vault-go 0.31.2 → 0.33.0

package/README.md

@@ -53,7 +53,9 @@ The setup wizard:
 3. Leaves other client config in place.
 4. Installs the local dashboard on port `38850` (starts at login on macOS).
 
-Supported clients: Codex, ChatGPT Desktop, Claude Code, Claude Desktop, Grok, Agy / Antigravity, Gemini CLI, Cursor, Windsurf, VS Code + GitHub Copilot, Copilot CLI, Roo Code, OpenCode, and Vault Desktop (Crystal).
+Supported clients: Codex, ChatGPT Desktop, Claude Code, Claude Desktop, Grok, Agy / Antigravity, Gemini CLI, Cursor, Windsurf, VS Code + GitHub Copilot, Copilot CLI, Roo Code, OpenCode, Warp, Goose, Hermes, and Vault Desktop (Crystal).
+
+Goose and Hermes are configured by editing a single entry in their `config.yaml` (`extensions.vault-go` and `mcp_servers.vault-go`). Comments and other lines are left as they are. A file with a shape that cannot be edited safely, such as an inline mapping, is left unchanged and reported.
 
 ```sh
 vault-go setup
@@ -152,6 +154,8 @@ vault-go engine key openrouter
 
 MCP tools never accept secrets. Store keys with the CLI or the local dashboard. Provider usage limits apply. Managed Vault AI generation still depends on server configuration and quota.
 
+When the background queue hits an exhausted quota, Vault AI Resume and the Claude subscription stand in for each other. Other failures never switch engines. Set `VAULT_GO_ENGINE_FALLBACK=off` to disable this.
+
 ## MCP tools
 
 Account and health: `vault_go_status`, `vault_go_cloud_health`, `vault_go_preferences`, `vault_go_preferences_update`.
@@ -212,6 +216,10 @@ The worker drains a private queue with the selected engine. Successful generatio
 
 Opt-in Claude/Codex transcript watchers and project context chains are configured with MCP/CLI and stay bound to the current account.
 
+Helper threads that clients generate themselves are never captured: Codex titles, suggestions and memory consolidation, Grok research briefings, and turns that are only a `<task-notification>`.
+
+**File Read Gate (Claude Code).** In some cases a whole-file `Read` is denied, and the denial lists the file's memories. This happens only when the file is a code file of 32 KB or more, inside the workspace, and Vault memories about it are newer than its last change. Claude is pointed to `vault_go_smart_outline` / `vault_go_smart_unfold` or to a `Read` with `offset`/`limit` instead; partial reads always pass. Subagents and other clients are never gated, and any lookup failure lets the read through. Turn it off with `VAULT_GO_FILE_READ_GATE=off` or the `fileReadGate: false` preference.
+
 ## Automatic updates
 
 The worker checks the official npm registry daily for a stable `vault-go` release, stages an exact version under `~/.memvault/releases` without running package install scripts, validates it, and activates when idle. A failed start rolls back. Auth, preferences, and the queue are kept. Open MCP clients must reconnect to load new tools.

package/dist/capture-privacy.d.ts

@@ -1 +1,3 @@
+/** True when nothing remains once memory tags are removed: such text must not be stored at all. */
+export declare function isFullyPrivate(value: string): boolean;
 export declare function redact(value: unknown): unknown;

package/dist/capture-privacy.js

@@ -1,4 +1,24 @@
 const SENSITIVE_KEY = /api[_-]?key|secret|token|password|authorization|cookie|credential|private[_-]?key/i;
+const MEMORY_TAGS = `(private|vault-private|${["claude", "mem", "context"].join("-")}|system_instruction|system-instruction|persisted-output|system-reminder)`;
+// Credentials pasted in free text have no key to match. `(?!\w)` instead of a
+// closing `\b`: these classes include `-`, and `\b` after a final `-` needs a
+// following word character, so such a key was left (or kept its last `-`).
