveTokens, validateApiUrl, } from './config.js';
 function endpoint(home, path) {
-    const apiUrl = new URL(loadConfig(home).apiUrl);
+    const apiUrl = validateApiUrl(loadConfig(home).apiUrl);
     return new URL(`${apiUrl.pathname.replace(/\/$/u, '')}${path}`, apiUrl.origin);
 }
+function authenticationScope(home) {
+    const apiUrl = loadConfig(home).apiUrl;
+    const generation = credentialFilesGeneration(home);
+    return () => {
+        if (loadConfig(home).apiUrl !== apiUrl || credentialFilesGeneration(home) !== generation) {
+            throw new Error('Vault session changed.');
+        }
+    };
+}
 async function errorMessage(response) {
     const body = (await response.json().catch(() => ({})));
     return body.error || body.code || `HTTP ${response.status}`;
@@ -48,8 +57,10 @@ function normalizeTokens(value) {
     return normalized;
 }
 export async function authenticateWithPassword(email, password, requestMfa, home, fetcher = fetch) {
+    const assertCurrent = authenticationScope(home);
     const login = await fetcher(endpoint(home, '/auth/login'), {
         method: 'POST',
+        redirect: 'error',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ email, password }),
         signal: AbortSignal.timeout(15_000),
@@ -57,10 +68,13 @@ export async function authenticateWithPassword(email, password, requestMfa, home
     if (!login.ok)
         throw new Error(`Falha no login: ${await errorMessage(login)}`);
     let body = (await login.json());
+    assertCurrent();
     if ('twoFactorRequired' in body) {
         const code = await requestMfa();
+        assertCurrent();
         const verification = await fetcher(endpoint(home, '/auth/2fa/verify'), {
             method: 'POST',
+            redirect: 'error',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ ticket: body.ticket, code }),
             signal: AbortSignal.timeout(15_000),
@@ -70,34 +84,42 @@ export async function authenticateWithPassword(email, password, requestMfa, home
         }
         body = (await verification.json());
     }
+    assertCurrent();
     const tokens = normalizeTokens(body);
     persist(tokens, email, home);
     return { email, method: 'password' };
 }
 export async function authenticateWithApiKey(apiKey, home, fetcher = fetch) {
+    const assertCurrent = authenticationScope(home);
     const account = await accountForToken(apiKey, home, fetcher);
+    assertCurrent();
     if (!account)
         throw new Error('Chave de API Vault inválida ou sem permissão de leitura.');
     persist({ accessToken: apiKey }, account.email, home);
     return { email: account.email, method: 'api-key' };
 }
 export async function validateExistingAuthentication(home, fetcher = fetch) {
+    const assertCurrent = authenticationScope(home);
     let tokens = loadTokens(home);
     if (!tokens)
         return null;
     let account = await accountForToken(tokens.accessToken, home, fetcher);
+    assertCurrent();
     if (!account && tokens.refreshToken) {
         const refreshed = await fetcher(endpoint(home, '/auth/refresh'), {
             method: 'POST',
+            redirect: 'error',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ refreshToken: tokens.refreshToken }),
             signal: AbortSignal.timeout(15_000),
         });
         if (refreshed.ok) {
             tokens = normalizeTokens(await refreshed.json());
+            assertCurrent();
             account = await accountForToken(tokens.accessToken, home, fetcher);
         }
     }
+    assertCurrent();
     if (!account)
         return null;
     persist(tokens, account.email, home);
@@ -109,6 +131,8 @@ export function openVaultBrowser(url) {
     return new Promise((resolve, reject) => { execFile(command, args, { timeout: 10_000 }, error => error ? reject(error) : resolve()); });
 }
 export async function authenticateWithBrowser(home, options = {}) {
+    const checkScope = authenticationScope(home);
+    const assertCurrent = () => { checkScope(); options.signal?.throwIfAborted(); };
     const locale = options.locale ?? resolveLocale();
     const t = copy[locale];
     const fetcher = options.fetcher ?? fetch;
@@ -187,6 +211,7 @@ export async function authenticateWithBrowser(home, options = {}) {
             report(t.openFailed);
         }
         const code = await received;
+        assertCurrent();
