vault-go 0.30.0 → 0.31.0

package/dist/cloud.js

@@ -1,5 +1,6 @@
+import { resolve } from 'node:path';
 import { recordActivity } from './activity.js';
-import { loadConfig, loadTokens, saveTokens, validateApiUrl, vaultHome, } from './config.js';
+import { credentialFilesGeneration, loadConfig, loadTokens, saveTokens, validateApiUrl, vaultHome, } from './config.js';
 const KNOWLEDGE_BASE_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
 const SKILL_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
 const KNOWLEDGE_BASE_RESPONSE_LIMIT_ERROR = 'A base de conhecimento excede o limite de resposta de 8 MiB.';
@@ -43,6 +44,31 @@ function withoutClientDecisions(input) {
             return safeRecord;
         }) };
 }
+const cloudSessions = new Map();
+function sessionFor(home) {
+    const generation = credentialFilesGeneration(home);
+    const base = validateApiUrl(loadConfig(home).apiUrl).href;
+    const environmentToken = process.env['VAULT_GO_TOKEN'];
+    const tokens = environmentToken ? null : loadTokens(home);
+    if (credentialFilesGeneration(home) !== generation) {
+        throw new VaultCloudError(401, 'Vault session changed.');
+    }
+    const key = JSON.stringify([base, environmentToken, tokens?.accessToken, tokens?.refreshToken, generation]);
+    let session = cloudSessions.get(resolve(home));
+    if (!session || session.key !== key) {
+        session = { key, base, tokens, environmentToken };
+        cloudSessions.set(resolve(home), session);
+    }
+    return session;
+}
+function assertSession(home, session) {
+    if (sessionFor(home) !== session)
+        throw new VaultCloudError(401, 'Vault session changed.');
+}
+function sessionEndpoint(base, path) {
+    const url = new URL(base);
+    return new URL(`${url.pathname.replace(/\/$/u, '')}${path}`, url.origin);
+}
 export class VaultCloudClient {
     home;
     cloudFetch;
@@ -104,7 +130,7 @@ export class VaultCloudClient {
         return { deleted: true, id };
     }
     async search(input) {
-        return this.request('/memory/search', { method: 'POST', body: input });
+        return this.request('/memory/search', { retryRead: true, method: 'POST', body: input });
     }
     async retrieve(input) {
         return this.request('/memory/retrieve', { method: 'POST', body: input });
@@ -116,19 +142,19 @@ export class VaultCloudClient {
         return this.request('/memory/decisions/evaluate', { method: 'POST', body: input });
     }
     async searchIndex(input) {
-        return this.request('/memory/search/index', { method: 'POST', body: input });
+        return this.request('/memory/search/index', { retryRead: true, method: 'POST', body: input });
     }
     async observations(ids) {
-        return this.request('/memory/memories/batch', { method: 'POST', body: { ids } });
+        return this.request('/memory/memories/batch', { retryRead: true, method: 'POST', body: { ids } });
     }
     async timeline(input) {
-        return this.request('/memory/timeline', { method: 'POST', body: input });
+        return this.request('/memory/timeline', { retryRead: true, method: 'POST', body: input });
     }
     async context(input) {
-        return this.request('/memory/context', { method: 'POST', body: input });
+        return this.request('/memory/context', { retryRead: true, method: 'POST', body: input });
     }
     async fileContext(input) {
-        return this.request('/memory/files/context', { method: 'POST', body: input });
+        return this.request('/memory/files/context', { retryRead: true, method: 'POST', body: input });
     }
     async stats() {
         return this.request('/memory/stats');
@@ -196,6 +222,7 @@ export class VaultCloudClient {
     }
     async queryKnowledgeBase(id, input) {
         return this.request(`/memory/knowledge-bases/${encodeURIComponent(id)}/query`, {
+            retryRead: true,
             method: 'POST',
             body: input,
         });
@@ -242,7 +269,7 @@ export class VaultCloudClient {
         return this.request(`/memory/memories/${encodeURIComponent(id)}`);
     }
     async toolUses(input) {
-        return this.request('/memory/events/batch', { method: 'POST', body: input });
+        return this.request('/memory/events/batch', { retryRead: true, method: 'POST', body: input });
     }
     async graph() { return this.request('/memory/graph'); }
     async graphPresets() { return this.request('/memory/graph/presets'); }
@@ -261,50 +288,59 @@ export class VaultCloudClient {
         const prefix = base.pathname.replace(/\/$/u, '');
         return new URL(`${prefix}${path}`, base.origin);
     }
-    async accessToken(forceRefresh = false) {
-        const environmentToken = process.env['VAULT_GO_TOKEN'];
-        if (environmentToken)
-            return environmentToken;
-        const tokens = loadTokens(this.home);
-        if (!tokens) {
+    async accessToken(session, rejectedToken) {
+        assertSession(this.home, session);
+        if (session.environmentToken)
+            return session.environmentToken;
+        const tokens = session.tokens;
+        if (!tokens)
             throw new Error('Vault não autenticado. Execute `bunx --bun vault-go@latest login`.');
-        }
-        const valid = !forceRefresh &&
-            (!tokens.expiresAt || Date.now() < tokens.expiresAt - 60_000);
-        if (valid)
+        // A concurrent read may already have renewed this same session.
+        if (rejectedToken && rejectedToken !== tokens.accessToken)
+            return tokens.accessToken;
+        if (!rejectedToken && (!tokens.expiresAt || Date.now() < tokens.expiresAt - 60_000))
             return tokens.accessToken;
-        if (!tokens.refreshToken) {
+        if (session.refreshing)
+            return session.refreshing;
+        if (!tokens.refreshToken)