+const TOKEN_PATTERNS = [
+    /AKIA[0-9A-Z]{16}/g,
+    /\bgh[oprsu]_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{82}\b/g,
+    /\bsk-(?!ant-)[A-Za-z0-9_-]{20,}(?!\w)/g,
+    /\bsk-ant-[A-Za-z0-9_-]{20,}(?!\w)/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}(?!\w)/g,
+    /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?!\w)/g,
+    /-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g,
+    /\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{24,}\b/g,
+    /\bAIza[0-9A-Za-z_-]{35}(?!\w)/g,
+    /\bvg_device_[a-f0-9]{64}\b/g,
+];
+/** True when nothing remains once memory tags are removed: such text must not be stored at all. */
+export function isFullyPrivate(value) {
+    return value.trim() !== '' && !value.replace(new RegExp(`<${MEMORY_TAGS}\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "").trim();
+}
 /** Keep quoted values together: whitespace/escaped quotes must not leave a secret tail. */
 function redactText(value, depth = 0) {
     // Nested stringified payloads are untrusted. Do not recurse indefinitely.
@@ -13,8 +33,8 @@ function redactText(value, depth = 0) {
         }
         catch { /* Partial JSON and pasted logs still use the text filter below. */ }
     }
-    return value
-        .replace(new RegExp(`<(private|vault-private|${["claude", "mem", "context"].join("-")}|system_instruction|system-instruction|persisted-output|system-reminder)\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "[redacted]")
+    return TOKEN_PATTERNS.reduce((text, pattern) => text.replace(pattern, '[redacted]'), value)
+        .replace(new RegExp(`<${MEMORY_TAGS}\\b[^>]*>[\\s\\S]*?(?:<\\/\\1\\s*>|$)`, "gi"), "[redacted]")
         // Raw HTTP headers can contain spaces, auth schemes and several cookies.
         // Stop at a shell argument's quote or a new line, preserving adjacent diagnostics.
         .replace(/(\b(?:authorization|proxy-authorization|cookie|set-cookie)[ \t]*:[ \t]*)[^\r\n'\"]+/gi, '$1[redacted]')

package/dist/cli.js

@@ -358,7 +358,7 @@ Uso:
       Captura opt-in de transcripts pelo worker local, com checkpoints e privacidade.
       Setup aceita --watch-transcripts claude|codex --workspace /projeto --consent.
 
-  vault-go context-chain status|set|clear --workspace /projeto [--roots /a,/b] [--worktree-parent] [--consent]
+  vault-go context-chain status|set|clear --workspace /projeto [--roots /a,/b] [--worktree-parent] [--all-projects] [--consent]
       Contexto do SessionStart em projetos relacionados; orçamento total e conta preservados.
 
   vault-go hook <adaptador> <evento>
@@ -493,7 +493,7 @@ export async function runContextChain(args, home = vaultHome()) {
         const workspace = optionValue(args, '--workspace');
         if (!workspace)
             throw new Error('Informe --workspace /projeto.');
-        result = configureContextChain(home, { workspace, roots: command === 'clear' ? [] : (optionValue(args, '--roots') ?? '').split(',').filter(Boolean), consent: args.includes('--consent'), includeWorktreeParent: command === 'set' && args.includes('--worktree-parent') });
+        result = configureContextChain(home, { workspace, roots: command === 'clear' ? [] : (optionValue(args, '--roots') ?? '').split(',').filter(Boolean), consent: args.includes('--consent'), includeWorktreeParent: command === 'set' && args.includes('--worktree-parent'), allProjects: command === 'set' && args.includes('--all-projects') });
     }
     else
         throw new Error('vault-go context-chain status|set|clear');

package/dist/client-prompts.d.ts

@@ -0,0 +1,2 @@
+/** Whether a prompt was generated by the client itself; the same text from another client is a person's prompt. */
+export declare function isClientInternalPrompt(adapter: string, text: string): boolean;

package/dist/client-prompts.js

@@ -0,0 +1,34 @@
+// Clients send their own helper threads through the same prompt hook as a
+// person's turn. Storing them creates sessions and spends generation on the
+// client's internals, so they are recognised by their fixed opening lines,
+// never by phrases a person would type.
