vault-go 0.31.1 → 0.32.0

package/README.md

@@ -53,7 +53,9 @@ The setup wizard:
 3. Leaves other client config in place.
 4. Installs the local dashboard on port `38850` (starts at login on macOS).
 
-Supported clients: Codex, ChatGPT Desktop, Claude Code, Claude Desktop, Grok, Agy / Antigravity, Gemini CLI, Cursor, Windsurf, VS Code + GitHub Copilot, Copilot CLI, Roo Code, OpenCode, and Vault Desktop (Crystal).
+Supported clients: Codex, ChatGPT Desktop, Claude Code, Claude Desktop, Grok, Agy / Antigravity, Gemini CLI, Cursor, Windsurf, VS Code + GitHub Copilot, Copilot CLI, Roo Code, OpenCode, Warp, Goose, Hermes, and Vault Desktop (Crystal).
+
+Goose and Hermes are configured by editing a single entry in their `config.yaml` (`extensions.vault-go` and `mcp_servers.vault-go`). Comments and other lines are left as they are. A file with a shape that cannot be edited safely, such as an inline mapping, is left unchanged and reported.
 
 ```sh
 vault-go setup
@@ -152,6 +154,8 @@ vault-go engine key openrouter
 
 MCP tools never accept secrets. Store keys with the CLI or the local dashboard. Provider usage limits apply. Managed Vault AI generation still depends on server configuration and quota.
 
+When the background queue hits an exhausted quota, Vault AI Resume and the Claude subscription stand in for each other. Other failures never switch engines. Set `VAULT_GO_ENGINE_FALLBACK=off` to disable this.
+
 ## MCP tools
 
 Account and health: `vault_go_status`, `vault_go_cloud_health`, `vault_go_preferences`, `vault_go_preferences_update`.
@@ -212,6 +216,10 @@ The worker drains a private queue with the selected engine. Successful generatio
 
 Opt-in Claude/Codex transcript watchers and project context chains are configured with MCP/CLI and stay bound to the current account.
 
+Helper threads that clients generate themselves are never captured: Codex titles, suggestions and memory consolidation, Grok research briefings, and turns that are only a `<task-notification>`.
+
+**File Read Gate (Claude Code).** In some cases a whole-file `Read` is denied, and the denial lists the file's memories. This happens only when the file is a code file of 32 KB or more, inside the workspace, and Vault memories about it are newer than its last change. Claude is pointed to `vault_go_smart_outline` / `vault_go_smart_unfold` or to a `Read` with `offset`/`limit` instead; partial reads always pass. Subagents and other clients are never gated, and any lookup failure lets the read through. Turn it off with `VAULT_GO_FILE_READ_GATE=off` or the `fileReadGate: false` preference.
+
 ## Automatic updates
 
 The worker checks the official npm registry daily for a stable `vault-go` release, stages an exact version under `~/.memvault/releases` without running package install scripts, validates it, and activates when idle. A failed start rolls back. Auth, preferences, and the queue are kept. Open MCP clients must reconnect to load new tools.

package/dist/capture-privacy.d.ts

@@ -1 +1,3 @@
+/** True when nothing remains once memory tags are removed: such text must not be stored at all. */
+export declare function isFullyPrivate(value: string): boolean;
 export declare function redact(value: unknown): unknown;

package/dist/capture-privacy.js

@@ -1,4 +1,24 @@
 const SENSITIVE_KEY = /api[_-]?key|secret|token|password|authorization|cookie|credential|private[_-]?key/i;
+const MEMORY_TAGS = `(private|vault-private|${["claude", "mem", "context"].join("-")}|system_instruction|system-instruction|persisted-output|system-reminder)`;
+// Credentials pasted in free text have no key to match. `(?!\w)` instead of a
+// closing `\b`: these classes include `-`, and `\b` after a final `-` needs a
+// following word character, so such a key was left (or kept its last `-`).
+const TOKEN_PATTERNS = [
+    /AKIA[0-9A-Z]{16}/g,
+    /\bgh[oprsu]_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{82}\b/g,
+    /\bsk-(?!ant-)[A-Za-z0-9_-]{20,}(?!\w)/g,
+    /\bsk-ant-[A-Za-z0-9_-]{20,}(?!\w)/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}(?!\w)/g,
+    /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?!\w)/g,
+    /-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g,
+    /\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g,
+    /\bAIza[0-9A-Za-z_-]{35}(?!\w)/g,
+    /\bvg_device_[a-f0-9]{64}\b/g,
+];
+/** True when nothing remains once memory tags are removed: such text must not be stored at all. */
+export function isFullyPrivate(value) {
+    return value.trim() !== '' && !value.replace(new RegExp(`<${MEMORY_TAGS}\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "").trim();
+}
 /** Keep quoted values together: whitespace/escaped quotes must not leave a secret tail. */
 function redactText(value, depth = 0) {
     // Nested stringified payloads are untrusted. Do not recurse indefinitely.
@@ -13,8 +33,8 @@ function redactText(value, depth = 0) {
         }
         catch { /* Partial JSON and pasted logs still use the text filter below. */ }
     }
-    return value
-        .replace(new RegExp(`<(private|vault-private|${["claude", "mem", "context"].join("-")}|system_instruction|system-instruction|persisted-output|system-reminder)\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "[redacted]")
+    return TOKEN_PATTERNS.reduce((text, pattern) => text.replace(pattern, '[redacted]'), value)
+        .replace(new RegExp(`<${MEMORY_TAGS}\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "[redacted]")
         // Raw HTTP headers can contain spaces, auth schemes and several cookies.
         // Stop at a shell argument's quote or a new line, preserving adjacent diagnostics.
         .replace(/(\b(?:authorization|proxy-authorization|cookie|set-cookie)[ \t]*:[ \t]*)[^\r\n'\"]+/gi, '$1[redacted]')

package/dist/cli.js

@@ -358,7 +358,7 @@ Uso:
       Captura opt-in de transcripts pelo worker local, com checkpoints e privacidade.
       Setup aceita --watch-transcripts claude|codex --workspace /projeto --consent.
 
-  vault-go context-chain status|set|clear --workspace /projeto [--roots /a,/b] [--worktree-parent] [--consent]
+  vault-go context-chain status|set|clear --workspace /projeto [--roots /a,/b] [--worktree-parent] [--all-projects] [--consent]
       Contexto do SessionStart em projetos relacionados; orçamento total e conta preservados.
 
   vault-go hook <adaptador> <evento>
@@ -493,7 +493,7 @@ export async function runContextChain(args, home = vaultHome()) {
         const workspace = optionValue(args, '--workspace');
         if (!workspace)
             throw new Error('Informe --workspace /projeto.');
-        result = configureContextChain(home, { workspace, roots: command === 'clear' ? [] : (optionValue(args, '--roots') ?? '').split(',').filter(Boolean), consent: args.includes('--consent'), includeWorktreeParent: command === 'set' && args.includes('--worktree-parent') });
+        result = configureContextChain(home, { workspace, roots: command === 'clear' ? [] : (optionValue(args, '--roots') ?? '').split(',').filter(Boolean), consent: args.includes('--consent'), includeWorktreeParent: command === 'set' && args.includes('--worktree-parent'), allProjects: command === 'set' && args.includes('--all-projects') });
     }
     else
         throw new Error('vault-go context-chain status|set|clear');

package/dist/client-prompts.d.ts

@@ -0,0 +1,2 @@
+/** Whether a prompt was generated by the client itself; the same text from another client is a person's prompt. */
+export declare function isClientInternalPrompt(adapter: string, text: string): boolean;

package/dist/client-prompts.js

@@ -0,0 +1,34 @@
+// Clients send their own helper threads through the same prompt hook as a
+// person's turn. Storing them creates sessions and spends generation on the
+// client's internals, so they are recognised by their fixed opening lines,
+// never by phrases a person would type.
+const CODEX_INTERNAL_PROMPT_OPENINGS = [
+    // Codex app: names a task.
+    /^You are a helpful assistant\. You will be presented with a user prompt, and your job is to provide a short title/,
+    // Codex memories: the consolidation pass.
+    /^## Memory Writing Agent: Phase 2 \(Consolidation\)/,
+    // Codex app: onboarding suggestions.
+    /^# Overview\r?\n(?:\r?\n)?Generate 0 to 3 hyperpersonalized suggestions/,
+    // Codex app: suggests the next message for the empty composer.
+    /^This is an app-generated request for a suggested next user message\. The user did not write this message\./,
+    // Codex memories: folds rollout summaries into memory_summary.md.
+    /^Consolidate the supplied rollout summaries into `memory_summary\.md`/,
+];
+const GROK_INTERNAL_PROMPT_OPENINGS = [
+    // Research sub-agent briefings.
+    /^Independently verify every candidate claim in the JSON packet below/,
+    /^Rewrite the verified research findings/,
+    /^Investigate the JSON-encoded question/,
+    /^Break the JSON-encoded research query/,
+];
+// A turn made only of a protocol envelope (e.g. a background task notice) carries no request from a person.
+const PROTOCOL_ONLY = /^\s*<(task-notification)\b[^>]*>(?:(?!<\1\b|<\/\1\b)[\s\S])*<\/\1\s*>\s*$/;
+const MAX_PROTOCOL_PAYLOAD_CHARS = 256 * 1024;
+/** Whether a prompt was generated by the client itself; the same text from another client is a person's prompt. */
+export function isClientInternalPrompt(adapter, text) {
+    if (text.length <= MAX_PROTOCOL_PAYLOAD_CHARS && PROTOCOL_ONLY.test(text))
+        return true;
+    const opening = text.trimStart();
+    const openings = adapter === 'codex' ? CODEX_INTERNAL_PROMPT_OPENINGS : adapter === 'grok' ? GROK_INTERNAL_PROMPT_OPENINGS : [];
+    return openings.some(pattern => pattern.test(opening));
+}

package/dist/context-chain.d.ts

@@ -11,6 +11,7 @@ interface Link {
     workspace: string;
     roots: string[];
     includeWorktreeParent: boolean;
+    allProjects?: boolean;
 }
 export declare function contextChainStatus(home: string): {
     chains: Link[];
@@ -22,6 +23,7 @@ export declare function configureContextChain(home: string, input: {
     roots: string[];
     consent?: boolean;
     includeWorktreeParent?: boolean;
+    allProjects?: boolean;
 }): {
     chains: Link[];
     maxProjects: number;

package/dist/context-chain.js

@@ -16,7 +16,7 @@ function configuration(home) {
 }
 export function contextChainStatus(home) { return { chains: configuration(home).chains, maxProjects: 5, default: 'workspace-only' }; }
 export function configureContextChain(home, input) {
-    if ((input.roots.length || input.includeWorktreeParent) && input.consent !== true)
+    if ((input.roots.length || input.includeWorktreeParent || input.allProjects) && input.consent !== true)
         throw new Error('Relacionar projetos exige consent=true.');
     if (!captureOwner(home))
         throw new Error('Autentique a conta antes de relacionar projetos.');
@@ -27,8 +27,9 @@ export function configureContextChain(home, input) {
         throw new Error('Diretório de projeto inexistente.');
     const config = configuration(home);
     config.chains = config.chains.filter(c => c.workspace !== workspace);
-    if (roots.length || input.includeWorktreeParent)
-        config.chains.push({ workspace, roots, includeWorktreeParent: input.includeWorktreeParent === true });
+    // allProjects is the account-wide opt-in: every non-private project of this account joins the context budget.
+    if (roots.length || input.includeWorktreeParent || input.allProjects)
+        config.chains.push({ workspace, roots, includeWorktreeParent: input.includeWorktreeParent === true, ...(input.allProjects === true ? { allProjects: true } : {}) });
     if (config.chains.length > 50)
         throw new Error('Limite de 50 cadeias de contexto.');
     privateJson(home, 'context-chains.json', config);
@@ -74,7 +75,14 @@ export async function loadProjectContext(home, cloud, input) {
         if (project && project.private !== true && project.isPrivate !== true && project.is_private !== true && !selected.some(p => p.id === project.id))
             selected.push(project);
     }
-    // A worktree shares its canonical project; extra projects still require explicit links.