             throw new Error('Sessão expirada. Execute `bunx --bun vault-go@latest login --force`.');
+        const pending = (async () => {
+            const response = await this.cloudFetch(sessionEndpoint(session.base, '/auth/refresh'), {
+                method: 'POST', redirect: 'error',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ refreshToken: tokens.refreshToken }),
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok) {
+                await response.body?.cancel().catch(() => { });
+                assertSession(this.home, session);
+                throw new Error('Sessão expirada. Execute `bunx --bun vault-go@latest login --force`.');
+            }
+            const refreshed = (await response.json());
+            assertSession(this.home, session);
+            if (!refreshed || typeof refreshed.accessToken !== 'string' || !refreshed.accessToken) {
+                throw new Error('A API Vault retornou credenciais inválidas.');
+            }
+            const stored = { ...refreshed, expiresAt: Date.now() + (refreshed.expiresIn ?? 900) * 1000 };
+            saveTokens(stored, this.home);
+            session.tokens = stored;
+            session.key = JSON.stringify([session.base, session.environmentToken, stored.accessToken, stored.refreshToken, credentialFilesGeneration(this.home)]);
+            return stored.accessToken;
+        })();
+        session.refreshing = pending;
+        try {
+            return await pending;
         }
-        const response = await this.cloudFetch(this.endpoint('/auth/refresh'), {
-            method: 'POST',
-            redirect: 'error',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ refreshToken: tokens.refreshToken }),
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (!response.ok) {
-            throw new Error('Sessão expirada. Execute `bunx --bun vault-go@latest login --force`.');
+        finally {
+            if (session.refreshing === pending)
+                delete session.refreshing;
         }
-        const refreshed = (await response.json());
-        // A refresh already in flight must not overwrite a newer login or logout.
-        const latest = loadTokens(this.home);
-        if (!latest)
-            throw new Error('Vault session was disconnected.');
-        if (latest.accessToken !== tokens.accessToken || latest.refreshToken !== tokens.refreshToken)
-            return latest.accessToken;
-        const stored = {
-            ...refreshed,
-            expiresAt: Date.now() + (refreshed.expiresIn ?? 900) * 1000,
-        };
-        saveTokens(stored, this.home);
-        return stored.accessToken;
     }
     async request(path, options = {}) {
         const start = Date.now();
         let ok = false;
         try {
-            const result = await this.performRequest(path, options);
+            const result = await this.performRequest(path, options, sessionFor(this.home));
             ok = true;
             return result;
         }
@@ -313,14 +349,16 @@ export class VaultCloudClient {
                 recordActivity(this.home, (options.method ?? 'GET') + ' ' + path.split('?')[0], ok, Date.now() - start);
         }
     }
-    async performRequest(path, options = {}) {
+    async performRequest(path, options, session, rejectedToken) {
+        options.signal?.throwIfAborted();
+        assertSession(this.home, session);
         const headers = new Headers({ accept: 'application/json' });
         if (options.body)
             headers.set('content-type', 'application/json');
         for (const [name, value] of Object.entries(options.headers ?? {}))
             headers.set(name, value);
         if (options.authenticated !== false) {
-            headers.set('authorization', `Bearer ${await this.accessToken(options.retried)}`);
+            headers.set('authorization', `Bearer ${await this.accessToken(session, rejectedToken)}`);
         }
         const request = {
             method: options.method ?? 'GET',
@@ -330,21 +368,34 @@ export class VaultCloudClient {
         };
         if (options.body)
             request.body = JSON.stringify(options.body);
-        const endpoint = this.endpoint(path);
+        options.signal?.throwIfAborted();
+        assertSession(this.home, session);
+        const endpoint = sessionEndpoint(session.base, path);
         for (const [key, value] of Object.entries(options.query ?? {})) {
             if (value !== undefined && value !== null && value !== '') {
                 endpoint.searchParams.set(key, String(value));
             }
         }
         const response = await this.cloudFetch(endpoint, request);
-        if (response.status === 401 && options.authenticated !== false && !options.retried) {
+        if (response.status === 401 && options.authenticated !== false && !options.retried &&
+            (['GET', 'HEAD'].includes(options.method ?? 'GET') || options.retryRead)) {
             try {
                 await response.body?.cancel();
             }
             catch { /* Release the rejected response before retrying. */ }
-            return this.performRequest(path, { ...options, retried: true });
+            return this.performRequest(path, { ...options, retried: true }, session, headers.get('authorization')?.slice(7));
+        }
+        try {
+            options.signal?.throwIfAborted();
+            assertSession(this.home, session);
+        }
+        catch (error) {
+            await response.body?.cancel().catch(() => { });
+            throw error;
         }
         const text = await readResponseText(response, options.responseMaxBytes);
+        options.signal?.throwIfAborted();
+        assertSession(this.home, session);
         const payload = text ? safeJson(text) : null;
         if (!response.ok) {
             const message = payload && typeof payload === 'object' && 'error' in payload