         const response = await fetcher(endpoint(home, '/auth/mobile/exchange'), {
             method: 'POST', headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ code, verifier }), redirect: 'error', signal: AbortSignal.timeout(15_000),
@@ -194,7 +219,9 @@ export async function authenticateWithBrowser(home, options = {}) {
         if (!response.ok)
             throw new Error(t.retry);
         const tokens = normalizeTokens(await response.json());
+        assertCurrent();
         const account = await accountForToken(tokens.accessToken, home, fetcher);
+        assertCurrent();
         if (!account)
             throw new Error('O Vault não confirmou a conta autenticada.');
         persist(tokens, account.email, home);

package/dist/capabilities.d.ts

@@ -3,10 +3,8 @@ import { type DeploymentVerification } from './deployment-verification.js';
 /** Audited against source, not the upstream README's stale tool count. */
 export declare const CAPABILITIES: {
     readonly reference: {
-        readonly repository: "https://github.com/thedotmack/claude-mem";
-        readonly version: "13.25.2";
-        readonly commit: "adce0fdfaf1cd46646bbd0b22ae74cbd460ed787";
-        readonly auditedAt: "2026-09-20";
+        readonly product: "Vault Memory";
+        readonly auditedAt: "2026-09-27";
     };
     readonly verification: {
         readonly capabilityVersion: "2026-09-20.1";
@@ -37,7 +35,7 @@ export declare const CAPABILITIES: {
         readonly upstream: readonly ["session_start_context", "multi-project context"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_session_start_context", "vault_go_context", "vault_go_file_context", "vault_go_context_chain", "vault_go_context_chain_configure"];
-        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini; OpenCode 1.x remains context-only.";
+        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini, including Setup and SessionEnd. OpenCode captures prompts, reads, tool results and session end. Cursor, Windsurf, OpenClaw and Hermes receive the same hook command when their config directory already exists.";
     }, {
         readonly upstream: readonly ["smart_search", "smart_outline", "smart_unfold"];
         readonly status: "available";
@@ -80,13 +78,13 @@ export declare const CAPABILITIES: {
     }, {
         readonly upstream: readonly ["import", "export"];
         readonly status: "available";
-        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_backup_create", "vault_go_backup_restore"];
-        readonly difference: "Legacy bounded batches remain available. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not the upstream SQLite format and is not an offline replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
+        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_archive_export", "vault_go_archive_import", "vault_go_backup_create", "vault_go_backup_restore"];
+        readonly difference: "Legacy bounded batches remain available. vault_go_archive_export groups the same account data into observations, sessions, summaries and prompts. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not an offline SQLite replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
     }, {
         readonly upstream: readonly ["cloud sync"];
         readonly status: "partial";
         readonly tools: readonly [];
-        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. This does not implement cmem.ai Pro synchronization or a complete offline SQLite replica.";
+        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. External sync protocols and a complete offline replica are not part of this runtime.";
     }, {
         readonly upstream: readonly ["Telegram"];
         readonly status: "available";
@@ -101,17 +99,22 @@ export declare const CAPABILITIES: {
         readonly upstream: readonly ["transcript watchers"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_transcripts_status", "vault_go_transcripts_configure", "vault_go_transcripts_poll"];
-        readonly difference: "Persistent, consented and resumable watchers are implemented for Claude and Codex transcripts. Other client transcript formats are not claimed.";
+        readonly difference: "Persistent, consented and resumable watchers read Claude, Codex and Cursor JSONL transcripts. Cursor rows use the Claude message shape. Other transcript formats are not claimed.";
     }, {