+const CODEX_INTERNAL_PROMPT_OPENINGS = [
+    // Codex app: names a task.
+    /^You are a helpful assistant\. You will be presented with a user prompt, and your job is to provide a short title/,
+    // Codex memories: the consolidation pass.
+    /^## Memory Writing Agent: Phase 2 \(Consolidation\)/,
+    // Codex app: onboarding suggestions.
+    /^# Overview\r?\n(?:\r?\n)?Generate 0 to 3 hyperpersonalized suggestions/,
+    // Codex app: suggests the next message for the empty composer.
+    /^This is an app-generated request for a suggested next user message\. The user did not write this message\./,
+    // Codex memories: folds rollout summaries into memory_summary.md.
+    /^Consolidate the supplied rollout summaries into `memory_summary\.md`/,
+];
+const GROK_INTERNAL_PROMPT_OPENINGS = [
+    // Research sub-agent briefings.
+    /^Independently verify every candidate claim in the JSON packet below/,
+    /^Rewrite the verified research findings/,
+    /^Investigate the JSON-encoded question/,
+    /^Break the JSON-encoded research query/,
+];
+// A turn made only of a protocol envelope (e.g. a background task notice) carries no request from a person.
+const PROTOCOL_ONLY = /^\s*<(task-notification)\b[^>]*>(?:(?!<\1\b|<\/\1\b)[\s\S])*<\/\1\s*>\s*$/;
+const MAX_PROTOCOL_PAYLOAD_CHARS = 256 * 1024;
+/** Whether a prompt was generated by the client itself; the same text from another client is a person's prompt. */
+export function isClientInternalPrompt(adapter, text) {
+    if (text.length <= MAX_PROTOCOL_PAYLOAD_CHARS && PROTOCOL_ONLY.test(text))
+        return true;
+    const opening = text.trimStart();
+    const openings = adapter === 'codex' ? CODEX_INTERNAL_PROMPT_OPENINGS : adapter === 'grok' ? GROK_INTERNAL_PROMPT_OPENINGS : [];
+    return openings.some(pattern => pattern.test(opening));
+}

package/dist/context-chain.d.ts

@@ -11,6 +11,7 @@ interface Link {
     workspace: string;
     roots: string[];
     includeWorktreeParent: boolean;
+    allProjects?: boolean;
 }
 export declare function contextChainStatus(home: string): {
     chains: Link[];
@@ -22,6 +23,7 @@ export declare function configureContextChain(home: string, input: {
     roots: string[];
     consent?: boolean;
     includeWorktreeParent?: boolean;
+    allProjects?: boolean;
 }): {
     chains: Link[];
     maxProjects: number;

package/dist/context-chain.js

@@ -16,7 +16,7 @@ function configuration(home) {
 }
 export function contextChainStatus(home) { return { chains: configuration(home).chains, maxProjects: 5, default: 'workspace-only' }; }
 export function configureContextChain(home, input) {
-    if ((input.roots.length || input.includeWorktreeParent) && input.consent !== true)
+    if ((input.roots.length || input.includeWorktreeParent || input.allProjects) && input.consent !== true)
         throw new Error('Relacionar projetos exige consent=true.');
     if (!captureOwner(home))
         throw new Error('Autentique a conta antes de relacionar projetos.');
@@ -27,8 +27,9 @@ export function configureContextChain(home, input) {
         throw new Error('Diretório de projeto inexistente.');
     const config = configuration(home);
     config.chains = config.chains.filter(c => c.workspace !== workspace);
-    if (roots.length || input.includeWorktreeParent)
-        config.chains.push({ workspace, roots, includeWorktreeParent: input.includeWorktreeParent === true });
+    // allProjects is the account-wide opt-in: every non-private project of this account joins the context budget.