package/dist/config.d.ts

@@ -21,6 +21,8 @@ export interface VaultStatus {
 export declare function vaultHome(environment?: NodeJS.ProcessEnv): string;
 export declare function configPath(home?: string): string;
 export declare function authPath(home?: string): string;
+/** File identity survives value-level ABA (logout then login with the same API key). */
+export declare function credentialFilesGeneration(home?: string): string;
 export declare function loadConfig(home?: string): VaultConfig;
 export declare function loadTokens(home?: string): StoredTokens | null;
 export declare function saveConfig(config: VaultConfig, home?: string): void;

package/dist/config.js

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { VAULT_CLOUD_API_URL } from './vault-cloud.js';
@@ -20,6 +20,20 @@ export function configPath(home = vaultHome()) {
 export function authPath(home = vaultHome()) {
     return join(home, 'auth.json');
 }
+/** File identity survives value-level ABA (logout then login with the same API key). */
+export function credentialFilesGeneration(home = vaultHome()) {
+    return [configPath(home), authPath(home)].map(path => {
+        try {
+            const stat = statSync(path, { bigint: true });
+            return [stat.dev, stat.ino, stat.birthtimeNs, stat.mtimeNs, stat.ctimeNs, stat.size].join(':');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return 'absent';
+            throw error;
+        }
+    }).join('|');
+}
 export function loadConfig(home = vaultHome()) {
     const file = configPath(home);
     const environmentApiUrl = process.env['VAULT_GO_API_URL'];