+    if (chain?.allProjects === true) {
+        for (const item of input.projects) {
+            const project = item && typeof item === 'object' ? item : undefined;
+            if (project && typeof project.id === 'string' && project.private !== true && project.isPrivate !== true && project.is_private !== true && !selected.some(p => p.id === project.id))
+                selected.push(project);
+        }
+    }
+    // A worktree shares its canonical project; extra projects still require explicit links or the allProjects opt-in.
     if (selected[0]?.id !== input.primary.id)
         return '';
     const projects = selected.slice(0, Math.min(5, input.limit)), parts = [];

package/dist/context-engines.d.ts

@@ -9,6 +9,11 @@ export interface EngineModelOption {
     aliases?: readonly string[];
 }
 export declare const ENGINE_MODELS: Record<ContextEngineId, readonly EngineModelOption[]>;
+export declare class ContextQuotaError extends Error {
+    readonly engine: ContextEngineId;
+    constructor(engine: ContextEngineId);
+}
+export declare function isQuotaFailure(error: unknown): boolean;
 export interface ContextResult {
     title: string;
     content: string;
@@ -78,3 +83,4 @@ export interface GenerateContextOptions {
     }) => Promise<unknown>;
 }
 export declare function generateContext(home: string, engine: unknown, text: unknown, options?: GenerateContextOptions): Promise<ContextResult>;
+export declare function generateContextWithFallback(home: string, engine: unknown, text: unknown, options?: GenerateContextOptions): Promise<ContextResult>;

package/dist/context-engines.js

@@ -54,6 +54,23 @@ const KEY_ENV = {
     openrouter: ["VAULT_GO_OPENROUTER_API_KEY", "OPENROUTER_API_KEY"],
     gemini: ["VAULT_GO_GEMINI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY"],
 };
+// Provider notices that mean the allowance ran out rather than a bad request.
+// A spent Anthropic API key is reported as a 400 "credit balance is too low".
+const QUOTA_NOTICE = /credit balance is too low|usage limit|rate[ _]limit|limit reached|quota|too many requests/i;
+export class ContextQuotaError extends Error {
+    engine;
+    constructor(engine) {
+        super("Context engine quota exhausted.");
+        this.engine = engine;
+        this.name = "ContextQuotaError";
+    }
+}
+export function isQuotaFailure(error) {
+    if (error instanceof ContextQuotaError)
+        return true;
+    const status = error && typeof error === "object" ? error.status : undefined;
+    return status === 429 || status === 402 || (error instanceof Error && QUOTA_NOTICE.test(error.message));
+}
 export function isContextEngine(value) {
     return (typeof value === "string" &&
         CONTEXT_ENGINE_IDS.includes(value));
@@ -267,7 +284,9 @@ export const runContextCommand = (request) => new Promise((resolve, reject) => {
     child.on("close", (code) => finish(failure ??
         (code === 0
             ? undefined
-            : new Error("Context CLI failed. Check its login and subscription limits."))));
+            : new Error(QUOTA_NOTICE.test(stdout + stderr)
+                ? "Context CLI reported an exhausted quota."
+                : "Context CLI failed. Check its login and subscription limits."))));
     child.stdin.end(request.input ?? "");
     if (request.signal?.aborted)
         abort();
@@ -539,6 +558,8 @@ async function generateApiContext(home, engine, text, options, signal) {
             ? error
             : new Error("Context engine request failed.");
     }
+    if (response.status === 429 || response.status === 402)
+        throw new ContextQuotaError(engine);
     if (!response.ok) {
         throw new Error(engine === "openrouter"
             ? "OpenRouter request failed. Check the API key and usage limits."
@@ -582,7 +603,7 @@ export async function generateContext(home, engine, text, options = {}) {
             signal.addEventListener("abort", abort, { once: true });
             void Promise.resolve()
                 .then(() => options.managedGenerate(text, { signal, ...(modeGuidance ? { modeGuidance } : {}) }))
-                .then(resolve, reject)
+                .then(resolve, (error) => reject(isQuotaFailure(error) ? new ContextQuotaError(engine) : error))
                 .finally(() => signal.removeEventListener("abort", abort));
         });
         return validateContextResult(value, engine);
@@ -658,10 +679,11 @@ export async function generateContext(home, engine, text, options = {}) {
             timeoutMs: 90000,
             signal,
         });
-        let parsed;
+        let parsed, quota = false;
         try {
             const output = JSON.parse(result.stdout);
             if (engine === "claude-subscription") {
+                quota = output["is_error"] === true && QUOTA_NOTICE.test(String(output["result"]));
                 if (output["is_error"] === true)
                     throw new Error();
                 parsed =
@@ -671,6 +693,8 @@ export async function generateContext(home, engine, text, options = {}) {
                 parsed = output;
         }
         catch {
+            if (quota)
+                throw new ContextQuotaError(engine);
             throw new Error("Context engine returned an invalid response.");
         }
         return validateContextResult(parsed, engine);
@@ -679,3 +703,31 @@ export async function generateContext(home, engine, text, options = {}) {
         rmSync(cwd, { recursive: true, force: true });
     }
 }
+// The two Anthropic allowances stand in for each other: the managed Vault AI
+// Resume (an API key held by the server) and this machine's Claude subscription
+// login. Only an exhausted quota hands over; any other failure surfaces as is.
+const QUOTA_FALLBACK = {
+    "vault-ai-resume": "claude-subscription",
+    "claude-subscription": "vault-ai-resume",
+};
+export async function generateContextWithFallback(home, engine, text, options = {}) {
+    try {
+        return await generateContext(home, engine, text, options);
+    }
+    catch (error) {
+        const fallback = isContextEngine(engine) ? QUOTA_FALLBACK[engine] : undefined;
+        if (!fallback ||
+            !isQuotaFailure(error) ||
+            options.signal?.aborted ||
+            (options.env ?? process.env).VAULT_GO_ENGINE_FALLBACK === "off" ||
+            (fallback === "vault-ai-resume" && !options.managedGenerate))
+            throw error;
+        try {
+            return await generateContext(home, fallback, text, options);
+        }
+        catch {
+            // The stand-in being unavailable must not hide why the selected engine stopped.
+            throw error;
+        }
+    }
+}

package/dist/crystal-tools.js

@@ -2,7 +2,7 @@ import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
-const unavailable = 'Abra o Vault Desktop e ative a integração Vault MCP no Crystal.';
+const unavailable = 'Para usar o Crystal local neste computador, abra o Vault Desktop e ative a integração Vault MCP no Crystal. Em uma sessão nativa do Vault Cloud, use vault_crystal_status, vault_crystal_list, vault_crystal_read e vault_crystal_search; a conexão local do Vault Go não alcança outro computador.';
 const invalidConnection = 'Conexão local do Crystal inválida. Reative a integração no Vault Desktop.';
 const MAX_RESPONSE = 32 * 1024 * 1024;
 export const CRYSTAL_LOCKED = 'CRYSTAL_LOCKED';

package/dist/hook-install.js

@@ -9,7 +9,8 @@ function readJsonObject(path) {
         return {};
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(path, "utf8"));
+        // Windows editors may save a UTF-8 byte order mark, which JSON.parse rejects.
+        parsed = JSON.parse(readFileSync(path, "utf8").replace(/^\uFEFF/, ""));
     }
     catch (error) {
         throw new Error(`JSON inválido em ${path}; o arquivo não foi alterado.`, {
@@ -98,7 +99,9 @@ function agyHandler(event, configHome = vaultHome()) {
 }
 function agyHookManifest(configHome = vaultHome()) {
     return {
-        PreInvocation: [agyHandler("context", configHome)],
+        // SessionStart injects memory once per session. On PreInvocation it was re-sent
+        // before every model call, invalidating the provider prompt cache each step.
+        SessionStart: [agyHandler("context", configHome)],
         PreToolUse: [{ matcher: "*", hooks: [agyHandler("file-context", configHome)] }],
         PostToolUse: [
             { matcher: "*", hooks: [agyHandler("observation", configHome)] },

package/dist/hook-queue.d.ts

@@ -1,5 +1,5 @@
 import { VaultCloudClient } from './cloud.js';
-import { generateContext, type ContextResult } from './context-engines.js';
+import { generateContextWithFallback, type ContextResult } from './context-engines.js';
 import { type TelegramObservation } from './telegram.js';
 import { privateStore } from './private-store.js';
 import { type CrystalMirrorRecord } from './crystal-memory-mirror.js';
@@ -43,7 +43,7 @@ export declare function generationQueueStatus(home?: string): {
     legacyAwaitingOwnership: number;
     heldForOtherAccount: number;
 };
-export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContext, options?: {
+export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContextWithFallback, options?: {
     notifyObservation?: (observation: TelegramObservation) => Promise<unknown>;
     crystalMirrorStore?: CrystalMirrorStoreFactory;
 }): Promise<boolean>;

package/dist/hook-queue.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { VaultCloudClient } from './cloud.js';
 import { loadConfig, loadTokens, vaultHome } from './config.js';
-import { generateContext, selectedContextEngine } from './context-engines.js';
+import { generateContextWithFallback, isQuotaFailure, selectedContextEngine } from './context-engines.js';
 import { notifyTelegramObservation } from './telegram.js';
 import { pushAwareness } from './grok-awareness.js';
 import { privateStore } from './private-store.js';
@@ -88,6 +88,8 @@ function isUnusableGenerationText(text) {
 }
 function generationFailureCode(error) {
     const message = error instanceof Error ? error.message : '';
+    if (isQuotaFailure(error))
+        return 'engine_quota';
     if (message.includes('Official CLI or subscription login unavailable'))
         return 'engine_cli_unavailable';
     if (message.includes('Context engine timed out'))
@@ -238,7 +240,7 @@ export function generationQueueStatus(home = vaultHome()) {
     const jobs = readQueue(home), owner = ownerKey(home);
     return { pending: jobs.filter(j => j.owner === owner || !j.owner).length, failed: jobs.filter(j => j.owner === owner && j.lastError).length, legacyAwaitingOwnership: jobs.filter(j => !j.owner).length, heldForOtherAccount: jobs.filter(j => j.owner && j.owner !== owner).length };
 }
-export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContext, options = {}) {
+export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContextWithFallback, options = {}) {
     const release = await lock(home, 'generation-worker', false);
     if (!release)
         return false;

package/dist/hooks.js

@@ -1,4 +1,6 @@
-import { redact } from './capture-privacy.js';
+import { isFullyPrivate, redact } from './capture-privacy.js';
+import { isClientInternalPrompt } from './client-prompts.js';
+import { newestMemoryEpoch, readGateCandidate, readGateReason } from './read-gate.js';
 export { redact } from './capture-privacy.js';
 import { createHash, randomUUID } from "node:crypto";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
@@ -214,6 +216,9 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     const sessionId = string(input.session_id);
     if (!reading && !sessionId)
         return hookOutput(event, "", adapter);
+    // Client helper threads never become sessions, projects or memories.
+    if (event === "session-init" && isClientInternalPrompt(adapter, string(input.prompt)))
+        return hookOutput(event, "", adapter);
     const workspace = root(string(input.cwd, input.workspace) || process.cwd());
     const roots = projectRoots(workspace);
     const projects = await cloud.projects();
@@ -254,6 +259,11 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
             })
             : { context: await loadProjectContext(home, cloud, { workspace, primary: { id: project.id }, projects, ...limits }) });
         let context = string(result.context).slice(0, limits.maxChars);
+        if (event === "file-context" && context) {
+            const denial = await fullReadDenial(cloud, { adapter, toolName, tool, agentId: string(input.agent_id, input.agentId), workspace, prefs, memoryIds: result.memoryIds ?? result.memory_ids, context, file });
+            if (denial)
+                return denial;
+        }
         if (event === "context") {
             // Skills do projeto entram depois da memória e só no espaço que sobrar; falha aqui nunca derruba o contexto.
             try {
@@ -276,8 +286,10 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     }));
     if (typeof session.id !== "string")
         throw new Error("Sessão inválida");
-    const prompt = string(input.prompt);
-    const response = string(input.last_assistant_message);
+    // Text that is entirely <private> (or other memory tags) is dropped, never stored as a "[redacted]" placeholder.