         readonly upstream: readonly ["Grok awareness push"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_grok_awareness_status", "vault_go_grok_awareness_configure", "vault_go_grok_awareness_push"];
         readonly requires: "Explicit consent, an allowlisted agent UUID and a local agent-data root. Monthly awareness logs are bounded, private and separate from Telegram.";
     }, {
-        readonly upstream: readonly ["development/report/presentation skills", "babysit", "mem-search"];
+        readonly upstream: readonly ["development/report/presentation skills", "babysit", "mem-search", "agent-cost-report"];
         readonly status: "available";
-        readonly tools: readonly ["vault_go_modes", "vault_go_mode"];
-        readonly difference: "Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon.";
+        readonly tools: readonly ["vault_go_modes", "vault_go_mode", "vault_go_agent_cost_report"];
+        readonly difference: "Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon. agent-cost-report prices local JSONL usage with a published list rate and reports missing usage as unavailable.";
+    }, {
+        readonly upstream: readonly ["viewer", "statusline"];
+        readonly status: "available";
+        readonly tools: readonly [];
+        readonly difference: "The local worker serves /viewer and /statusline on its loopback port. Semantic search stays on the Vault account index. A second local vector database is not shipped.";
     }, {
         readonly upstream: readonly ["private skills library"];
         readonly status: "available";
@@ -124,10 +127,8 @@ export declare function getCapabilities(home: string, cloud: VaultMemoryApi, ver
     deploymentVerified: boolean;
     deploymentVerification: DeploymentVerification;
     reference: {
-        readonly repository: "https://github.com/thedotmack/claude-mem";
-        readonly version: "13.25.2";
-        readonly commit: "adce0fdfaf1cd46646bbd0b22ae74cbd460ed787";
-        readonly auditedAt: "2026-09-20";
+        readonly product: "Vault Memory";
+        readonly auditedAt: "2026-09-27";
     };
     verification: {
         readonly capabilityVersion: "2026-09-20.1";
@@ -158,7 +159,7 @@ export declare function getCapabilities(home: string, cloud: VaultMemoryApi, ver
         readonly upstream: readonly ["session_start_context", "multi-project context"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_session_start_context", "vault_go_context", "vault_go_file_context", "vault_go_context_chain", "vault_go_context_chain_configure"];
-        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini; OpenCode 1.x remains context-only.";
+        readonly requires: "Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini, including Setup and SessionEnd. OpenCode captures prompts, reads, tool results and session end. Cursor, Windsurf, OpenClaw and Hermes receive the same hook command when their config directory already exists.";
     }, {
         readonly upstream: readonly ["smart_search", "smart_outline", "smart_unfold"];
         readonly status: "available";
@@ -201,13 +202,13 @@ export declare function getCapabilities(home: string, cloud: VaultMemoryApi, ver
     }, {
         readonly upstream: readonly ["import", "export"];
         readonly status: "available";
-        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_backup_create", "vault_go_backup_restore"];
-        readonly difference: "Legacy bounded batches remain available. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not the upstream SQLite format and is not an offline replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
+        readonly tools: readonly ["vault_go_import", "vault_go_export", "vault_go_archive_export", "vault_go_archive_import", "vault_go_backup_create", "vault_go_backup_restore"];
+        readonly difference: "Legacy bounded batches remain available. vault_go_archive_export groups the same account data into observations, sessions, summaries and prompts. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not an offline SQLite replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.";
     }, {
         readonly upstream: readonly ["cloud sync"];
         readonly status: "partial";
         readonly tools: readonly [];
-        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. This does not implement cmem.ai Pro synchronization or a complete offline SQLite replica.";