package/dist/crystal-memory-mirror.d.ts

@@ -9,10 +9,23 @@ type MirrorJob = {
 export declare function shouldMirrorCrystalMemory(job: MirrorJob): boolean;
 export declare function crystalProjectFolder(project: unknown): string | null;
 export declare function resolveCrystalProjectFolder(cloud: Pick<VaultMemoryApi, 'projects'>, projectId: string): Promise<string | null>;
+export interface CrystalMirrorRecord {
+    sourceId: string;
+    project: string;
+    title: string;
+    content: string;
+    tags: string[];
+}
+/** written; locked (retry later); rejected (non-locked tool error); unavailable (Desktop unreachable). */
+export type CrystalMirrorOutcome = 'written' | 'locked' | 'rejected' | 'unavailable';
+export declare function writeCrystalMirror(home: string, record: CrystalMirrorRecord): Promise<CrystalMirrorOutcome>;
 export declare function mirrorCrystalMemory(input: {
     home: string;
     cloud: Pick<VaultMemoryApi, 'projects'>;
     job: MirrorJob;
     result: Pick<ContextResult, 'title' | 'content' | 'concepts'>;
-}): Promise<void>;
+}): Promise<{
+    outcome: CrystalMirrorOutcome | 'skipped';
+    record?: CrystalMirrorRecord;
+}>;
 export {};

package/dist/crystal-memory-mirror.js

@@ -33,23 +33,32 @@ export async function resolveCrystalProjectFolder(cloud, projectId) {
     const oldest = namesakes.at(-1);
     return oldest?.id === projectId ? folder : `${folder}-${projectId.slice(0, 8)}`;
 }
-export async function mirrorCrystalMemory(input) {
-    if (!shouldMirrorCrystalMemory(input.job))
-        return;
-    const project = await resolveCrystalProjectFolder(input.cloud, input.job.projectId);
-    if (!project)
-        return;
+export async function writeCrystalMirror(home, record) {
     try {
-        const { callCrystalTool } = await import('./crystal-tools.js');
-        await callCrystalTool(input.home, 'crystal_memory_write', {
-            project,
-            title: input.result.title,
-            content: input.result.content,
-            tags: input.result.concepts,
-            sourceId: `vault-go:event:${input.job.id}`,
-        });
+        const { callCrystalTool, isCrystalLockedResult } = await import('./crystal-tools.js');
+        const result = await callCrystalTool(home, 'crystal_memory_write', { ...record });
+        if (isCrystalLockedResult(result))
+            return 'locked';
+        return result.isError ? 'rejected' : 'written';
     }
     catch {
-        // Crystal MCP is optional; account memory already persisted.
+        return 'unavailable';
     }
 }
+export async function mirrorCrystalMemory(input) {
+    if (!shouldMirrorCrystalMemory(input.job))
+        return { outcome: 'skipped' };
+    const project = await resolveCrystalProjectFolder(input.cloud, input.job.projectId);
+    if (!project)
+        return { outcome: 'skipped' };
+    const record = {
+        project,
+        title: input.result.title,
+        content: input.result.content,
+        tags: input.result.concepts,
+        sourceId: `vault-go:event:${input.job.id}`,
+    };
+    // Crystal MCP is optional; account memory already persisted. Only a locked
+    // Crystal is worth retrying, so the caller queues the record for that case.
+    return { outcome: await writeCrystalMirror(input.home, record), record };
+}

package/dist/crystal-tools.d.ts

@@ -1,9 +1,32 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare const CRYSTAL_LOCKED = "CRYSTAL_LOCKED";
+type CrystalToolResult = {
+    isError?: boolean | undefined;
+    content?: {
+        type: string;
+        text?: string;
+    }[] | undefined;
+    structuredContent?: Record<string, unknown> | undefined;
+};
+export declare function isCrystalLockedResult(result: CrystalToolResult): boolean;
 export declare function callCrystalTool(home: string, name: string, args: Record<string, unknown>): Promise<{
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    structuredContent: {
+        code: string;
+    };
+    isError: boolean;
+} | {
     isError?: boolean;
     content: {
         text: string;
         type: "text";
     }[];
+    structuredContent?: never;
 }>;
-export declare function registerCrystalTools(server: McpServer, home: string): void;
+export declare function registerCrystalTools(server: McpServer, home: string, options?: {
+    crystalMirrorStore?: import('./hook-queue.js').CrystalMirrorStoreFactory;
+}): void;
+export {};