+    const visible = (value) => isFullyPrivate(value) ? "" : value;
+    const prompt = visible(string(input.prompt));
+    const response = visible(string(input.last_assistant_message));
     const toolPayload = record(redact({
         toolName,
         toolInput: tool,
@@ -351,6 +363,31 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
         await cloud.endSession(session.id);
     return hookOutput(event, "", adapter);
 }
+// Fails open: any missing evidence or lookup error lets the Read through.
+async function fullReadDenial(cloud, request) {
+    const enabled = request.prefs.fileReadGate !== false && process.env.VAULT_GO_FILE_READ_GATE !== "off";
+    const candidate = readGateCandidate({ adapter: request.adapter, toolName: request.toolName, toolInput: request.tool, agentId: request.agentId, workspace: request.workspace, enabled });
+    const ids = Array.isArray(request.memoryIds) ? request.memoryIds.filter((id) => typeof id === "string").slice(0, 20) : [];
+    if (!candidate || !ids.length)
+        return undefined;
+    try {
+        // Memories older than the file's last change describe code that may be gone: read it.
+        if (newestMemoryEpoch(await cloud.observations(ids)) <= candidate.mtimeMs)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    return {
+        continue: true,
+        suppressOutput: true,
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: readGateReason(request.file, ids, request.context),
+        },
+    };
+}
 function boundedPreference(value, fallback, min, max) {
     return typeof value === 'number' && Number.isInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
 }

package/dist/installer.d.ts

@@ -1,6 +1,6 @@
 export declare const MCP_SERVER_NAME = "vault-go";
 export declare const MCP_SERVER_COMMAND: readonly ["bunx", "--bun", "vault-go@latest", "serve"];
-export declare const MCP_CLIENTS: readonly ["codex", "claude", "claude-desktop", "cursor", "vscode", "copilot", "windsurf", "roo", "opencode", "grok", "agy", "gemini", "vault-desktop"];
+export declare const MCP_CLIENTS: readonly ["codex", "claude", "claude-desktop", "cursor", "vscode", "copilot", "windsurf", "roo", "opencode", "grok", "agy", "gemini", "warp", "goose", "hermes", "vault-desktop"];
 export type McpClient = (typeof MCP_CLIENTS)[number];
 export interface DetectedClient {
     client: McpClient;

package/dist/installer.js

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { vaultHome } from './config.js';
 import { stageLocalRuntime } from './local-install.js';
 import { installCaptureHooks, installClientHooks, installOpenCodePlugin } from './hook-install.js';
+import { upsertYamlEntry } from './yaml-entry.js';
 import { installManagedSkills } from './skill-install.js';
 export const MCP_SERVER_NAME = 'vault-go';
 export const MCP_SERVER_COMMAND = ['bunx', '--bun', 'vault-go@latest', 'serve'];
@@ -21,6 +22,9 @@ export const MCP_CLIENTS = [
     'grok',
     'agy',
     'gemini',
+    'warp',
+    'goose',
+    'hermes',
     'vault-desktop',
 ];
 const CLIENT_ALIASES = {
@@ -34,7 +38,8 @@ function readJsonObject(path) {
         return {};
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(path, 'utf8'));
+        // Windows editors may save a UTF-8 byte order mark, which JSON.parse rejects.
+        parsed = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
     }
     catch (error) {
         throw new Error(`JSON inválido em ${path}; o arquivo não foi alterado.`, { cause: error });
@@ -62,7 +67,8 @@ function formatTomlValue(value) {
     return `[${value.map((item) => JSON.stringify(item)).join(', ')}]`;
 }
 function upsertTomlTable(path, table, assignments) {
-    const previous = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    // A byte order mark would hide a table on the first line and duplicate it on append.
+    const previous = existsSync(path) ? readFileSync(path, 'utf8').replace(/^\uFEFF/, '') : '';
     const body = Object.entries(assignments)
         .map(([key, value]) => `${key} = ${formatTomlValue(value)}`)
         .join('\n');
@@ -76,6 +82,21 @@ function upsertTomlTable(path, table, assignments) {
             : block;
     atomicWriteText(path, next);
 }
+function upsertYamlFile(path, topKey, fields) {
+    const previous = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    let next;
+    try {
+        next = upsertYamlEntry(previous, topKey, MCP_SERVER_NAME, fields);
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : 'YAML inválido'} (${path})`, { cause: error });
+    }
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.tmp`);
+    writeFileSync(temporary, next, { mode: 0o600 });
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+}
 function standardServer() {
     return {
         command: MCP_SERVER_COMMAND[0],
@@ -219,6 +240,21 @@ export function installMcpClient(client, options = {}) {
         installClientHooks('gemini', home);
         return { client, status: 'installed', destination: path };
     }
+    if (client === 'goose') {
+        // Goose starts MCP servers only from the top-level `extensions` mapping, never `mcpServers`.
+        const destination = join(home, '.config', 'goose', 'config.yaml');
+        upsertYamlFile(destination, 'extensions', {
+            enabled: true, type: 'stdio', name: MCP_SERVER_NAME,
+            cmd: MCP_SERVER_COMMAND[0], args: MCP_SERVER_COMMAND.slice(1), envs: {}, timeout: 300,
+        });
+        return { client, status: 'installed', destination };
+    }
+    if (client === 'hermes') {
+        const destination = join(home, '.hermes', 'config.yaml');
+        // MCP only: Hermes loads tools from `mcp_servers`; its capture uses a provider plugin vault-go does not ship.
+        upsertYamlFile(destination, 'mcp_servers', { command: MCP_SERVER_COMMAND[0], args: MCP_SERVER_COMMAND.slice(1) });
+        return { client, status: 'installed', destination };
+    }
     if (client === 'vault-desktop') {
         const destination = vaultDesktopMcpPath(home);
         mergeServer(destination);
@@ -236,6 +272,9 @@ export function installMcpClient(client, options = {}) {
         path = join(home, '.codeium', 'windsurf', 'mcp_config.json');
     else if (client === 'roo')
         path = resolve(cwd, '.roo', 'mcp.json');
+    // Warp reads global MCP servers from the dotfile ~/.warp/.mcp.json, not ~/.warp/mcp.json.
+    else if (client === 'warp')
+        path = join(home, '.warp', '.mcp.json');
     else
         path = join(home, '.config', 'opencode', 'opencode.json');
     if (client === 'opencode') {
@@ -284,6 +323,9 @@ export function detectMcpClients(home = homedir()) {
         ['grok', ['grok'], [join(home, '.grok')]],
         ['agy', ['agy'], [join(home, '.gemini', 'antigravity-cli'), join(home, '.gemini', 'config'), join(home, '.gemini', 'antigravity')]],
         ['gemini', ['gemini'], [join(home, '.gemini', 'settings.json')]],
+        ['warp', [], [join(home, '.warp'), '/Applications/Warp.app']],
+        ['goose', ['goose'], [join(home, '.config', 'goose')]],
+        ['hermes', ['hermes'], [join(home, '.hermes')]],
         ['vault-desktop', [], [vaultDesktopMcpPath(home), vaultDesktopDotMcpPath(home), '/Applications/Vault Desktop.app']],
     ];
     return definitions.map(([client, commands, paths]) => {

package/dist/local-dashboard.js

@@ -6,7 +6,7 @@ export function dashboardHtml() {
 
 /* Same identity tokens and glass surfaces as the Vault portal. */
 :root{--c-canvas:8 11 18;--c-surface:24 29 45;--c-surface-2:32 38 56;--c-line:53 61 81;--c-fg:241 243 252;--c-muted:172 180 203;--c-faint:148 159 187;--c-accent:185 182 255;color:rgb(var(--c-fg));background:rgb(var(--c-canvas))}body{background:radial-gradient(ellipse at 85% 8%,#534ca02e,transparent 45%),linear-gradient(145deg,#080b12,#101321 58%,#080b12)}[hidden]{display:none!important}.shell{grid-template-columns:258px 1fr;max-width:1600px}.rail{background:linear-gradient(160deg,#1c2135f5,#101522f5);border-color:#cdd8ff26}.brand{font-size:15px;letter-spacing:-.3px;gap:10px;white-space:nowrap}.brand img,.onboarding-logo{object-fit:contain;filter:drop-shadow(0 5px 12px #7775c533)}.brand-sub{display:block;font-size:9px;letter-spacing:1.7px;color:#acb4cb;margin-top:7px}.card,.panel,.onboarding,.step,.notice{background:linear-gradient(135deg,#272c3ed1,#131724e0);border-color:#cdd8ff26;box-shadow:0 24px 70px -30px #0009,inset 0 1px 0 #ffffff0c;backdrop-filter:blur(28px) saturate(135%)}.nav a.active,.nav a:hover{background:#b9b6ff20;color:#d3d1ff}.eyebrow,.step-number,.empty-symbol{color:#b9b6ff}p,.card-label{color:#acb4cb}.card-note,.row-meta,.rail-footer,.rail-label,.footer{color:#949fbb}.pulse{color:#b9b6ff;border-color:#b9b6ff30;background:#b9b6ff0d}.button{background:#202638;color:#f1f3fc;border-color:#cdd8ff26;text-decoration:none;justify-content:center}.button:hover{border-color:#b9b6ff88}.primary{background:linear-gradient(135deg,#c8c5ff,#9d9bed);color:#15152f;border-color:transparent;font-weight:650;padding:13px 20px;font-size:14px}.primary:hover{background:#d3d1ff}.onboarding{border:1px solid #cdd8ff26;border-radius:20px;overflow:hidden;margin-top:30px;animation:arrive .6s ease both}.onboarding-hero{position:relative;padding:38px;background:radial-gradient(ellipse at 100% 0%,#7370d02c,transparent 62%)}.onboarding-logo{width:86px;height:86px;margin-bottom:24px}.onboarding h1{font-size:36px;max-width:600px;line-height:1.12;margin:12px 0 18px}.onboarding-hero>p{max-width:570px;font-size:14px;line-height:1.8}.actions{display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin-top:25px}.link{color:#d3d1ff;text-decoration:none;font-size:12px}.link:hover{text-decoration:underline}.onboarding-hint{font-size:11px!important;color:#949fbb;margin-top:15px!important}.steps{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));border-top:1px solid #cdd8ff26}.step{padding:25px;background:#080b122b;box-shadow:none;border-right:1px solid #cdd8ff16}.step:last-child{border:0}.step-number{font-family:monospace;font-size:11px;margin-bottom:13px}.step h2{margin-bottom:9px}.step p{font-size:12px}.terminal-fallback{padding:22px 30px;border-top:1px solid #cdd8ff26;background:#080b1233}.terminal-fallback p{font-size:12px}.terminal-fallback code{display:block;margin-top:10px;font-size:12px;color:#d3d1ff;overflow-wrap:anywhere}.connection-message{margin-top:18px;font-size:12px;color:#d3d1ff;min-height:18px}.next-step{display:flex;justify-content:space-between;align-items:center;gap:20px;margin-top:22px;padding:23px;border:1px solid #b9b6ff30;border-radius:14px;background:#b9b6ff09}.next-step h2{margin-bottom:8px}.next-step p{font-size:12px}.next-step .actions{margin:0;flex-shrink:0}button:focus-visible,a:focus-visible,input:focus-visible,select:focus-visible{outline-color:#b9b6ff}.notice code{color:#d3d1ff}.search{border-color:#cdd8ff26;background:#0307117a}.breadcrumb b{color:#f1f3fc}.rail-footer .dot{background:#b9b6ff}.footer{margin-top:28px}@media(max-width:1100px){.shell{grid-template-columns:225px 1fr}.brand{font-size:13px}.main{padding:25px}.onboarding-hero{padding:30px}.next-step{align-items:flex-start;flex-direction:column}}@media(max-width:680px){.shell{display:block}.brand{font-size:16px}.onboarding{margin-top:22px}.onboarding-hero{padding:26px}.onboarding h1{font-size:30px}.onboarding-logo{width:65px;height:65px;margin-bottom:15px}.steps{grid-template-columns:1fr}.step{padding:20px 26px;border-right:0;border-bottom:1px solid #cdd8ff16}.step-number{margin-bottom:8px}.terminal-fallback{padding:22px 26px}.main{padding:20px}.next-step .actions{flex-shrink:1}.onboarding .actions .button{width:100%}.onboarding .actions .link{padding:8px 0}.card-value{overflow-wrap:anywhere}.nav{padding-bottom:2px}}