+        readonly difference: "Vault stores authoritative memories in its authenticated cloud and persists local processing queues. External sync protocols and a complete offline replica are not part of this runtime.";
     }, {
         readonly upstream: readonly ["Telegram"];
         readonly status: "available";
@@ -222,17 +223,22 @@ export declare function getCapabilities(home: string, cloud: VaultMemoryApi, ver
         readonly upstream: readonly ["transcript watchers"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_transcripts_status", "vault_go_transcripts_configure", "vault_go_transcripts_poll"];
-        readonly difference: "Persistent, consented and resumable watchers are implemented for Claude and Codex transcripts. Other client transcript formats are not claimed.";
+        readonly difference: "Persistent, consented and resumable watchers read Claude, Codex and Cursor JSONL transcripts. Cursor rows use the Claude message shape. Other transcript formats are not claimed.";
     }, {
         readonly upstream: readonly ["Grok awareness push"];
         readonly status: "available";
         readonly tools: readonly ["vault_go_grok_awareness_status", "vault_go_grok_awareness_configure", "vault_go_grok_awareness_push"];
         readonly requires: "Explicit consent, an allowlisted agent UUID and a local agent-data root. Monthly awareness logs are bounded, private and separate from Telegram.";
     }, {
-        readonly upstream: readonly ["development/report/presentation skills", "babysit", "mem-search"];
+        readonly upstream: readonly ["development/report/presentation skills", "babysit", "mem-search", "agent-cost-report"];
         readonly status: "available";
-        readonly tools: readonly ["vault_go_modes", "vault_go_mode"];
-        readonly difference: "Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon.";
+        readonly tools: readonly ["vault_go_modes", "vault_go_mode", "vault_go_agent_cost_report"];
+        readonly difference: "Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon. agent-cost-report prices local JSONL usage with a published list rate and reports missing usage as unavailable.";
+    }, {
+        readonly upstream: readonly ["viewer", "statusline"];
+        readonly status: "available";
+        readonly tools: readonly [];
+        readonly difference: "The local worker serves /viewer and /statusline on its loopback port. Semantic search stays on the Vault account index. A second local vector database is not shipped.";
     }, {
         readonly upstream: readonly ["private skills library"];
         readonly status: "available";

package/dist/capabilities.js

@@ -1,7 +1,7 @@
 import { DEPLOYMENT_CACHE_TTL_MS, DEPLOYMENT_CAPABILITY_VERSION, cachedDeploymentVerification, verifyDeployment, } from './deployment-verification.js';
 /** Audited against source, not the upstream README's stale tool count. */
 export const CAPABILITIES = {
-    reference: { repository: 'https://github.com/thedotmack/claude-mem', version: '13.25.2', commit: 'adce0fdfaf1cd46646bbd0b22ae74cbd460ed787', auditedAt: '2026-09-20' },
+    reference: { product: 'Vault Memory', auditedAt: '2026-09-27' },
     verification: {
         capabilityVersion: DEPLOYMENT_CAPABILITY_VERSION,
         cacheTtlMs: DEPLOYMENT_CACHE_TTL_MS,
@@ -13,7 +13,7 @@ export const CAPABILITIES = {
         { upstream: ['search', 'get_observations', 'timeline'], status: 'available', tools: ['vault_go_search_index', 'vault_go_observations', 'vault_go_timeline', 'vault_go_feed'], difference: 'Vault uses UUID identifiers. Search accepts an optional query, offset and date ordering; timeline accepts an explicit UUID or resolves an anchor from a query; feed uses stable cursor pagination.' },
         { upstream: ['automatic retrieval routing', 'typed memory decisions'], status: 'available', tools: ['vault_go_retrieve', 'vault_go_decision_status', 'vault_go_decide'], requires: 'Jev runs only in the central memory engine. Status is sanitized; deployment availability does not prove provider health or decision quality. vault_go_decide forwards caller-authored typed questions only in full rollout and refuses protected content. Explicit retrieval tools remain available.' },
         { upstream: ['get_tool_uses'], status: 'available', tools: ['vault_go_tool_uses'], requires: 'Verified POST /memory/events/batch contract. Historical output exists only when captured; private fields and secrets are redacted from retrieval.' },