package/dist/crystal-tools.js

@@ -5,6 +5,19 @@ import { z } from 'zod';
 const unavailable = 'Abra o Vault Desktop e ative a integração Vault MCP no Crystal.';
 const invalidConnection = 'Conexão local do Crystal inválida. Reative a integração no Vault Desktop.';
 const MAX_RESPONSE = 32 * 1024 * 1024;
+export const CRYSTAL_LOCKED = 'CRYSTAL_LOCKED';
+const lockedMessage = `${CRYSTAL_LOCKED}: O Crystal está trancado no Vault Desktop. Peça ao usuário para destrancá-lo no Vault Desktop com Touch ID ou a senha do macOS e só então tente de novo; não repita a chamada em loop.`;
+const lockedGuidance = ` Se o Crystal usar criptografia local e estiver trancado, a chamada falha com ${CRYSTAL_LOCKED}: peça ao usuário para destrancá-lo no Vault Desktop com Touch ID e não repita em loop.`;
+// Why: Vault Desktop 0.2.76 reports a locked Crystal only as text starting with
+// "Crystal trancado"; newer versions use the CRYSTAL_LOCKED prefix and code.
+export function isCrystalLockedResult(result) {
+    if (!result.isError)
+        return false;
+    if (result.structuredContent?.code === CRYSTAL_LOCKED)
+        return true;
+    return (result.content ?? []).some(item => typeof item.text === 'string' &&
+        (/^CRYSTAL_LOCKED\b/.test(item.text.trimStart()) || /^Crystal trancado/i.test(item.text.trimStart())));
+}
 function connection(home) {
     const file = join(home, 'crystal-connection.json');
     try {
@@ -71,25 +84,37 @@ export async function callCrystalTool(home, name, args) {
     }
     const envelope = z.object({
         jsonrpc: z.literal('2.0'), id: z.literal(id),
-        result: z.object({ isError: z.boolean().optional(), content: z.array(z.object({ type: z.literal('text'), text: z.string() })) }),
+        result: z.object({
+            isError: z.boolean().optional(),
+            content: z.array(z.object({ type: z.literal('text'), text: z.string() })),
+            structuredContent: z.record(z.unknown()).optional(),
+        }),
     }).safeParse(payload);
     if (!envelope.success)
         throw new Error('Resposta inválida do Crystal. Atualize o Vault Desktop.');
+    if (isCrystalLockedResult(envelope.data.result)) {
+        return { content: [{ type: 'text', text: lockedMessage }], structuredContent: { code: CRYSTAL_LOCKED }, isError: true };
+    }
     return {
         content: envelope.data.result.content.map(item => ({ ...item, text: item.text.replaceAll(local.token, '[redacted]') })),
         ...(envelope.data.result.isError ? { isError: true } : {}),
     };
 }
-export function registerCrystalTools(server, home) {
+export function registerCrystalTools(server, home, options = {}) {
     const path = z.string().min(1).max(2000).refine(value => !/^(?:[a-zA-Z]:|[\\/])|(?:^|[\\/])\.\.(?:[\\/]|$)/.test(value) && !value.includes('\0'), 'Informe um caminho relativo dentro do Crystal.');
     const notePath = path.refine(value => /\.(?:md|markdown)$/i.test(value), 'Informe uma nota Markdown do Crystal.');
     const add = (name, description, inputSchema, readOnly = true, destructive = false) => {
         server.registerTool(`vault_go_crystal_${name}`, {
-            description: `${description} Usa o Crystal do Vault Desktop aberto neste computador.`, inputSchema,
+            description: `${description} Usa o Crystal do Vault Desktop aberto neste computador.${name === 'status' ? '' : lockedGuidance}`, inputSchema,
             annotations: { readOnlyHint: readOnly, destructiveHint: destructive, idempotentHint: readOnly, openWorldHint: name === 'sync' },
         }, async (input) => {
             try {
-                return await callCrystalTool(home, `crystal_${name}`, input);
+                const result = await callCrystalTool(home, `crystal_${name}`, input);
+                // A successful call proves the Crystal is unlocked; status also answers while locked.
+                if (!result.isError && name !== 'status') {
+                    void import('./hook-queue.js').then(queue => queue.flushPendingCrystalMirrors(home, undefined, options.crystalMirrorStore ? { openStore: options.crystalMirrorStore } : {})).catch(() => { });
+                }
+                return result;
             }
             catch (error) {
                 return { isError: true, content: [{ type: 'text', text: error instanceof Error ? error.message : unavailable }] };
@@ -102,7 +127,7 @@ export function registerCrystalTools(server, home) {
     add('write', 'Cria ou atualiza uma nota Markdown no Crystal.', { path, content: z.string().max(10 * 1024 * 1024), title: z.string().max(1000).optional(), tags: z.array(z.string().max(200)).max(100).optional() }, false);
     add('delete', 'Exclui uma nota do Crystal.', { path: notePath }, false, true);
     add('sync', 'Sincroniza o Crystal com o Vault Cloud.', {}, false);
-    add('status', 'Mostra o estado do Crystal e da sincronização.', {});
+    add('status', 'Mostra o estado do Crystal e da sincronização. localEncryption.locked indica se o Crystal está trancado no Vault Desktop (syncState pode ser paused-locked).', {});
     add('memory_list', 'Lista notas duráveis em {projeto}/Memory no Crystal.', { project: z.string().trim().min(1).max(200).optional() });
     add('memory_write', 'Grava uma nota durável em {projeto}/Memory no Crystal.', {
         project: z.string().trim().min(1).max(200),