-.danger{border-color:#ed9a9a66;color:#ffb5b5;background:#53272d55}.danger:hover{border-color:#ffb5b5}.danger-title{color:#ffb5b5}.pagination{display:flex;gap:9px;align-items:center;flex-wrap:wrap;border-top:1px solid #cdd8ff20;margin-top:15px;padding-top:15px;color:#acb4cb;font-size:11px}.pagination label{display:flex;align-items:center;gap:7px}.pagination .page-summary{flex:1;min-width:95px}.pagination select{padding:7px}.pagination .button{padding:7px 10px}.pagination button:disabled{cursor:default}.row-open{background:transparent;border:0;text-align:left;padding:0;color:#d3d1ff;cursor:pointer;font:inherit}.row-open:hover{text-decoration:underline}.row-actions{padding-top:5px}.detail-dialog{color:#f1f3fc;background:linear-gradient(135deg,#272c3e,#131724);border:1px solid #cdd8ff40;border-radius:18px;max-width:800px;width:calc(100% - 32px);max-height:85vh;padding:26px;box-shadow:0 30px 100px #0009}.detail-dialog::backdrop{background:#050710bd;backdrop-filter:blur(5px)}.detail-dialog h2{font-size:20px;overflow-wrap:anywhere}.detail-fields{margin:0}.detail-fields dt{color:#acb4cb;font-size:11px;margin:20px 0 8px}.detail-fields dd{margin:0;font-size:13px;line-height:1.7;white-space:pre-wrap;overflow-wrap:anywhere}.detail-fields pre{font:inherit;white-space:pre-wrap;margin:0}.engine-options{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-top:18px}.engine-keys{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:12px;margin-top:16px}.engine-keys label{display:block;font-size:12px;margin-bottom:8px}.engine-keys input{width:100%;background:#0307117a;color:#f1f3fc;border:1px solid #cdd8ff26;border-radius:9px;padding:10px 12px;font:inherit;font-size:13px;margin-bottom:8px}.engine-option{display:block;padding:17px;border:1px solid #cdd8ff26;border-radius:10px;background:#080b1233;cursor:pointer}.engine-option:has(input:checked){border-color:#b9b6ff;background:#b9b6ff12}.engine-option:has(input:disabled){opacity:.7;cursor:default}.engine-option input{accent-color:#b9b6ff;margin-right:8px}.engine-option strong{font-size:12px}.engine-option p{font-size:11px;margin-top:9px}.engine-message{margin-top:13px;font-size:12px;color:#d3d1ff}.context-editor{margin-top:20px}.context-editor label{display:block;font-size:12px;margin-bottom:8px}.context-editor textarea{width:100%;min-height:130px;resize:vertical;background:#0307117a;color:#f1f3fc;border:1px solid #cdd8ff26;border-radius:9px;padding:12px;font:inherit;font-size:13px}.context-editor textarea:focus-visible{outline:2px solid #b9b6ff;outline-offset:3px}.mcp-clients{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:10px;margin-top:14px}.mcp-client{display:flex;align-items:center;justify-content:space-between;gap:10px;border:1px solid #cdd8ff26;border-radius:10px;padding:10px 12px;background:#080b1233;font-size:13px;flex-wrap:wrap}.mcp-client strong{font-size:13px;font-weight:600}.mcp-state{font-size:11px;color:#8edbc8;white-space:nowrap}.mcp-dim{opacity:.75}.mcp-evidence{font-size:10px;color:#949fbb;width:100%}.mcp-note{color:#949fbb;font-size:12px}.mcp-message{color:#ed9a9a;font-size:12px;margin-top:10px}.mcp-message:empty{display:none}.mcp-fallback{color:#949fbb;font-size:11px;margin-top:12px}.mcp-fallback code{font-size:11px;color:#c7d4df;background:#0307117a;border-radius:6px;padding:2px 6px}@media(max-width:800px){.engine-options{grid-template-columns:1fr}}@media(prefers-reduced-motion:reduce){.detail-dialog::backdrop{backdrop-filter:none}}</style><script src="/app.js" defer></script></head><body><div class="shell"><aside class="rail"><div class="brand"><img src="/logo.png" alt="" width="46" height="46"><div>AI Vault Memory<span class="brand-sub">LOCAL AGENT</span></div></div><div class="rail-label" data-i18n="workspace">WORKSPACE</div><nav class="nav" aria-label="Navigation"><a class="active" href="#overview"><span class="icon">◈</span><span data-i18n="overview">Overview</span></a><a href="#activity"><span class="icon">⌁</span><span data-i18n="activity">Activity</span></a><a href="#memories"><span class="icon">▤</span><span data-i18n="memories">Memories</span></a><a href="#context"><span class="icon">✧</span><span data-i18n="contextEngine">Context engine</span></a><a href="#projects"><span class="icon">▱</span><span data-i18n="projects">Projects</span></a></nav><div class="rail-footer"><span class="dot"></span><span data-i18n="localWorkspace">Your local workspace</span><br><span data-i18n="privacy">Activity metadata stays local.</span></div></aside><main class="main" id="overview"><header class="top"><div class="breadcrumb">Vault <span aria-hidden="true"> / </span><b data-i18n="localMonitor">Local monitor</b></div><div class="controls"><select id="locale" aria-label="Language"><option value="en">English</option><option value="pt">Português</option><option value="es">Español</option></select><button class="button" id="logout" type="button" hidden data-i18n="logout">Sign out of dashboard</button><button class="button" id="reconnect" type="button" hidden data-i18n="reconnect">Reconnect account</button><button class="button" id="refresh" type="button"><span aria-hidden="true">↻</span><span data-i18n="refresh">Refresh cloud</span></button></div></header><div id="error" class="error" role="status" aria-live="polite"></div><section class="onboarding" id="onboarding"><div class="onboarding-hero"><img class="onboarding-logo" src="/logo.png" alt="" width="86" height="86"><div class="eyebrow" data-i18n="connectEyebrow">AI VAULT MEMORY · LOCAL</div><h1 data-i18n="connectTitle">Your memory. Connected to this machine.</h1><p data-i18n="connectIntro">Connect your Vault account to see your memories, projects and recent activity in one place.</p><div class="actions"><button type="button" class="button primary" id="connect" data-i18n="connect">Connect to Vault</button><a class="link" href="${VAULT_WEB_APP_URL}" target="_blank" rel="noopener noreferrer" data-i18n="openPortal">Open Vault portal ↗</a></div><p class="onboarding-hint" data-i18n="connectHint">Sign in securely in a separate window. Your password stays with the Vault portal.</p><div class="connection-message" id="connection-message" role="status" aria-live="polite"></div><a id="auth-fallback" class="button" hidden target="_blank" rel="noopener noreferrer" data-i18n="continueAuth">Continue sign-in ↗</a></div><div class="steps"><article class="step"><div class="step-number">01 / VAULT</div><h2 data-i18n="stepAccount">Connect your account</h2><p data-i18n="stepAccountBody">Sign in to Vault and authorize this local agent.</p></article><article class="step"><div class="step-number">02 / MCP</div><h2 data-i18n="stepClient">Connect your AI clients</h2><p data-i18n="stepClientBody">After signing in, connect Claude, Codex and other clients with one click, right here.</p></article><article class="step"><div class="step-number">03 / MEMORY</div><h2 data-i18n="stepMemory">Build your first memory</h2><p data-i18n="stepMemoryBody">Ask your connected client to save useful context, then follow its activity here.</p></article></div><div class="terminal-fallback"><button class="button" id="verify-connection" type="button" data-i18n="verifyConnection">Already signed in? Check connection</button><p style="margin-top:16px" data-i18n="terminalFallback">Already connected through the CLI? Open a secure local session:</p><code>bunx --bun vault-go@latest local open</code></div></section><div id="dashboard" hidden><div class="welcome"><div><div class="eyebrow" data-i18n="eyebrow">YOUR KNOWLEDGE, CONNECTED</div><h1 data-i18n="title">Your local workspace.</h1><p data-i18n="subtitle">Your Vault account, memories and activity on this machine.</p></div><img src="/logo.png" alt="" width="56" height="56"></div><div id="session-notice" hidden></div><section class="cards" aria-label="Status"><article class="card"><div class="card-label"><span data-i18n="localService">Local service</span><span aria-hidden="true">◈</span></div><div class="card-value" id="local-status">—</div><div class="card-note" id="local-note">localhost:38850</div></article><article class="card"><div class="card-label"><span data-i18n="cloudConnection">Cloud connection</span><span aria-hidden="true">↗</span></div><div class="card-value" id="cloud-status">—</div><div class="card-note" id="cloud-note">—</div></article><article class="card"><div class="card-label"><span data-i18n="recentOperations">Recent operations</span><span aria-hidden="true">⌁</span></div><div class="card-value" id="activity-total">—</div><div class="card-note" data-i18n="operationsNote">Recent MCP request metadata</div></article></section><section class="next-step" id="first-memory"><div><h2 data-i18n="firstTitle">Connect your AI clients</h2><p data-i18n="firstBody">Connect Claude, Codex and other clients here in one click, then ask them to save context. Memories appear after a cloud refresh.</p><div class="mcp-clients" id="mcp-clients" role="group" aria-label="AI clients"></div><p id="mcp-message" role="status" aria-live="polite" class="mcp-message"></p><p data-i18n="rememberPrompt" style="margin-top:10px"></p><p class="mcp-fallback"><span data-i18n="mcpFallback"></span> <code>bunx --bun vault-go@latest install</code></p></div><div class="actions"><a class="link" href="${VAULT_WEB_MCP_URL}" target="_blank" rel="noopener noreferrer" data-i18n="otherClients">Other clients ↗</a><a class="link" href="${VAULT_WEB_MEMORY_URL}" target="_blank" rel="noopener noreferrer" data-i18n="openMemories">Open memories ↗</a></div></section><div class="layout"><section class="panel wide" id="security"><div class="panel-head"><h2 data-i18n="securityTitle">Security on this machine</h2></div><div id="security-facts"></div><div class="actions"><button class="button danger" id="disconnect-device" type="button" data-i18n="disconnectDevice">Disconnect device</button></div></section><section class="panel wide" id="context"><div class="panel-head"><h2 data-i18n="contextEngine">Context engine</h2></div><p data-i18n="engineIntro">Choose how Vault prepares your context.</p><div class="engine-options" id="engine-options" role="radiogroup" aria-label="Context engine"></div><div class="engine-options" id="model-options" role="radiogroup" aria-label="Context model"></div><div class="engine-keys" id="engine-keys"></div><div class="engine-message" id="engine-message" role="status" aria-live="polite"></div><div class="context-editor"><label for="context-text" data-i18n="contextText">Text to prepare</label><textarea id="context-text" maxlength="16000" aria-describedby="context-note"></textarea><p id="context-note" data-i18n="contextNote"></p><div class="actions"><button class="button primary" id="context-preview" type="button" data-i18n="contextPreview"></button><button class="button" id="context-stop" type="button" data-i18n="cancel" hidden></button></div><p id="context-progress" role="status" aria-live="polite"></p></div></section><section class="panel" id="activity"><div class="panel-head"><h2 data-i18n="activity">Activity</h2><span class="count" id="activity-count">0</span></div><input class="search" id="activity-search" type="search" data-placeholder="searchActivity" aria-label="Search activity"><div id="activity-list"></div><div class="pagination" id="activity-pagination"></div></section><section class="panel" id="memories"><div class="panel-head"><h2 data-i18n="memories">Memories</h2><span class="count" id="memory-count">0</span></div><input class="search" id="memory-search" type="search" data-placeholder="searchMemories" aria-label="Search memories"><div id="memory-list"></div><div class="pagination" id="memory-pagination"></div></section><section class="panel wide" id="projects"><div class="panel-head"><h2 data-i18n="projects">Projects</h2><span class="count" id="project-count">0</span></div><input class="search" id="project-search" type="search" data-placeholder="searchProjects" aria-label="Search projects"><div id="project-list"></div><div class="pagination" id="project-pagination"></div></section></div></div><footer class="footer"><span data-i18n="footer">Vault Local · Context with a place to call home.