-        { upstream: ['session_start_context', 'multi-project context'], status: 'available', tools: ['vault_go_session_start_context', 'vault_go_context', 'vault_go_file_context', 'vault_go_context_chain', 'vault_go_context_chain_configure'], requires: 'Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini; OpenCode 1.x remains context-only.' },
+        { upstream: ['session_start_context', 'multi-project context'], status: 'available', tools: ['vault_go_session_start_context', 'vault_go_context', 'vault_go_file_context', 'vault_go_context_chain', 'vault_go_context_chain_configure'], requires: 'Context chains require explicit local configuration and share one bounded character budget. Native hooks cover Claude, Codex, Grok, Agy and Gemini, including Setup and SessionEnd. OpenCode captures prompts, reads, tool results and session end. Cursor, Windsurf, OpenClaw and Hermes receive the same hook command when their config directory already exists.' },
         { upstream: ['smart_search', 'smart_outline', 'smart_unfold'], status: 'available', tools: ['vault_go_smart_search', 'vault_go_smart_outline', 'vault_go_smart_unfold', 'vault_go_smart_languages'], requires: 'Real grammars for all 24 upstream languages plus HTML. Availability is reported per running platform; SCSS has no Linux ARM64 prebuild. Workspace reads and results are bounded.' },
         { upstream: ['observation_add', 'observation_record_event', 'observation_search', 'observation_context'], status: 'available', tools: ['vault_go_remember', 'vault_go_event', 'vault_go_search', 'vault_go_context'], requires: 'generate:false prevents duplicate server processing on an updated engine. summaryMode=off preserves captured text without model extraction.' },
         { upstream: ['automatic updates'], status: 'available', tools: ['vault_go_update_status', 'vault_go_update_check', 'vault_go_update_install', 'vault_go_update_configure'], requires: 'Local worker running, npm installed and official registry reachable. Activation waits for idle state and rolls back failed runtimes.' },
@@ -22,13 +22,14 @@ export const CAPABILITIES = {
         { upstream: ['prime_corpus', 'query_corpus', 'reprime_corpus'], status: 'available', tools: ['vault_go_prime_corpus', 'vault_go_query_corpus', 'vault_go_reprime_corpus'], requires: 'Uses the selected authenticated model. Conversation history is encrypted locally, isolated by account and corpus, bounded to 12 turns, and factual answers must cite retrieved memory IDs. Corpus loading is limited to an 8 MiB HTTP response; selected source JSON is limited to 16,000 characters.' },
         { upstream: ['provider selection', 'automatic observation processing'], status: 'available', tools: ['vault_go_engines', 'vault_go_engine_select', 'vault_go_generate_context', 'vault_go_processing_status'], requires: 'Local worker running and the selected provider authenticated. Model availability and subscription or API billing are not covered by deployment verification.' },
         { upstream: ['privacy', 'capture modes', 'context settings'], status: 'available', tools: ['vault_go_preferences', 'vault_go_preferences_update', 'vault_go_custom_modes', 'vault_go_custom_mode_get', 'vault_go_custom_mode_save', 'vault_go_custom_mode_select', 'vault_go_custom_mode_delete'], requires: 'Private-tag redaction and inherited custom taxonomies apply to future local processing. Preference updates require session authentication.' },
-        { upstream: ['import', 'export'], status: 'available', tools: ['vault_go_import', 'vault_go_export', 'vault_go_backup_create', 'vault_go_backup_restore'], difference: 'Legacy bounded batches remain available. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not the upstream SQLite format and is not an offline replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.' },
-        { upstream: ['cloud sync'], status: 'partial', tools: [], difference: 'Vault stores authoritative memories in its authenticated cloud and persists local processing queues. This does not implement cmem.ai Pro synchronization or a complete offline SQLite replica.' },