package/dist/grok-awareness.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import fs from 'node:fs';
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { loadConfig, loadTokens } from './config.js';
 import { redact } from './capture-privacy.js';
@@ -133,6 +133,55 @@ async function lock(home) {
     }
     throw new Error('Awareness writer is busy');
 }
+function logLines(memoryDir) {
+    const log = join(memoryDir, 'log');
+    if (!existsSync(log))
+        return [];
+    const stat = lstatSync(log);
+    if (stat.isSymbolicLink() || !stat.isDirectory() || realpathSync(log) !== log)
+        return [];
+    const lines = [];
+    for (const name of readdirSync(log)) {
+        if (!name.endsWith('.md'))
+            continue;
+        const file = join(log, name);
+        const fileStat = lstatSync(file);
+        if (fileStat.isSymbolicLink() || !fileStat.isFile() || fileStat.size > MAX_LOG_BYTES)
+            continue;
+        lines.push(...readFileSync(file, 'utf8').split('\n').map(line => line.trim()).filter(line => line.startsWith('- ') && line.length <= 500));
+    }
+    return lines.slice(-80);
+}
+function writeLiveIndex(root, agentId, _now) {
+    const agents = ensureDirectory(root, ['agents']);
+    const seat = ensureDirectory(root, ['agents', agentId, 'memory']);
+    const lines = logLines(seat).slice(-80);
+    if (lines.length < 80) {
+        for (const name of readdirSync(agents)) {
+            if (lines.length >= 80 || name === agentId || name.startsWith('.'))
+                continue;
+            const other = join(agents, name, 'memory');
+            try {
+                const stat = lstatSync(other);
+                if (stat.isSymbolicLink() || !stat.isDirectory() || realpathSync(other) !== other)
+                    continue;
+                lines.push(...logLines(other).slice(0, 80 - lines.length));
+            }
+            catch { /* unreadable sibling stays out of the index */ }
+        }
+    }
+    const body = ['# Vault Memory', '', ...lines.slice(0, 80), ''].join('\n');
+    const file = join(seat, 'zz-vault-memory-inject.md');
+    const temp = join(seat, `.index-${randomUUID()}.tmp`);
+    writeFileSync(temp, body, { mode: 0o600, flag: 'wx' });
+    try {
+        renameSync(temp, file);
+        chmodSync(file, 0o600);
+    }
+    finally {
+        rmSync(temp, { force: true });
+    }
+}
 export async function pushAwareness(home, input, now = new Date(), io = fs) {
     const initial = load(home), identity = owner(home);
     let release;
@@ -222,6 +271,10 @@ export async function pushAwareness(home, input, now = new Date(), io = fs) {
             }
             chmodSync(file, 0o600);
         }
+        try {
+            writeLiveIndex(config.agentDataRoot, input.agentId, now);
+        }
+        catch { /* the monthly log remains the source of record */ }
         config.lastPush = Date.now();
         delete config.lastError;
         save(home, config);