</span><span id="updated" aria-live="off">—</span></footer></main></div><dialog class="detail-dialog" id="detail-dialog" aria-labelledby="detail-title"><div class="panel-head"><h2 id="detail-title"></h2><button class="button" type="button" id="detail-copy" hidden data-i18n="copyResult">Copy result</button><button class="button" type="button" id="detail-close" data-i18n="close">Close</button></div><dl class="detail-fields" id="detail-fields"></dl></dialog><dialog class="detail-dialog" id="logout-dialog" aria-labelledby="logout-title" aria-describedby="logout-description"><h2 id="logout-title" data-i18n="logout"></h2><p id="logout-description" data-i18n="logoutDescription" style="margin-top:16px"></p><div class="actions"><button class="button" type="button" id="logout-cancel" data-i18n="cancel"></button><button class="button primary" type="button" id="logout-confirm" data-i18n="logoutConfirm"></button></div></dialog><dialog class="detail-dialog" id="context-confirm-dialog" aria-labelledby="context-confirm-title" aria-describedby="context-confirm-note"><h2 id="context-confirm-title" data-i18n="contextPreview"></h2><p id="context-confirm-engine" style="margin-top:16px"></p><p id="context-confirm-billing"></p><p id="context-confirm-note" data-i18n="contextConsentNote" style="margin-top:16px"></p><pre id="context-confirm-text" style="white-space:pre-wrap;overflow-wrap:anywhere;max-height:32vh;overflow:auto;font-size:12px;line-height:1.7"></pre><label style="display:flex;gap:10px;align-items:flex-start;font-size:12px"><input id="context-consent" type="checkbox"><span data-i18n="contextConsent"></span></label><div class="actions"><button class="button" id="context-cancel" type="button" data-i18n="cancel"></button><button class="button primary" id="context-generate" type="button" disabled data-i18n="contextGenerate"></button></div></dialog><dialog class="detail-dialog" id="disconnect-dialog" aria-labelledby="disconnect-title" aria-describedby="disconnect-description"><h2 class="danger-title" id="disconnect-title" data-i18n="disconnectDevice"></h2><p id="disconnect-description" data-i18n="disconnectDescription" style="margin-top:16px"></p><p id="disconnect-error" class="error" role="alert"></p><div class="actions"><button class="button" type="button" id="disconnect-cancel" data-i18n="cancel"></button><button class="button danger" type="button" id="disconnect-confirm" data-i18n="disconnectConfirm"></button></div></dialog></body></html>`;
+.danger{border-color:#ed9a9a66;color:#ffb5b5;background:#53272d55}.danger:hover{border-color:#ffb5b5}.danger-title{color:#ffb5b5}.pagination{display:flex;gap:9px;align-items:center;flex-wrap:wrap;border-top:1px solid #cdd8ff20;margin-top:15px;padding-top:15px;color:#acb4cb;font-size:11px}.pagination label{display:flex;align-items:center;gap:7px}.pagination .page-summary{flex:1;min-width:95px}.pagination select{padding:7px}.pagination .button{padding:7px 10px}.pagination button:disabled{cursor:default}.row-open{background:transparent;border:0;text-align:left;padding:0;color:#d3d1ff;cursor:pointer;font:inherit}.row-open:hover{text-decoration:underline}.row-actions{padding-top:5px}.detail-dialog{color:#f1f3fc;background:linear-gradient(135deg,#272c3e,#131724);border:1px solid #cdd8ff40;border-radius:18px;max-width:800px;width:calc(100% - 32px);max-height:85vh;padding:26px;box-shadow:0 30px 100px #0009}.detail-dialog::backdrop{background:#050710bd;backdrop-filter:blur(5px)}.detail-dialog h2{font-size:20px;overflow-wrap:anywhere}.detail-fields{margin:0}.detail-fields dt{color:#acb4cb;font-size:11px;margin:20px 0 8px}.detail-fields dd{margin:0;font-size:13px;line-height:1.7;white-space:pre-wrap;overflow-wrap:anywhere}.detail-fields pre{font:inherit;white-space:pre-wrap;margin:0}.clamped{display:-webkit-box;-webkit-box-orient:vertical;-webkit-line-clamp:8;overflow:hidden}.row-title.clamped{-webkit-line-clamp:3}.show-more{background:transparent;border:0;padding:6px 0 0;color:#b9b6ff;font:inherit;font-size:12px;cursor:pointer}.show-more:hover{text-decoration:underline}.show-more:focus-visible{outline:2px solid #b9b6ff;outline-offset:3px;border-radius:4px}.engine-options{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-top:18px}.engine-keys{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:12px;margin-top:16px}.engine-keys label{display:block;font-size:12px;margin-bottom:8px}.engine-keys input{width:100%;background:#0307117a;color:#f1f3fc;border:1px solid #cdd8ff26;border-radius:9px;padding:10px 12px;font:inherit;font-size:13px;margin-bottom:8px}.engine-option{display:block;padding:17px;border:1px solid #cdd8ff26;border-radius:10px;background:#080b1233;cursor:pointer}.engine-option:has(input:checked){border-color:#b9b6ff;background:#b9b6ff12}.engine-option:has(input:disabled){opacity:.7;cursor:default}.engine-option input{accent-color:#b9b6ff;margin-right:8px}.engine-option strong{font-size:12px}.engine-option p{font-size:11px;margin-top:9px}.engine-message{margin-top:13px;font-size:12px;color:#d3d1ff}.context-editor{margin-top:20px}.context-editor label{display:block;font-size:12px;margin-bottom:8px}.context-editor textarea{width:100%;min-height:130px;resize:vertical;background:#0307117a;color:#f1f3fc;border:1px solid #cdd8ff26;border-radius:9px;padding:12px;font:inherit;font-size:13px}.context-editor textarea:focus-visible{outline:2px solid #b9b6ff;outline-offset:3px}.mcp-clients{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:10px;margin-top:14px}.mcp-client{display:flex;align-items:center;justify-content:space-between;gap:10px;border:1px solid #cdd8ff26;border-radius:10px;padding:10px 12px;background:#080b1233;font-size:13px;flex-wrap:wrap}.mcp-client strong{font-size:13px;font-weight:600}.mcp-state{font-size:11px;color:#8edbc8;white-space:nowrap}.mcp-dim{opacity:.75}.mcp-evidence{font-size:10px;color:#949fbb;width:100%}.mcp-note{color:#949fbb;font-size:12px}.mcp-message{color:#ed9a9a;font-size:12px;margin-top:10px}.mcp-message:empty{display:none}.mcp-fallback{color:#949fbb;font-size:11px;margin-top:12px}.mcp-fallback code{font-size:11px;color:#c7d4df;background:#0307117a;border-radius:6px;padding:2px 6px}@media(max-width:800px){.engine-options{grid-template-columns:1fr}}@media(prefers-reduced-motion:reduce){.detail-dialog::backdrop{backdrop-filter:none}}</style><script src="/app.js" defer></script></head><body><div class="shell"><aside class="rail"><div class="brand"><img src="/logo.png" alt="" width="46" height="46"><div>AI Vault Memory<span class="brand-sub">LOCAL AGENT</span></div></div><div class="rail-label" data-i18n="workspace">WORKSPACE</div><nav class="nav" aria-label="Navigation"><a class="active" href="#overview"><span class="icon">◈</span><span data-i18n="overview">Overview</span></a><a href="#activity"><span class="icon">⌁</span><span data-i18n="activity">Activity</span></a><a href="#memories"><span class="icon">▤</span><span data-i18n="memories">Memories</span></a><a href="#context"><span class="icon">✧</span><span data-i18n="contextEngine">Context engine</span></a><a href="#projects"><span class="icon">▱</span><span data-i18n="projects">Projects</span></a></nav><div class="rail-footer"><span class="dot"></span><span data-i18n="localWorkspace">Your local workspace</span><br><span data-i18n="privacy">Activity metadata stays local.</span></div></aside><main class="main" id="overview"><header class="top"><div class="breadcrumb">Vault <span aria-hidden="true"> / </span><b data-i18n="localMonitor">Local monitor</b></div><div class="controls"><select id="locale" aria-label="Language"><option value="en">English</option><option value="pt">Português</option><option value="es">Español</option></select><button class="button" id="logout" type="button" hidden data-i18n="logout">Sign out of dashboard</button><button class="button" id="reconnect" type="button" hidden data-i18n="reconnect">Reconnect account</button><button class="button" id="refresh" type="button"><span aria-hidden="true">↻</span><span data-i18n="refresh">Refresh cloud</span></button></div></header><div id="error" class="error" role="status" aria-live="polite"></div><section class="onboarding" id="onboarding"><div class="onboarding-hero"><img class="onboarding-logo" src="/logo.png" alt="" width="86" height="86"><div class="eyebrow" data-i18n="connectEyebrow">AI VAULT MEMORY · LOCAL</div><h1 data-i18n="connectTitle">Your memory. Connected to this machine.</h1><p data-i18n="connectIntro">Connect your Vault account to see your memories, projects and recent activity in one place.</p><div class="actions"><button type="button" class="button primary" id="connect" data-i18n="connect">Connect to Vault</button><a class="link" href="${VAULT_WEB_APP_URL}" target="_blank" rel="noopener noreferrer" data-i18n="openPortal">Open Vault portal ↗</a></div><p class="onboarding-hint" data-i18n="connectHint">Sign in securely in a separate window. Your password stays with the Vault portal.</p><div class="connection-message" id="connection-message" role="status" aria-live="polite"></div><a id="auth-fallback" class="button" hidden target="_blank" rel="noopener noreferrer" data-i18n="continueAuth">Continue sign-in ↗</a></div><div class="steps"><article class="step"><div class="step-number">01 / VAULT</div><h2 data-i18n="stepAccount">Connect your account</h2><p data-i18n="stepAccountBody">Sign in to Vault and authorize this local agent.</p></article><article class="step"><div class="step-number">02 / MCP</div><h2 data-i18n="stepClient">Connect your AI clients</h2><p data-i18n="stepClientBody">After signing in, connect Claude, Codex and other clients with one click, right here.</p></article><article class="step"><div class="step-number">03 / MEMORY</div><h2 data-i18n="stepMemory">Build your first memory</h2><p data-i18n="stepMemoryBody">Ask your connected client to save useful context, then follow its activity here.</p></article></div><div class="terminal-fallback"><button class="button" id="verify-connection" type="button" data-i18n="verifyConnection">Already signed in? Check connection</button><p style="margin-top:16px" data-i18n="terminalFallback">Already connected through the CLI? Open a secure local session:</p><code>bunx --bun vault-go@latest local open</code></div></section><div id="dashboard" hidden><div class="welcome"><div><div class="eyebrow" data-i18n="eyebrow">YOUR KNOWLEDGE, CONNECTED</div><h1 data-i18n="title">Your local workspace.</h1><p data-i18n="subtitle">Your Vault account, memories and activity on this machine.