+    if (roots.length || input.includeWorktreeParent || input.allProjects)
+        config.chains.push({ workspace, roots, includeWorktreeParent: input.includeWorktreeParent === true, ...(input.allProjects === true ? { allProjects: true } : {}) });
     if (config.chains.length > 50)
         throw new Error('Limite de 50 cadeias de contexto.');
     privateJson(home, 'context-chains.json', config);
@@ -74,7 +75,14 @@ export async function loadProjectContext(home, cloud, input) {
         if (project && project.private !== true && project.isPrivate !== true && project.is_private !== true && !selected.some(p => p.id === project.id))
             selected.push(project);
     }
-    // A worktree shares its canonical project; extra projects still require explicit links.
+    if (chain?.allProjects === true) {
+        for (const item of input.projects) {
+            const project = item && typeof item === 'object' ? item : undefined;
+            if (project && typeof project.id === 'string' && project.private !== true && project.isPrivate !== true && project.is_private !== true && !selected.some(p => p.id === project.id))
+                selected.push(project);
+        }
+    }
+    // A worktree shares its canonical project; extra projects still require explicit links or the allProjects opt-in.
     if (selected[0]?.id !== input.primary.id)
         return '';
     const projects = selected.slice(0, Math.min(5, input.limit)), parts = [];

package/dist/context-engines.d.ts

@@ -9,6 +9,11 @@ export interface EngineModelOption {
     aliases?: readonly string[];
 }
 export declare const ENGINE_MODELS: Record<ContextEngineId, readonly EngineModelOption[]>;
+export declare class ContextQuotaError extends Error {
+    readonly engine: ContextEngineId;
+    constructor(engine: ContextEngineId);
+}
+export declare function isQuotaFailure(error: unknown): boolean;
 export interface ContextResult {
     title: string;
     content: string;
@@ -78,3 +83,4 @@ export interface GenerateContextOptions {
     }) => Promise<unknown>;
 }
 export declare function generateContext(home: string, engine: unknown, text: unknown, options?: GenerateContextOptions): Promise<ContextResult>;
+export declare function generateContextWithFallback(home: string, engine: unknown, text: unknown, options?: GenerateContextOptions): Promise<ContextResult>;

package/dist/context-engines.js

@@ -54,6 +54,23 @@ const KEY_ENV = {
     openrouter: ["VAULT_GO_OPENROUTER_API_KEY", "OPENROUTER_API_KEY"],
     gemini: ["VAULT_GO_GEMINI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY"],
 };
+// Provider notices that mean the allowance ran out rather than a bad request.
+// A spent Anthropic API key is reported as a 400 "credit balance is too low".
+const QUOTA_NOTICE = /credit balance is too low|usage limit|rate[ _]limit|limit reached|quota|too many requests/i;
+export class ContextQuotaError extends Error {
+    engine;
+    constructor(engine) {
+        super("Context engine quota exhausted.");
+        this.engine = engine;
+        this.name = "ContextQuotaError";
+    }
+}
+export function isQuotaFailure(error) {
+    if (error instanceof ContextQuotaError)
+        return true;
+    const status = error && typeof error === "object" ? error.status : undefined;
+    return status === 429 || status === 402 || (error instanceof Error && QUOTA_NOTICE.test(error.message));
+}
 export function isContextEngine(value) {
     return (typeof value === "string" &&
         CONTEXT_ENGINE_IDS.includes(value));
@@ -267,7 +284,9 @@ export const runContextCommand = (request) => new Promise((resolve, reject) => {
     child.on("close", (code) => finish(failure ??
         (code === 0
             ? undefined
-            : new Error("Context CLI failed. Check its login and subscription limits."))));
+            : new Error(QUOTA_NOTICE.test(stdout + stderr)
+                ? "Context CLI reported an exhausted quota."
+                : "Context CLI failed. Check its login and subscription limits."))));
     child.stdin.end(request.input ?? "");
     if (request.signal?.aborted)
         abort();
@@ -539,6 +558,8 @@ async function generateApiContext(home, engine, text, options, signal) {
             ? error
             : new Error("Context engine request failed.");
     }
+    if (response.status === 429 || response.status === 402)
+        throw new ContextQuotaError(engine);
     if (!response.ok) {
         throw new Error(engine === "openrouter"
             ? "OpenRouter request failed. Check the API key and usage limits."