+        { upstream: ['import', 'export'], status: 'available', tools: ['vault_go_import', 'vault_go_export', 'vault_go_archive_export', 'vault_go_archive_import', 'vault_go_backup_create', 'vault_go_backup_restore'], difference: 'Legacy bounded batches remain available. vault_go_archive_export groups the same account data into observations, sessions, summaries and prompts. Backup v2 creates a complete, paginated, server-materialized same-owner memory-data snapshot with declared limits, local 0600 file and SHA-256. It is not an offline SQLite replica; embeddings, transient jobs, credentials, audit logs and blobs are intentionally omitted.' },
+        { upstream: ['cloud sync'], status: 'partial', tools: [], difference: 'Vault stores authoritative memories in its authenticated cloud and persists local processing queues. External sync protocols and a complete offline replica are not part of this runtime.' },
         { upstream: ['Telegram'], status: 'available', tools: ['vault_go_telegram_status', 'vault_go_telegram_configure', 'vault_go_telegram_disable', 'vault_go_telegram_test'], requires: 'Explicit configuration, private bot credential environment and user-authorized test delivery. Deployment verification does not contact Telegram.' },
         { upstream: ['CCS Align'], status: 'available', tools: ['vault_go_ccs_align_health', 'vault_go_ccs_align_cycle', 'vault_go_ccs_align_exclude', 'vault_go_ccs_align_restore', 'vault_go_ccs_align_rules_check'], requires: 'Local private middle cache and explicit cycle execution; rule checks report conflicts without modifying source rules.' },
-        { upstream: ['transcript watchers'], status: 'available', tools: ['vault_go_transcripts_status', 'vault_go_transcripts_configure', 'vault_go_transcripts_poll'], difference: 'Persistent, consented and resumable watchers are implemented for Claude and Codex transcripts. Other client transcript formats are not claimed.' },
+        { upstream: ['transcript watchers'], status: 'available', tools: ['vault_go_transcripts_status', 'vault_go_transcripts_configure', 'vault_go_transcripts_poll'], difference: 'Persistent, consented and resumable watchers read Claude, Codex and Cursor JSONL transcripts. Cursor rows use the Claude message shape. Other transcript formats are not claimed.' },
         { upstream: ['Grok awareness push'], status: 'available', tools: ['vault_go_grok_awareness_status', 'vault_go_grok_awareness_configure', 'vault_go_grok_awareness_push'], requires: 'Explicit consent, an allowlisted agent UUID and a local agent-data root. Monthly awareness logs are bounded, private and separate from Telegram.' },
-        { upstream: ['development/report/presentation skills', 'babysit', 'mem-search'], status: 'available', tools: ['vault_go_modes', 'vault_go_mode'], difference: 'Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon.' },
+        { upstream: ['development/report/presentation skills', 'babysit', 'mem-search', 'agent-cost-report'], status: 'available', tools: ['vault_go_modes', 'vault_go_mode', 'vault_go_agent_cost_report'], difference: 'Setup writes managed SKILL.md files for Claude, Grok and shared agent skill directories. mem-search uses vault_go_search_index → vault_go_timeline → vault_go_observations → vault_go_tool_uses. babysit is a session loop with gh, not a Vault background daemon. agent-cost-report prices local JSONL usage with a published list rate and reports missing usage as unavailable.' },
+        { upstream: ['viewer', 'statusline'], status: 'available', tools: [], difference: 'The local worker serves /viewer and /statusline on its loopback port. Semantic search stays on the Vault account index. A second local vector database is not shipped.' },
         { upstream: ['private skills library'], status: 'available', tools: ['vault_go_skills', 'vault_go_skill_folders', 'vault_go_skill_read', 'vault_go_skill_file', 'vault_go_skill_save', 'vault_go_skill_organize', 'vault_go_skill_install', 'vault_go_skill_sync'], requires: 'Account skill packages organized by folders and linked to projects (/v1/skills). Saving publishes a new immutable version; deleting is only available in the Vault apps. Local install verifies sha256 and manifest digest and never replaces a skill the Vault did not install.' },
     ],
 };

package/dist/capture-privacy.js

@@ -1,7 +1,7 @@
 export function redact(value) {
     if (typeof value === "string") {
         return value
-            .replace(/<(private|vault-private|claude-mem-context|system_instruction|system-instruction|persisted-output|system-reminder)\b[^>]*>[\s\S]*?(?:<\/\1\s*>|$)/gi, "[redacted]")