</p></div><img src="/logo.png" alt="" width="56" height="56"></div><div id="session-notice" hidden></div><section class="cards" aria-label="Status"><article class="card"><div class="card-label"><span data-i18n="localService">Local service</span><span aria-hidden="true">◈</span></div><div class="card-value" id="local-status">—</div><div class="card-note" id="local-note">localhost:38850</div></article><article class="card"><div class="card-label"><span data-i18n="cloudConnection">Cloud connection</span><span aria-hidden="true">↗</span></div><div class="card-value" id="cloud-status">—</div><div class="card-note" id="cloud-note">—</div></article><article class="card"><div class="card-label"><span data-i18n="recentOperations">Recent operations</span><span aria-hidden="true">⌁</span></div><div class="card-value" id="activity-total">—</div><div class="card-note" data-i18n="operationsNote">Recent MCP request metadata</div></article></section><section class="next-step" id="first-memory"><div><h2 data-i18n="firstTitle">Connect your AI clients</h2><p data-i18n="firstBody">Connect Claude, Codex and other clients here in one click, then ask them to save context. Memories appear after a cloud refresh.</p><div class="mcp-clients" id="mcp-clients" role="group" aria-label="AI clients"></div><p id="mcp-message" role="status" aria-live="polite" class="mcp-message"></p><p data-i18n="rememberPrompt" style="margin-top:10px"></p><p class="mcp-fallback"><span data-i18n="mcpFallback"></span> <code>bunx --bun vault-go@latest install</code></p></div><div class="actions"><a class="link" href="${VAULT_WEB_MCP_URL}" target="_blank" rel="noopener noreferrer" data-i18n="otherClients">Other clients ↗</a><a class="link" href="${VAULT_WEB_MEMORY_URL}" target="_blank" rel="noopener noreferrer" data-i18n="openMemories">Open memories ↗</a></div></section><div class="layout"><section class="panel wide" id="security"><div class="panel-head"><h2 data-i18n="securityTitle">Security on this machine</h2></div><div id="security-facts"></div><div class="actions"><button class="button danger" id="disconnect-device" type="button" data-i18n="disconnectDevice">Disconnect device</button></div></section><section class="panel wide" id="context"><div class="panel-head"><h2 data-i18n="contextEngine">Context engine</h2></div><p data-i18n="engineIntro">Choose how Vault prepares your context.</p><div class="engine-options" id="engine-options" role="radiogroup" aria-label="Context engine"></div><div class="engine-options" id="model-options" role="radiogroup" aria-label="Context model"></div><div class="engine-keys" id="engine-keys"></div><div class="engine-message" id="engine-message" role="status" aria-live="polite"></div><div class="context-editor"><label for="context-text" data-i18n="contextText">Text to prepare</label><textarea id="context-text" maxlength="16000" aria-describedby="context-note"></textarea><p id="context-note" data-i18n="contextNote"></p><div class="actions"><button class="button primary" id="context-preview" type="button" data-i18n="contextPreview"></button><button class="button" id="context-stop" type="button" data-i18n="cancel" hidden></button></div><p id="context-progress" role="status" aria-live="polite"></p></div></section><section class="panel" id="activity"><div class="panel-head"><h2 data-i18n="activity">Activity</h2><span class="count" id="activity-count">0</span></div><input class="search" id="activity-search" type="search" data-placeholder="searchActivity" aria-label="Search activity"><div id="activity-list"></div><div class="pagination" id="activity-pagination"></div></section><section class="panel" id="memories"><div class="panel-head"><h2 data-i18n="memories">Memories</h2><span class="count" id="memory-count">0</span></div><input class="search" id="memory-search" type="search" data-placeholder="searchMemories" aria-label="Search memories"><div id="memory-list"></div><div class="pagination" id="memory-pagination"></div></section><section class="panel wide" id="projects"><div class="panel-head"><h2 data-i18n="projects">Projects</h2><span class="count" id="project-count">0</span></div><input class="search" id="project-search" type="search" data-placeholder="searchProjects" aria-label="Search projects"><div id="project-list"></div><div class="pagination" id="project-pagination"></div></section></div></div><footer class="footer"><span data-i18n="footer">Vault Local · Context with a place to call home.</span><span id="updated" aria-live="off">—</span></footer></main></div><dialog class="detail-dialog" id="detail-dialog" aria-labelledby="detail-title"><div class="panel-head"><h2 id="detail-title"></h2><button class="button" type="button" id="detail-copy" hidden data-i18n="copyResult">Copy result</button><button class="button" type="button" id="detail-close" data-i18n="close">Close</button></div><dl class="detail-fields" id="detail-fields"></dl></dialog><dialog class="detail-dialog" id="logout-dialog" aria-labelledby="logout-title" aria-describedby="logout-description"><h2 id="logout-title" data-i18n="logout"></h2><p id="logout-description" data-i18n="logoutDescription" style="margin-top:16px"></p><div class="actions"><button class="button" type="button" id="logout-cancel" data-i18n="cancel"></button><button class="button primary" type="button" id="logout-confirm" data-i18n="logoutConfirm"></button></div></dialog><dialog class="detail-dialog" id="context-confirm-dialog" aria-labelledby="context-confirm-title" aria-describedby="context-confirm-note"><h2 id="context-confirm-title" data-i18n="contextPreview"></h2><p id="context-confirm-engine" style="margin-top:16px"></p><p id="context-confirm-billing"></p><p id="context-confirm-note" data-i18n="contextConsentNote" style="margin-top:16px"></p><pre id="context-confirm-text" style="white-space:pre-wrap;overflow-wrap:anywhere;max-height:32vh;overflow:auto;font-size:12px;line-height:1.7"></pre><label style="display:flex;gap:10px;align-items:flex-start;font-size:12px"><input id="context-consent" type="checkbox"><span data-i18n="contextConsent"></span></label><div class="actions"><button class="button" id="context-cancel" type="button" data-i18n="cancel"></button><button class="button primary" id="context-generate" type="button" disabled data-i18n="contextGenerate"></button></div></dialog><dialog class="detail-dialog" id="disconnect-dialog" aria-labelledby="disconnect-title" aria-describedby="disconnect-description"><h2 class="danger-title" id="disconnect-title" data-i18n="disconnectDevice"></h2><p id="disconnect-description" data-i18n="disconnectDescription" style="margin-top:16px"></p><p id="disconnect-error" class="error" role="alert"></p><div class="actions"><button class="button" type="button" id="disconnect-cancel" data-i18n="cancel"></button><button class="button danger" type="button" id="disconnect-confirm" data-i18n="disconnectConfirm"></button></div></dialog></body></html>`;
 }
 export function dashboardScript() {
     return `"use strict";
@@ -34,7 +34,8 @@ export function dashboardScript() {
     en:{engineUpdateCli:'Update the official CLI to a version supporting isolated context generation.',engineClaudeLogin:'Sign in with a Claude subscription using claude auth login.',engineCodexLogin:'Sign in with ChatGPT using codex login.',engineCliUnavailable:'Official CLI or subscription login unavailable. Install or sign in using the provider CLI.',engineVaultUnavailable:'Vault AI Resume is not configured or unavailable for this account.',engineProviderCheck:'Provider readiness is checked when generating.',engineObserverMissing:'Managed observer is not configured.',engineOpenrouterKey:'Configure an OpenRouter API key with vault-go engine key openrouter.',engineGeminiKey:'Configure a Gemini API key with vault-go engine key gemini.',billingVault:'Uses the Vault observer allowance.',billingClaude:'Uses the provider allowance for Claude Code non-interactive runs; limits/additional charges may apply.',billingOpenai:'Uses your ChatGPT subscription through Codex. Provider limits or credits may apply.',billingOpenrouter:'Uses your OpenRouter key and credits. Provider limits may apply.',billingGemini:'Uses your Gemini API key. Google rate limits or billing may apply.',openrouterKey:'OpenRouter API key',geminiKey:'Gemini API key',saveKey:'Save key',keyConfigured:'Key configured on this machine',keyMissing:'Paste the key and save',keySaved:'Key stored with private file permissions.',keyFailed:'Could not store the key. Try again.',keyOs:'Operating system keychain',keyFile:'Local file protected by permissions',keyEphemeral:'In memory for this run only',keyUnavailable:'Unavailable'},
     es:{engineUpdateCli:'Actualiza el CLI oficial a una versión compatible con la generación aislada de contexto.',engineClaudeLogin:'Inicia sesión con tu suscripción Claude usando claude auth login.',engineCodexLogin:'Inicia sesión con tu cuenta ChatGPT usando codex login.',engineCliUnavailable:'CLI oficial o sesión de la suscripción no disponible. Instala el CLI del proveedor o inicia sesión mediante él.',engineVaultUnavailable:'Vault AI Resume no está configurado o no está disponible para esta cuenta.',engineProviderCheck:'La disponibilidad del proveedor se comprobará al generar.',engineObserverMissing:'El observador administrado no está configurado.',engineOpenrouterKey:'Configura una clave OpenRouter con vault-go engine key openrouter.',engineGeminiKey:'Configura una clave Gemini con vault-go engine key gemini.',billingVault:'Usa la cuota del observador de Vault.',billingClaude:'Usa la cuota del proveedor para ejecuciones no interactivas de Claude Code; pueden aplicarse límites y cargos adicionales.',billingOpenai:'Usa tu suscripción ChatGPT mediante Codex. Pueden aplicarse límites o créditos de uso del proveedor.',billingOpenrouter:'Usa tu clave y créditos de OpenRouter. Pueden aplicarse límites del proveedor.',billingGemini:'Usa tu clave de la API Gemini. Pueden aplicarse límites o facturación de Google.',openrouterKey:'Clave OpenRouter',geminiKey:'Clave Gemini',saveKey:'Guardar clave',keyConfigured:'Clave configurada en este equipo',keyMissing:'Pega la clave y guarda',keySaved:'Clave guardada con permisos privados.',keyFailed:'No se pudo guardar la clave. Inténtalo de nuevo.',keyOs:'Llavero del sistema operativo',keyFile:'Archivo local protegido por permisos',keyEphemeral:'Solo en memoria durante esta ejecución',keyUnavailable:'No disponible'}
   };
-  for (const language of Object.keys(strings)) Object.assign(strings[language],onboardingCopy[language],detailCopy[language],engineCopy[language]);
+  const disclosureCopy={en:{showMore:'Show more',showLess:'Show less'},pt:{showMore:'Mostrar mais',showLess:'Mostrar menos'},es:{showMore:'Mostrar más',showLess:'Mostrar menos'}};
+  for (const language of Object.keys(strings)) Object.assign(strings[language],onboardingCopy[language],detailCopy[language],engineCopy[language],disclosureCopy[language]);
   let locale = navigator.language.slice(0,2);
   try { locale = localStorage.getItem('vault-local-locale') || locale; } catch {}
   if (!strings[locale]) locale = 'en';
@@ -54,6 +55,17 @@ export function dashboardScript() {
   let mcpClients = null, mcpChecked = 0, mcpMessage = '';
   const mcpBusy = {};
   let contextPreview=null, contextJob=null, contextTimer=null, contextStarted=0, contextMessage='', contextResult=null, contextStarting=false;
+  // Machine-driven sessions produce multi-thousand-character prompts and payloads.
+  // Past these bounds a value is clamped behind a Show more disclosure instead of
+  // pushing every other field (or row) off screen.