@@ -582,7 +603,7 @@ export async function generateContext(home, engine, text, options = {}) {
             signal.addEventListener("abort", abort, { once: true });
             void Promise.resolve()
                 .then(() => options.managedGenerate(text, { signal, ...(modeGuidance ? { modeGuidance } : {}) }))
-                .then(resolve, reject)
+                .then(resolve, (error) => reject(isQuotaFailure(error) ? new ContextQuotaError(engine) : error))
                 .finally(() => signal.removeEventListener("abort", abort));
         });
         return validateContextResult(value, engine);
@@ -658,10 +679,11 @@ export async function generateContext(home, engine, text, options = {}) {
             timeoutMs: 90000,
             signal,
         });
-        let parsed;
+        let parsed, quota = false;
         try {
             const output = JSON.parse(result.stdout);
             if (engine === "claude-subscription") {
+                quota = output["is_error"] === true && QUOTA_NOTICE.test(String(output["result"]));
                 if (output["is_error"] === true)
                     throw new Error();
                 parsed =
@@ -671,6 +693,8 @@ export async function generateContext(home, engine, text, options = {}) {
                 parsed = output;
         }
         catch {
+            if (quota)
+                throw new ContextQuotaError(engine);
             throw new Error("Context engine returned an invalid response.");
         }
         return validateContextResult(parsed, engine);
@@ -679,3 +703,31 @@ export async function generateContext(home, engine, text, options = {}) {
         rmSync(cwd, { recursive: true, force: true });
     }
 }
+// The two Anthropic allowances stand in for each other: the managed Vault AI
+// Resume (an API key held by the server) and this machine's Claude subscription
+// login. Only an exhausted quota hands over; any other failure surfaces as is.
+const QUOTA_FALLBACK = {
+    "vault-ai-resume": "claude-subscription",
+    "claude-subscription": "vault-ai-resume",
+};
+export async function generateContextWithFallback(home, engine, text, options = {}) {
+    try {
+        return await generateContext(home, engine, text, options);
+    }
+    catch (error) {
+        const fallback = isContextEngine(engine) ? QUOTA_FALLBACK[engine] : undefined;
+        if (!fallback ||
+            !isQuotaFailure(error) ||
+            options.signal?.aborted ||
+            (options.env ?? process.env).VAULT_GO_ENGINE_FALLBACK === "off" ||
+            (fallback === "vault-ai-resume" && !options.managedGenerate))
+            throw error;
+        try {
+            return await generateContext(home, fallback, text, options);
+        }
+        catch {
+            // The stand-in being unavailable must not hide why the selected engine stopped.
+            throw error;
+        }
+    }
+}

package/dist/hook-install.js

@@ -9,7 +9,8 @@ function readJsonObject(path) {
         return {};
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(path, "utf8"));
+        // Windows editors may save a UTF-8 byte order mark, which JSON.parse rejects.
+        parsed = JSON.parse(readFileSync(path, "utf8").replace(/^\uFEFF/, ""));
     }
     catch (error) {
         throw new Error(`JSON inválido em ${path}; o arquivo não foi alterado.`, {
@@ -98,7 +99,9 @@ function agyHandler(event, configHome = vaultHome()) {
 }
 function agyHookManifest(configHome = vaultHome()) {
     return {
-        PreInvocation: [agyHandler("context", configHome)],
+        // SessionStart injects memory once per session. On PreInvocation it was re-sent
+        // before every model call, invalidating the provider prompt cache each step.