package/dist/hook-install.d.ts

@@ -1,14 +1,18 @@
 export declare const HOOK_OWNER = "Vault Go: captura e contexto";
 export declare const HOOK_EVENTS: {
+    readonly Setup: "setup";
     readonly SessionStart: "context";
     readonly UserPromptSubmit: "session-init";
     readonly PreToolUse: "file-context";
     readonly PostToolUse: "observation";
     readonly Stop: "summarize";
+    readonly SessionEnd: "session-end";
 };
 export declare function quoteShell(value: string): string;
 export declare function hookEntryPath(configHome?: string): string;
 export declare function hookCommand(adapter: string, event: string, configHome?: string): string;
+declare const CAPTURE_HOMES: Record<string, string>;
+export declare function installCaptureHooks(adapter: keyof typeof CAPTURE_HOMES, userHome?: string, configHome?: string): void;
 export type HookClient = "claude" | "codex" | "grok" | "agy" | "gemini";
 export declare function installClientHooks(client: HookClient, userHome?: string, configHome?: string): void;
 export declare function installOpenCodePlugin(userHome?: string, configHome?: string): void;

package/dist/hook-install.js

@@ -35,11 +35,13 @@ function atomicWriteText(path, text) {
 }
 export const HOOK_OWNER = "Vault Go: captura e contexto";
 export const HOOK_EVENTS = {
+    Setup: "setup",
     SessionStart: "context",
     UserPromptSubmit: "session-init",
     PreToolUse: "file-context",
     PostToolUse: "observation",
     Stop: "summarize",
+    SessionEnd: "session-end",
 };
 const GEMINI_EVENTS = {
     SessionStart: "context",
@@ -77,7 +79,7 @@ function hookManifest(adapter, configHome = vaultHome()) {
                                 timeout: event === "context" ? 60 : 20,
                                 statusMessage: HOOK_OWNER,
                             }),
-                            ...(adapter !== "gemini" && (event === "observation" || event === "summarize")
+                            ...(adapter !== "gemini" && (event === "observation" || event === "summarize" || event === "session-end")
                                 ? { async: true }
                                 : {}),
                         },
@@ -102,8 +104,37 @@ function agyHookManifest(configHome = vaultHome()) {
             { matcher: "*", hooks: [agyHandler("observation", configHome)] },
         ],
         Stop: [agyHandler("summarize", configHome)],
+        SessionEnd: [agyHandler("session-end", configHome)],
     };
 }
+const CAPTURE_HOMES = {
+    cursor: ".cursor/hooks.json",
+    windsurf: ".codeium/windsurf/hooks.json",
+    openclaw: ".openclaw/hooks.json",
+    hermes: ".hermes/hooks.json",
+};
+export function installCaptureHooks(adapter, userHome = homedir(), configHome = vaultHome()) {
+    const relative = CAPTURE_HOMES[adapter];
+    if (!relative)
+        throw new Error("Adaptador de captura desconhecido.");
+    const path = join(userHome, relative);
+    const config = existsSync(path) ? readJsonObject(path) : {};
+    const hooks = {
+        ...(config.hooks && typeof config.hooks === "object" && !Array.isArray(config.hooks) ? config.hooks : {}),
+    };
+    const desired = hookManifest(adapter, configHome).hooks;
+    for (const event of Object.keys(desired)) {
+        const current = hooks[event];
+        const retained = Array.isArray(current)
+            ? current.filter((group) => {
+                const text = JSON.stringify(group);
+                return !text.includes(HOOK_OWNER);
+            })
+            : [];
+        hooks[event] = [...retained, ...(desired[event] || [])];
+    }
+    atomicWriteJson(path, { ...config, hooks });
+}
 export function installClientHooks(client, userHome = homedir(), configHome = vaultHome()) {
     if (client === "grok") {
         atomicWriteJson(join(userHome, ".grok", "hooks", "vault-go.json"), hookManifest("grok", configHome));
@@ -173,6 +204,15 @@ export function repairAdditionalClientHooks(userHome = homedir(), configHome = v
         if (server && server.enabled !== false)
             installOpenCodePlugin(userHome, configHome);
     }, report);
+    for (const adapter of Object.keys(CAPTURE_HOMES)) {
+        const relative = CAPTURE_HOMES[adapter];
+        if (!relative)
+            continue;
+        const directory = join(userHome, relative.split("/").slice(0, -1).join("/"));
+        if (existsSync(directory)) {
+            repairClient(adapter, () => installCaptureHooks(adapter, userHome, configHome), report);
+        }
+    }
 }
 function reportRepairWarning(message) {
     process.stderr.write(message + "\n");