+  const CLAMP_LINES=8, CLAMP_MIN_CHARS=600;
+  const isLong=value=>value.split('\\n').length>CLAMP_LINES||value.length>CLAMP_MIN_CHARS;
+  function disclosure(target) {
+    target.classList.add('clamped');
+    const toggle=node('button','show-more',t('showMore'));toggle.type='button';toggle.setAttribute('aria-expanded','false');
+    toggle.addEventListener('click',()=>{const expanded=target.classList.toggle('clamped')===false;toggle.setAttribute('aria-expanded',String(expanded));toggle.textContent=t(expanded?'showLess':'showMore');});
+    return toggle;
+  }
   function showDetails(title,item,trigger) {
     contextResult=null;el('detail-copy').hidden=true;
     detailFocus=trigger.id; text('detail-title',title);
@@ -61,7 +73,9 @@ export function dashboardScript() {
     const entries=Object.entries(object(item));
     for(const [key,value] of entries.length ? entries : [[t('details'),item]]) {
       const term=node('dt','',key),definition=node('dd','');
-      definition.textContent=typeof value==='string' ? value : JSON.stringify(value,null,2);
+      const content=node('div','',typeof value==='string' ? value : JSON.stringify(value,null,2));
+      definition.append(content);
+      if(isLong(content.textContent))definition.append(disclosure(content));
       fields.append(term,definition);
     }
     el('detail-dialog').showModal(); el('detail-close').focus();
@@ -101,6 +115,7 @@ export function dashboardScript() {
       const wrap=node('div','row'),body=node('div','row-body'),title=node('button','row-title row-open',row.title.slice(0,600));
       title.type='button';title.addEventListener('click',()=>showDetails(row.title,row.item,button));
       body.append(title);
+      if(row.title.length>200)title.classList.add('clamped');
       if(kind==='activity') {
         const item=object(row.item);body.append(node('div','row-meta',(item.ok===true?t('success'):t('failed'))+(typeof item.durationMs==='number'?' · '+Math.round(item.durationMs)+' ms':'')));
         wrap.append(node('span','row-marker'+(item.ok===true?'':' failed')));

package/dist/mcp-clients.js

@@ -3,6 +3,7 @@ import { homedir, platform } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { detectMcpClients, installMcpClient, MCP_CLIENTS, vaultDesktopDotMcpPath, vaultDesktopMcpPath, } from "./installer.js";
+import { hasYamlEntry } from "./yaml-entry.js";
 export const MCP_CLIENT_LABELS = {
     codex: "Codex",
     claude: "Claude Code",
@@ -16,6 +17,9 @@ export const MCP_CLIENT_LABELS = {
     grok: "Grok",
     agy: "Antigravity",
     gemini: "Gemini CLI",
+    warp: "Warp",
+    goose: "Goose",
+    hermes: "Hermes",
     "vault-desktop": "Vault Desktop",
 };
 function vscodeMcpPaths(home) {
@@ -65,6 +69,12 @@ function configLocations(client, home, cwd) {
             ];
         case "gemini":
             return [[join(home, ".gemini", "settings.json"), "mcpServers"]];
+        case "warp":
+            return [[join(home, ".warp", ".mcp.json"), "mcpServers"]];
+        case "goose":
+            return [[join(home, ".config", "goose", "config.yaml"), "yaml:extensions"]];
+        case "hermes":
+            return [[join(home, ".hermes", "config.yaml"), "yaml:mcp_servers"]];
         case "vault-desktop":
             return [
                 [vaultDesktopMcpPath(home), "mcpServers"],
@@ -76,7 +86,7 @@ function serverConfiguredInJson(path, rootKey) {
     if (!existsSync(path))
         return false;
     try {
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        const parsed = JSON.parse(readFileSync(path, "utf8").replace(/^\uFEFF/, ""));
         const servers = parsed && typeof parsed === "object" ? parsed[rootKey] : undefined;
         return Boolean(servers && typeof servers === "object" && "vault-go" in servers);
     }
@@ -84,6 +94,16 @@ function serverConfiguredInJson(path, rootKey) {
         return false;
     }
 }
+function serverConfiguredInYaml(path, topKey) {
+    if (!existsSync(path))
+        return false;
+    try {
+        return hasYamlEntry(readFileSync(path, "utf8"), topKey, "vault-go");
+    }
+    catch {
+        return false;
+    }
+}
 function serverConfiguredInToml(path) {
     if (!existsSync(path))
         return false;
@@ -122,7 +142,12 @@ export function mcpClientConnected(client, home = homedir(), cwd = process.cwd()
     if (client === "codex" || client === "claude")
         return clientCliInstalled(client, home);
     for (const [path, rootKey] of configLocations(client, home, cwd)) {
-        if (rootKey === "toml" ? serverConfiguredInToml(path) : serverConfiguredInJson(path, rootKey)) {
+        const configured = rootKey === "toml"
+            ? serverConfiguredInToml(path)
+            : rootKey.startsWith("yaml:")
+                ? serverConfiguredInYaml(path, rootKey.slice(5))
+                : serverConfiguredInJson(path, rootKey);
+        if (configured) {
             return true;
         }
     }

package/dist/mcp-result.d.ts

@@ -5,6 +5,7 @@ export declare function jsonResult(value: unknown): {
     }[];
     structuredContent: Record<string, unknown>;
 };
+export declare function errorMessage(error: unknown): string;
 export declare function run(operation: () => Promise<unknown>): Promise<{
     content: {
         type: "text";

package/dist/mcp-result.js

@@ -3,13 +3,30 @@ export function jsonResult(value) {
         ? value
         : { value };
     return {
-        content: [{ type: 'text', text: JSON.stringify(value, null, 2) }],
+        // Compact: indentation only spends the client's context window; structuredContent carries the same value.
+        content: [{ type: 'text', text: JSON.stringify(value) ?? 'null' }],
         structuredContent,
     };
 }
-function errorResult(error) {
+// What the agent can do next for each cloud status, so a failure is actionable instead of a bare code.
+const STATUS_HINTS = {
+    401: 'A sessão do Vault expirou ou não existe. Peça ao usuário para rodar: bunx --bun vault-go@latest login',
+    403: 'Esta conta não tem acesso a esse recurso.',
+    404: 'Não encontrado nesta conta. Confira o ID ou use scope "account".',
+    409: 'O recurso mudou ou ainda não está pronto; leia o estado atual e tente de novo.',
+    413: 'Entrada grande demais; reduza o texto, a lista ou o limite.',
+    429: 'Limite de uso atingido; tente novamente em instantes.',
+};
+export function errorMessage(error) {
     const message = error instanceof Error ? error.message : 'Erro inesperado.';
-    return { content: [{ type: 'text', text: message }], isError: true };
+    const status = error && typeof error === 'object' ? error.status : undefined;
+    if (typeof status !== 'number')
+        return message;
+    const hint = STATUS_HINTS[status] ?? (status >= 500 ? 'O Vault está temporariamente indisponível; tente novamente em instantes.' : '');
+    return hint && !message.includes(hint) ? `${message} — ${hint}` : message;
+}
+function errorResult(error) {
+    return { content: [{ type: 'text', text: errorMessage(error) }], isError: true };
 }
 export async function run(operation) {
     try {

package/dist/project-scope.js

@@ -1,5 +1,7 @@
 import { findWorkspaceProject } from './hooks.js';
 const CACHE_MS = 60_000;
+const FILTER_KEYS = new Set(['kind', 'memoryType', 'platformSource', 'type']);
+const ALL = /^\s*(all|any|\*|todos?|todas?)\s*$/i;
 /**
  * Why: MCP reads used to span every project of the account, so an agent in one
  * repository received memories from unrelated clients. Reads now default to the
@@ -8,7 +10,9 @@ const CACHE_MS = 60_000;
 export function createProjectScope(cloud, cwd = () => process.cwd()) {
     let cached;
     return async (input) => {
-        const { scope = 'project', ...rest } = input;
+        const { scope = 'project', ...given } = input;
+        // Agents often send "all" to mean "no filter"; as a literal value it matches no memory.
+        const rest = Object.fromEntries(Object.entries(given).filter(([key, value]) => !(FILTER_KEYS.has(key) && typeof value === 'string' && ALL.test(value))));
         if (rest.projectId || scope === 'account')
             return rest;
         const workspace = cwd();

package/dist/read-gate.d.ts

@@ -0,0 +1,25 @@
+export declare const FILE_READ_GATE_MIN_BYTES: number;
+export interface ReadGateRequest {
+    adapter: string;
+    toolName: string;
+    toolInput: Record<string, unknown>;
+    agentId: string;
+    workspace: string;
+    enabled: boolean;
+}
+/** Whether the file has more lines than `count`, reading one chunk at a time. Null when unreadable. */
+export declare function fileHasMoreLinesThan(path: string, count: number): boolean | null;
+/**
+ * The file a Read would gate, or undefined when any cheap condition fails:
+ * Claude Code main session (never subagents or other clients), gate enabled, a
+ * single file_path Read starting at line 1, a code file inside the workspace
+ * between 32 KB and the smart-tool limit, and a Read that returns the whole file.
+ */
+export declare function readGateCandidate(request: ReadGateRequest): {
+    path: string;
+    mtimeMs: number;
+} | undefined;
+/** Newest update time among the memories, in epoch milliseconds; 0 when none is known. */
+export declare function newestMemoryEpoch(value: unknown): number;
+/** The deny reason shown to Claude. Memory titles are history, never the file's current contents. */
+export declare function readGateReason(requestedPath: string, memoryIds: readonly string[], context: string): string;

package/dist/read-gate.js

@@ -0,0 +1,121 @@
+import { closeSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { extname, isAbsolute, relative, resolve, sep } from "node:path";
+// File Read Gate: a whole-file Read of a large code file that already has
+// memory history is denied with that history, and Claude is routed to the
+// structural tools or a targeted Read. Below this size reading the file costs
+// about what the detour would, so small files are always read normally.
+export const FILE_READ_GATE_MIN_BYTES = 32 * 1024;
+// The smart tools refuse files above this, so the gate never routes Claude to them.
+const SMART_TOOL_MAX_BYTES = 1_048_576;
+const LINE_COUNT_CHUNK_BYTES = 64 * 1024;
+// Code the smart tools outline by symbol. Markup, data and prose stay readable.
+const GATED_EXTENSIONS = new Set([
+    ".js", ".jsx", ".mjs", ".cjs", ".ts", ".mts", ".cts", ".tsx",
+    ".py", ".pyw", ".go", ".rs", ".rb", ".java", ".c", ".h", ".cpp", ".cc", ".cxx", ".hpp", ".hh",
+    ".kt", ".kts", ".swift", ".php", ".lua", ".scala", ".sc", ".hs", ".zig",
+]);
+function windowValue(value) {
+    const numeric = typeof value === "string" && value.trim() !== "" ? Number(value) : value;
+    return typeof numeric === "number" && Number.isFinite(numeric) && numeric >= 0 ? numeric : undefined;
+}
+/** Whether the file has more lines than `count`, reading one chunk at a time. Null when unreadable. */
+export function fileHasMoreLinesThan(path, count) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, "r");
+        const chunk = Buffer.allocUnsafe(LINE_COUNT_CHUNK_BYTES);
+        let newlines = 0, endsWithNewline = false;
+        for (;;) {
+            const read = readSync(descriptor, chunk, 0, chunk.length, null);
+            if (read === 0)
+                break;
+            const bytes = chunk.subarray(0, read);
+            for (let index = bytes.indexOf(0x0a); index !== -1; index = bytes.indexOf(0x0a, index + 1)) {
+                if (++newlines > count)
+                    return true;
+            }
+            endsWithNewline = bytes[read - 1] === 0x0a;
+        }
+        return (endsWithNewline ? newlines : newlines + 1) > count;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+/**
+ * The file a Read would gate, or undefined when any cheap condition fails:
+ * Claude Code main session (never subagents or other clients), gate enabled, a
+ * single file_path Read starting at line 1, a code file inside the workspace
+ * between 32 KB and the smart-tool limit, and a Read that returns the whole file.
+ */
+export function readGateCandidate(request) {
+    if (!request.enabled || request.adapter !== "claude" || request.agentId || request.toolName !== "Read")
+        return undefined;
+    const filePath = request.toolInput.file_path;
+    if (typeof filePath !== "string" || !filePath.trim())
+        return undefined;
+    if ((windowValue(request.toolInput.offset) ?? 0) > 1)
+        return undefined;
+    if (!GATED_EXTENSIONS.has(extname(filePath).toLowerCase()))
+        return undefined;
+    let path, root, size, mtimeMs;
+    try {
+        root = realpathSync(request.workspace);
+        path = realpathSync(isAbsolute(filePath) ? filePath : resolve(request.workspace, filePath));
+        const stats = statSync(path);
+        if (!stats.isFile())
+            return undefined;
+        size = stats.size;
+        mtimeMs = stats.mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+    // Same containment the smart tools apply: a symlink leading outside the workspace is outside.