+        SessionStart: [agyHandler("context", configHome)],
         PreToolUse: [{ matcher: "*", hooks: [agyHandler("file-context", configHome)] }],
         PostToolUse: [
             { matcher: "*", hooks: [agyHandler("observation", configHome)] },

package/dist/hook-queue.d.ts

@@ -1,5 +1,5 @@
 import { VaultCloudClient } from './cloud.js';
-import { generateContext, type ContextResult } from './context-engines.js';
+import { generateContextWithFallback, type ContextResult } from './context-engines.js';
 import { type TelegramObservation } from './telegram.js';
 import { privateStore } from './private-store.js';
 import { type CrystalMirrorRecord } from './crystal-memory-mirror.js';
@@ -43,7 +43,7 @@ export declare function generationQueueStatus(home?: string): {
     legacyAwaitingOwnership: number;
     heldForOtherAccount: number;
 };
-export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContext, options?: {
+export declare function processGenerationQueue(home?: string, cloud?: VaultCloudClient, generate?: typeof generateContextWithFallback, options?: {
     notifyObservation?: (observation: TelegramObservation) => Promise<unknown>;
     crystalMirrorStore?: CrystalMirrorStoreFactory;
 }): Promise<boolean>;

package/dist/hook-queue.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { VaultCloudClient } from './cloud.js';
 import { loadConfig, loadTokens, vaultHome } from './config.js';
-import { generateContext, selectedContextEngine } from './context-engines.js';
+import { generateContextWithFallback, isQuotaFailure, selectedContextEngine } from './context-engines.js';
 import { notifyTelegramObservation } from './telegram.js';
 import { pushAwareness } from './grok-awareness.js';
 import { privateStore } from './private-store.js';
@@ -88,6 +88,8 @@ function isUnusableGenerationText(text) {
 }
 function generationFailureCode(error) {
     const message = error instanceof Error ? error.message : '';
+    if (isQuotaFailure(error))
+        return 'engine_quota';
     if (message.includes('Official CLI or subscription login unavailable'))
         return 'engine_cli_unavailable';
     if (message.includes('Context engine timed out'))
@@ -238,7 +240,7 @@ export function generationQueueStatus(home = vaultHome()) {
     const jobs = readQueue(home), owner = ownerKey(home);
     return { pending: jobs.filter(j => j.owner === owner || !j.owner).length, failed: jobs.filter(j => j.owner === owner && j.lastError).length, legacyAwaitingOwnership: jobs.filter(j => !j.owner).length, heldForOtherAccount: jobs.filter(j => j.owner && j.owner !== owner).length };
 }
-export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContext, options = {}) {
+export async function processGenerationQueue(home = vaultHome(), cloud = new VaultCloudClient(home), generate = generateContextWithFallback, options = {}) {
     const release = await lock(home, 'generation-worker', false);
     if (!release)
         return false;

package/dist/hooks.js

@@ -1,4 +1,6 @@
-import { redact } from './capture-privacy.js';
+import { isFullyPrivate, redact } from './capture-privacy.js';
+import { isClientInternalPrompt } from './client-prompts.js';
+import { newestMemoryEpoch, readGateCandidate, readGateReason } from './read-gate.js';
 export { redact } from './capture-privacy.js';
 import { createHash, randomUUID } from "node:crypto";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
@@ -214,6 +216,9 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     const sessionId = string(input.session_id);
     if (!reading && !sessionId)
         return hookOutput(event, "", adapter);
+    // Client helper threads never become sessions, projects or memories.
+    if (event === "session-init" && isClientInternalPrompt(adapter, string(input.prompt)))
+        return hookOutput(event, "", adapter);
     const workspace = root(string(input.cwd, input.workspace) || process.cwd());
     const roots = projectRoots(workspace);
     const projects = await cloud.projects();
@@ -254,6 +259,11 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
             })
             : { context: await loadProjectContext(home, cloud, { workspace, primary: { id: project.id }, projects, ...limits }) });
         let context = string(result.context).slice(0, limits.maxChars);
+        if (event === "file-context" && context) {
+            const denial = await fullReadDenial(cloud, { adapter, toolName, tool, agentId: string(input.agent_id, input.agentId), workspace, prefs, memoryIds: result.memoryIds ?? result.memory_ids, context, file });
+            if (denial)
+                return denial;
+        }
         if (event === "context") {
             // Skills do projeto entram depois da memória e só no espaço que sobrar; falha aqui nunca derruba o contexto.
             try {
@@ -276,8 +286,10 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     }));
     if (typeof session.id !== "string")
         throw new Error("Sessão inválida");
-    const prompt = string(input.prompt);
-    const response = string(input.last_assistant_message);
+    // Text that is entirely <private> (or other memory tags) is dropped, never stored as a "[redacted]" placeholder.