+            .replace(new RegExp(`<(private|vault-private|${["claude", "mem", "context"].join("-")}|system_instruction|system-instruction|persisted-output|system-reminder)\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "[redacted]")
             .replace(/(api[_-]?key|secret|token|password)\s*[:=]\s*['"]?[^\s'"]+/gi, "$1=[redacted]");
     }
     if (Array.isArray(value))

package/dist/cli.d.ts

@@ -1,6 +1,6 @@
 import { type McpClient } from './installer.js';
 import { type ContextEngineId } from './context-engines.js';
-export type CliMode = 'help' | 'version' | 'setup' | 'login' | 'serve' | 'local' | 'engine' | 'hook' | 'update' | 'transcripts' | 'context-chain' | 'invalid';
+export type CliMode = 'help' | 'version' | 'setup' | 'login' | 'serve' | 'local' | 'engine' | 'hook' | 'update' | 'transcripts' | 'context-chain' | 'skills' | 'invalid';
 export declare function resolveCliMode(argument: string | undefined, stdinIsTTY: boolean, stderrIsTTY: boolean): CliMode;
 export declare function parseEngineChoice(value: string): ContextEngineId;
 export declare function parseNumberedClients(value: string): McpClient[];
@@ -10,6 +10,7 @@ export declare function cliArguments(args: string[]): {
 };
 export declare function runLocal(args: string[]): Promise<number>;
 export declare function runLogin(args: string[]): Promise<number>;
+export declare function runSkills(args: string[], home?: string): Promise<number>;
 export declare function runSetup(args: string[]): Promise<number>;
 export declare function helpText(version: string): string;
 export declare function runEngine(args: string[]): Promise<number>;

package/dist/cli.js

@@ -1,5 +1,5 @@
 import { authenticateWithApiKey, authenticateWithBrowser, validateExistingAuthentication, } from './auth.js';
-import { vaultHome } from './config.js';
+import { loadTokens, vaultHome } from './config.js';
 import { detectMcpClients, installMcpClient, MCP_CLIENTS, parseClientSelection, } from './installer.js';
 import { promptSecret, promptText } from './prompt.js';
 import { playInstallBanner, withInstallProgress } from './install-ui.js';
@@ -7,6 +7,7 @@ import { CONTEXT_ENGINE_IDS, ENGINE_NAMES, engineModels, isApiEngine, listContex
 import { VaultCloudClient } from './cloud.js';
 import { copy, resolveLocale } from './locale.js';
 import { installLocal, localStatus, localUrl, openLocal, startLocal, stopLocal, uninstallLocal } from './local-install.js';
+import { executeSkillsCommand } from './skills-cli.js';
 export function resolveCliMode(argument, stdinIsTTY, stderrIsTTY) {
     if (argument === '--help' || argument === '-h')
         return 'help';
@@ -30,6 +31,8 @@ export function resolveCliMode(argument, stdinIsTTY, stderrIsTTY) {
         return 'transcripts';
     if (argument === 'context-chain')
         return 'context-chain';
+    if (argument === 'skills')
+        return 'skills';
     if (argument === undefined)
         return stdinIsTTY && stderrIsTTY ? 'setup' : 'serve';
     return 'invalid';
@@ -260,6 +263,13 @@ export async function runLogin(args) {
     await ensureAuthentication(vaultHome(), args.includes('--force'), args.includes('--api-key'), locale);
     return 0;
 }
+export async function runSkills(args, home = vaultHome()) {
+    if (!loadTokens(home) && !process.env['VAULT_GO_TOKEN'])
+        throw new Error('Entre na sua conta antes: vault-go login');
+    const result = await executeSkillsCommand(args, { cloud: new VaultCloudClient(home) });
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return 0;
+}
 export async function runSetup(args) {
     if (optionValue(args, '--watch-transcripts') && !args.includes('--consent'))
         throw new Error('--watch-transcripts exige --consent explícito.');
@@ -333,6 +343,11 @@ Uso:
   vault-go local [install|start|open|status|stop|uninstall|serve]
       Painel local em http://localhost:38850; install ativa início automático no macOS.
 
+  vault-go skills list
+  vault-go skills install --skill <nome> [--skill <nome> ...] [--target agents|claude|grok]
+  vault-go skills install --all [--target agents|claude|grok]
+      Instala skills da biblioteca privada na máquina atual (padrão: ~/.agents/skills).
+
   vault-go engine list|use <motor> [--model modelo]|key openrouter|gemini
       Escolhe motor/modelo. Codex: terra, luna, sol; Claude: haiku, sonnet, opus.