+    const inside = relative(root, path);
+    if (!inside || inside.startsWith(".." + sep) || inside === ".." || isAbsolute(inside))
+        return undefined;
+    if (size < FILE_READ_GATE_MIN_BYTES || size > SMART_TOOL_MAX_BYTES)
+        return undefined;
+    const limit = windowValue(request.toolInput.limit);
+    if (limit !== undefined && fileHasMoreLinesThan(path, limit) !== false)
+        return undefined;
+    return { path, mtimeMs };
+}
+/** Newest update time among the memories, in epoch milliseconds; 0 when none is known. */
+export function newestMemoryEpoch(value) {
+    const record = value && typeof value === "object" ? value : {};
+    const rows = Array.isArray(value) ? value : Array.isArray(record.memories) ? record.memories : Array.isArray(record.value) ? record.value : [];
+    let newest = 0;
+    for (const row of rows) {
+        const item = row && typeof row === "object" ? row : {};
+        for (const key of ["updatedAtEpoch", "createdAtEpoch"]) {
+            if (typeof item[key] === "number" && Number.isFinite(item[key]))
+                newest = Math.max(newest, item[key]);
+        }
+        for (const key of ["updatedAt", "updated_at", "createdAt", "created_at"]) {
+            const parsed = typeof item[key] === "string" ? Date.parse(item[key]) : NaN;
+            if (Number.isFinite(parsed))
+                newest = Math.max(newest, parsed);
+        }
+    }
+    return newest;
+}
+/** The deny reason shown to Claude. Memory titles are history, never the file's current contents. */
+export function readGateReason(requestedPath, memoryIds, context) {
+    const shown = requestedPath;
+    const safe = JSON.stringify(requestedPath);
+    return [
+        `Full-file Read blocked by Vault Memory: ${shown} is a large file with prior memories (listed below). Get what you need without reading the whole file:`,
+        `- Current code: call vault_go_smart_outline(filePath=${safe}) for its symbols and line numbers, then vault_go_smart_unfold(filePath=${safe}, symbolName="<name>") for the ones you need (MCP tools mcp__vault-go__vault_go_smart_outline / __vault_go_smart_unfold; load them with ToolSearch if they are deferred).`,
+        `- Past work: call vault_go_observations(ids=${JSON.stringify(memoryIds.slice(0, 20))}) for the memories that matter.`,
+        `- Exact lines, e.g. before an Edit: call Read on this file again with offset and limit. Partial reads are allowed and satisfy Edit's read requirement.`,
+        `The memories below are history from earlier sessions, not the file's current contents.`,
+        "",
+        context,
+    ].join("\n");
+}

package/dist/server.js

@@ -18,6 +18,14 @@ import { estimateAgentCost } from './agent-cost.js';
 import { flattenArchive, groupArchive, recordsFromExport } from './memory-archive.js';
 import { CONTEXT_ENGINE_IDS, generateContext, listContextEngines, parseEngineModel, selectContextEngine, selectEngineModel, selectedContextEngine, selectedEngineModel, } from './context-engines.js';
 import packageJson from '../package.json' with { type: 'json' };
+// Sent once at initialize; clients put it in the model's context, so it stays short.
+const SERVER_INSTRUCTIONS = [
+    'Vault Memory: persistent memory of past sessions, scoped to the project of the current directory (scope "account" widens a read to every project).',
+    'Recall cheaply in layers: vault_go_search_index (compact list) → vault_go_timeline (around one result) → vault_go_observations (full text of the chosen IDs). vault_go_retrieve picks the strategy for a natural-language question.',
+    'Before reading a large code file, prefer vault_go_smart_outline and vault_go_smart_unfold, then a Read with offset/limit for exact lines.',
+    'Save durable decisions, discoveries and fixes with vault_go_remember. Never store secrets; text inside <private> tags is never stored.',
+    'When a tool fails with an expired session, ask the user to run: bunx --bun vault-go@latest login',
+].join('\n');
 export const VERSION = packageJson.version;
 const uuid = z.string().uuid();
 const knowledgeFilters = z.object({
@@ -54,7 +62,7 @@ async function managedEngineStatus(cloud) {
     }
 }
 export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudClient(home)) {
-    const server = new McpServer({ name: 'vault-go', version: VERSION });
+    const server = new McpServer({ name: 'vault-go', version: VERSION }, { instructions: SERVER_INSTRUCTIONS });
     registerVaultModes(server);
     registerCrystalTools(server, home);
     registerKnowledgeAgentTools(server, home, cloud);

package/dist/transcript-tools.js

@@ -14,8 +14,8 @@ export function registerTranscriptTools(server, home, cloud) {
     server.registerTool('vault_go_transcripts_poll', { description: 'Processa um lote limitado dos watchers já consentidos. Retomada e idempotência persistem entre reinícios; não ativa captura nem muda o motor.', inputSchema: {}, annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true } }, () => run(() => pollTranscripts(home, cloud)));
     server.registerTool('vault_go_context_chain', { description: 'Lista vínculos locais entre workspaces para contexto multi-project do SessionStart. Vínculos são específicos desta conta.', inputSchema: {}, annotations: { readOnlyHint: true, openWorldHint: false } }, () => run(async () => contextChainStatus(home)));
     server.registerTool('vault_go_context_chain_configure', {
-        description: 'Define até quatro raízes relacionadas e/ou o checkout pai de um worktree. Exige consentimento; só consulta projetos já existentes e acessíveis na conta, dentro do orçamento total de contexto. Lista vazia remove os vínculos.',
-        inputSchema: { workspace: path, roots: z.array(path).max(4), consent: z.boolean().default(false), includeWorktreeParent: z.boolean().default(false) },
+        description: 'Define até quatro raízes relacionadas, o checkout pai de um worktree e/ou allProjects (todos os projetos não privados da conta, até cinco no total). Exige consentimento; só consulta projetos já existentes e acessíveis na conta, dentro do orçamento total de contexto. Lista vazia remove os vínculos.',
+        inputSchema: { workspace: path, roots: z.array(path).max(4), consent: z.boolean().default(false), includeWorktreeParent: z.boolean().default(false), allProjects: z.boolean().default(false) },
         annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },
     }, input => run(async () => configureContextChain(home, input)));
 }

package/dist/yaml-entry.d.ts

@@ -0,0 +1,6 @@
+/** Scalars and string lists rendered as JSON, which YAML reads as the same values. */
+export type YamlEntryValue = string | number | boolean | readonly string[] | Readonly<Record<string, string>>;
+/** `text` with `<topKey>.<name>` set to `fields`, replacing an entry of that name. */
+export declare function upsertYamlEntry(text: string, topKey: string, name: string, fields: Record<string, YamlEntryValue>): string;
+/** Whether `<topKey>.<name>` exists as a block entry. */
+export declare function hasYamlEntry(text: string, topKey: string, name: string): boolean;

package/dist/yaml-entry.js

@@ -0,0 +1,113 @@
+// Line edits for one named entry inside a top-level YAML mapping, such as
+// Goose's `extensions.vault-go` or Hermes's `mcp_servers.vault-go`. Users keep
+// comments in these files, so they are edited line by line instead of parsed
+// and re-dumped: every line vault-go does not own stays byte for byte. A shape
+// these edits cannot follow throws and the file is left untouched.
+const TOP_LEVEL_KEY = /^(["']?)([A-Za-z_][\w-]*)\1(\s*):(.*)$/;
+function isContent(line) {
+    const trimmed = line.trim();
+    return trimmed !== "" && !trimmed.startsWith("#");
+}
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+function stripComment(value) {
+    const match = /(^|\s)#/.exec(value);
+    return (match ? value.slice(0, match.index) : value).trim();
+}
+function render(fields, indent) {
+    const lines = [];
+    for (const [key, value] of Object.entries(fields)) {
+        if (Array.isArray(value)) {
+            lines.push(`${indent}${key}:`, ...value.map(item => `${indent}  - ${JSON.stringify(item)}`));
+        }
+        else if (value && typeof value === "object") {
+            const entries = Object.entries(value);
+            if (!entries.length)
+                lines.push(`${indent}${key}: {}`);
+            else
+                lines.push(`${indent}${key}:`, ...entries.map(([name, item]) => `${indent}  ${name}: ${JSON.stringify(item)}`));
+        }
+        else {
+            lines.push(`${indent}${key}: ${typeof value === "string" ? JSON.stringify(value) : String(value)}`);
+        }
+    }
+    return lines;
+}
+/** `text` with `<topKey>.<name>` set to `fields`, replacing an entry of that name. */
+export function upsertYamlEntry(text, topKey, name, fields) {
+    // Windows editors save a byte order mark; it is not part of the first key and is kept.
+    const bom = text.startsWith("") ? "" : "";
+    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+    const lines = text.slice(bom.length).split(/\r?\n/);
+    if (lines.length && lines[lines.length - 1] === "")
+        lines.pop();
+    const firstContent = lines.find(line => isContent(line) && !/^(---(\s|$)|%)/.test(line));
+    if (firstContent !== undefined && indentOf(firstContent) > 0)
+        throw new Error("O nível superior do YAML está indentado; o arquivo não foi alterado.");
+    const headers = lines.flatMap((line, index) => TOP_LEVEL_KEY.exec(line)?.[2] === topKey ? [index] : []);
+    if (headers.length > 1)
+        throw new Error(`Chave ${topKey} duplicada no YAML; o arquivo não foi alterado.`);
+    if (!headers.length) {
+        while (lines.length && !lines[lines.length - 1].trim())
+            lines.pop();
+        const documentEnd = lines.findIndex(line => /^\.\.\.(\s|$)/.test(line));
+        const block = [`${topKey}:`, `  ${name}:`, ...render(fields, "    ")];
+        if (documentEnd === -1)
+            lines.push(...block);
+        else
+            lines.splice(documentEnd, 0, ...block);
+        return bom + lines.join(eol) + eol;
+    }
+    const header = headers[0];
+    const match = TOP_LEVEL_KEY.exec(lines[header]);
+    const inline = stripComment(match[4]);
+    if (inline !== "" && inline !== "{}" && inline !== "null" && inline !== "~") {
+        throw new Error(`${topKey} usa valor inline no YAML; escreva como mapeamento em bloco. O arquivo não foi alterado.`);
+    }
+    if (inline)
+        lines[header] = lines[header].replace(/:[ \t]*(?:\{\}|null|~)/, ":");
+    let end = header + 1;
+    while (end < lines.length && !(isContent(lines[end]) && indentOf(lines[end]) === 0))
+        end++;
+    while (end > header + 1 && !isContent(lines[end - 1]))
+        end--;
+    const firstChild = lines.slice(header + 1, end).find(isContent);
+    if (firstChild?.startsWith("\t"))
+        throw new Error(`${topKey} está indentado com tabs; o arquivo não foi alterado.`);
+    const indent = " ".repeat(firstChild ? indentOf(firstChild) : 2);
+    const entry = [`${indent}${name}:`, ...render(fields, indent + "  ")];
+    const existing = lines.findIndex((line, index) => index > header && index < end && indentOf(line) === indent.length && new RegExp(`^(["']?)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\1\\s*:`).test(line.trimStart()));
+    if (existing === -1) {
+        lines.splice(header + 1, 0, ...entry);
+    }
+    else {
+        let entryEnd = existing + 1;
+        while (entryEnd < end && !(isContent(lines[entryEnd]) && indentOf(lines[entryEnd]) <= indent.length))
+            entryEnd++;
+        while (entryEnd > existing + 1 && !isContent(lines[entryEnd - 1]))
+            entryEnd--;
+        lines.splice(existing, entryEnd - existing, ...entry);
+    }
+    return bom + lines.join(eol) + eol;
+}
+/** Whether `<topKey>.<name>` exists as a block entry. */
+export function hasYamlEntry(text, topKey, name) {
+    const lines = text.replace(/^/, "").split(/\r?\n/);
+    const header = lines.findIndex(line => TOP_LEVEL_KEY.exec(line)?.[2] === topKey);
+    if (header === -1)
+        return false;
+    let childIndent = -1;
+    for (let index = header + 1; index < lines.length; index++) {
+        const line = lines[index];
+        if (!isContent(line))
+            continue;
+        if (indentOf(line) === 0)
+            break;
+        if (childIndent === -1)
+            childIndent = indentOf(line);
+        if (indentOf(line) === childIndent && new RegExp(`^(["']?)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\1\\s*:`).test(line.trimStart()))
+            return true;
+    }
+    return false;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "MCP server and installer for Vault Memory: search, capture, and use account memory across AI clients.",
   "type": "module",
   "bin": {
@@ -139,6 +139,12 @@
     "dist/context-chain.d.ts",
     "dist/capture-privacy.js",
     "dist/capture-privacy.d.ts",
+    "dist/client-prompts.js",
+    "dist/read-gate.js",
+    "dist/yaml-entry.js",
+    "dist/yaml-entry.d.ts",
+    "dist/read-gate.d.ts",
+    "dist/client-prompts.d.ts",
     "dist/deployment-verification.js",
     "dist/deployment-verification.d.ts",
     "dist/grok-awareness.js",
@@ -217,7 +223,7 @@
     "@ast-grep/lang-toml": "0.0.9",
     "@ast-grep/lang-yaml": "0.0.6",
     "@ast-grep/napi": "0.45.3",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "@tree-sitter-grammars/tree-sitter-zig": "1.1.2",
     "zod": "3.25.76"
   },