+    const visible = (value) => isFullyPrivate(value) ? "" : value;
+    const prompt = visible(string(input.prompt));
+    const response = visible(string(input.last_assistant_message));
     const toolPayload = record(redact({
         toolName,
         toolInput: tool,
@@ -351,6 +363,31 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
         await cloud.endSession(session.id);
     return hookOutput(event, "", adapter);
 }
+// Fails open: any missing evidence or lookup error lets the Read through.
+async function fullReadDenial(cloud, request) {
+    const enabled = request.prefs.fileReadGate !== false && process.env.VAULT_GO_FILE_READ_GATE !== "off";
+    const candidate = readGateCandidate({ adapter: request.adapter, toolName: request.toolName, toolInput: request.tool, agentId: request.agentId, workspace: request.workspace, enabled });
+    const ids = Array.isArray(request.memoryIds) ? request.memoryIds.filter((id) => typeof id === "string").slice(0, 20) : [];
+    if (!candidate || !ids.length)
+        return undefined;
+    try {
+        // Memories older than the file's last change describe code that may be gone: read it.
+        if (newestMemoryEpoch(await cloud.observations(ids)) <= candidate.mtimeMs)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    return {
+        continue: true,
+        suppressOutput: true,
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: readGateReason(request.file, ids, request.context),
+        },
+    };
+}
 function boundedPreference(value, fallback, min, max) {
     return typeof value === 'number' && Number.isInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
 }

package/dist/installer.d.ts

@@ -1,6 +1,6 @@
 export declare const MCP_SERVER_NAME = "vault-go";
 export declare const MCP_SERVER_COMMAND: readonly ["bunx", "--bun", "vault-go@latest", "serve"];
-export declare const MCP_CLIENTS: readonly ["codex", "claude", "claude-desktop", "cursor", "vscode", "copilot", "windsurf", "roo", "opencode", "grok", "agy", "gemini", "vault-desktop"];
+export declare const MCP_CLIENTS: readonly ["codex", "claude", "claude-desktop", "cursor", "vscode", "copilot", "windsurf", "roo", "opencode", "grok", "agy", "gemini", "warp", "goose", "hermes", "vault-desktop"];
 export type McpClient = (typeof MCP_CLIENTS)[number];
 export interface DetectedClient {
     client: McpClient;

package/dist/installer.js

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { vaultHome } from './config.js';
 import { stageLocalRuntime } from './local-install.js';
 import { installCaptureHooks, installClientHooks, installOpenCodePlugin } from './hook-install.js';
+import { upsertYamlEntry } from './yaml-entry.js';
 import { installManagedSkills } from './skill-install.js';
 export const MCP_SERVER_NAME = 'vault-go';
 export const MCP_SERVER_COMMAND = ['bunx', '--bun', 'vault-go@latest', 'serve'];
@@ -21,6 +22,9 @@ export const MCP_CLIENTS = [
     'grok',
     'agy',
     'gemini',
+    'warp',
+    'goose',
+    'hermes',
     'vault-desktop',
 ];
 const CLIENT_ALIASES = {
@@ -34,7 +38,8 @@ function readJsonObject(path) {
         return {};
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(path, 'utf8'));
+        // Windows editors may save a UTF-8 byte order mark, which JSON.parse rejects.
+        parsed = JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
     }
     catch (error) {
         throw new Error(`JSON inválido em ${path}; o arquivo não foi alterado.`, { cause: error });
@@ -62,7 +67,8 @@ function formatTomlValue(value) {
     return `[${value.map((item) => JSON.stringify(item)).join(', ')}]`;
 }
 function upsertTomlTable(path, table, assignments) {
-    const previous = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    // A byte order mark would hide a table on the first line and duplicate it on append.
+    const previous = existsSync(path) ? readFileSync(path, 'utf8').replace(/^\uFEFF/, '') : '';
     const body = Object.entries(assignments)
         .map(([key, value]) => `${key} = ${formatTomlValue(value)}`)
         .join('\n');
@@ -76,6 +82,21 @@ function upsertTomlTable(path, table, assignments) {
             : block;
     atomicWriteText(path, next);
 }
+function upsertYamlFile(path, topKey, fields) {
+    const previous = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    let next;
+    try {
+        next = upsertYamlEntry(previous, topKey, MCP_SERVER_NAME, fields);
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : 'YAML inválido'} (${path})`, { cause: error });
+    }
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = join(dirname(path), `.${process.pid}.${Date.now()}.tmp`);
+    writeFileSync(temporary, next, { mode: 0o600 });
+    renameSync(temporary, path);
+    chmodSync(path, 0o600);
+}
 function standardServer() {
     return {
         command: MCP_SERVER_COMMAND[0],
@@ -219,6 +240,21 @@ export function installMcpClient(client, options = {}) {
         installClientHooks('gemini', home);
         return { client, status: 'installed', destination: path };
     }
+    if (client === 'goose') {
+        // Goose starts MCP servers only from the top-level `extensions` mapping, never `mcpServers`.
+        const destination = join(home, '.config', 'goose', 'config.yaml');
+        upsertYamlFile(destination, 'extensions', {
+            enabled: true, type: 'stdio', name: MCP_SERVER_NAME,
+            cmd: MCP_SERVER_COMMAND[0], args: MCP_SERVER_COMMAND.slice(1), envs: {}, timeout: 300,
+        });
+        return { client, status: 'installed', destination };
+    }
+    if (client === 'hermes') {
+        const destination = join(home, '.hermes', 'config.yaml');
+        // MCP only: Hermes loads tools from `mcp_servers`; its capture uses a provider plugin vault-go does not ship.
+        upsertYamlFile(destination, 'mcp_servers', { command: MCP_SERVER_COMMAND[0], args: MCP_SERVER_COMMAND.slice(1) });
+        return { client, status: 'installed', destination };
+    }
     if (client === 'vault-desktop') {
         const destination = vaultDesktopMcpPath(home);
         mergeServer(destination);
@@ -236,6 +272,9 @@ export function installMcpClient(client, options = {}) {
         path = join(home, '.codeium', 'windsurf', 'mcp_config.json');
     else if (client === 'roo')
         path = resolve(cwd, '.roo', 'mcp.json');
+    // Warp reads global MCP servers from the dotfile ~/.warp/.mcp.json, not ~/.warp/mcp.json.
+    else if (client === 'warp')
+        path = join(home, '.warp', '.mcp.json');
     else
         path = join(home, '.config', 'opencode', 'opencode.json');
     if (client === 'opencode') {
@@ -284,6 +323,9 @@ export function detectMcpClients(home = homedir()) {
         ['grok', ['grok'], [join(home, '.grok')]],
         ['agy', ['agy'], [join(home, '.gemini', 'antigravity-cli'), join(home, '.gemini', 'config'), join(home, '.gemini', 'antigravity')]],
         ['gemini', ['gemini'], [join(home, '.gemini', 'settings.json')]],
+        ['warp', [], [join(home, '.warp'), '/Applications/Warp.app']],
+        ['goose', ['goose'], [join(home, '.config', 'goose')]],
+        ['hermes', ['hermes'], [join(home, '.hermes')]],
         ['vault-desktop', [], [vaultDesktopMcpPath(home), vaultDesktopDotMcpPath(home), '/Applications/Vault Desktop.app']],
     ];
     return definitions.map(([client, commands, paths]) => {