@agentmemory/agentmemory 0.9.30 → 0.9.32

package/plugin/skills/agentmemory-rest-api/REFERENCE.md

@@ -5,7 +5,7 @@ Generated from `src/triggers/api.ts`. Do not edit the block below by hand; run `
 <!-- AUTOGEN:rest START - generated by scripts/skills/generate.ts, do not edit by hand -->
 The REST API is the primary surface. All paths are under `http://localhost:3111` (override with `--port`). Send `Authorization: Bearer <secret>`: the value of `AGENTMEMORY_SECRET`, or the one generated into `~/.agentmemory/secret` on first start when it is unset. Writes must use `Content-Type: application/json`.
 
-138 registered endpoints:
+147 registered endpoints:
 
 | Method | Path |
 | --- | --- |
@@ -30,11 +30,14 @@ The REST API is the primary surface. All paths are under `http://localhost:3111`
 | POST | `/agentmemory/claude-bridge/sync` |
 | GET | `/agentmemory/commits` |
 | POST | `/agentmemory/compress-file` |
+| GET | `/agentmemory/compression` |
+| POST | `/agentmemory/compression/retry` |
 | GET | `/agentmemory/config/flags` |
 | POST | `/agentmemory/consolidate` |
 | POST | `/agentmemory/consolidate-pipeline` |
 | GET | `/agentmemory/consolidation/status` |
 | POST | `/agentmemory/context` |
+| GET | `/agentmemory/counts` |
 | GET | `/agentmemory/crystals` |
 | POST | `/agentmemory/crystals/auto` |
 | POST | `/agentmemory/crystals/create` |
@@ -61,6 +64,9 @@ The REST API is the primary surface. All paths are under `http://localhost:3111`
 | POST | `/agentmemory/graph/compact` |
 | POST | `/agentmemory/graph/extract` |
 | POST | `/agentmemory/graph/import-graphify` |
+| GET | `/agentmemory/graph/index` |
+| POST | `/agentmemory/graph/index/migrate` |
+| POST | `/agentmemory/graph/index/resume` |
 | GET | `/agentmemory/graph/node` |
 | POST | `/agentmemory/graph/query` |
 | POST | `/agentmemory/graph/reset` |
@@ -76,6 +82,7 @@ The REST API is the primary surface. All paths are under `http://localhost:3111`
 | GET | `/agentmemory/lessons` |
 | POST | `/agentmemory/lessons` |
 | POST | `/agentmemory/lessons/delete` |
+| POST | `/agentmemory/lessons/get` |
 | POST | `/agentmemory/lessons/search` |
 | POST | `/agentmemory/lessons/strengthen` |
 | GET | `/agentmemory/livez` |
@@ -145,6 +152,8 @@ The REST API is the primary surface. All paths are under `http://localhost:3111`
 | POST | `/agentmemory/timeline` |
 | POST | `/agentmemory/verify` |
 | GET | `/agentmemory/viewer` |
+| GET | `/agentmemory/viewer/events` |
+| GET | `/agentmemory/viewer/snapshot` |
 | POST | `/agentmemory/vision-embed` |
 | POST | `/agentmemory/vision-search` |
 <!-- AUTOGEN:rest END -->

package/plugin/skills/agentmemory-rest-api/SKILL.md

@@ -12,31 +12,37 @@ REST is agentmemory's primary surface. MCP is a bridge on top of it. Every memor
 # liveness
 curl -fsS http://localhost:3111/agentmemory/livez
 
+# For this fixed loopback URL only. Do not print the value or enable shell tracing.
+agentmemory_secret="${AGENTMEMORY_SECRET:-$(cat "$HOME/.agentmemory/secret")}"
+test -n "$agentmemory_secret" || exit 1
+
 # save
-curl -X POST http://localhost:3111/agentmemory/remember \
+curl -fsS -X POST http://localhost:3111/agentmemory/remember \
+  -H "Authorization: Bearer $agentmemory_secret" \
   -H "Content-Type: application/json" \
   -d '{"content":"chose JWT refresh rotation","concepts":["jwt-refresh-rotation"]}'
 
 # recall
-curl -X POST http://localhost:3111/agentmemory/smart-search \
+curl -fsS -X POST http://localhost:3111/agentmemory/smart-search \
+  -H "Authorization: Bearer $agentmemory_secret" \
   -H "Content-Type: application/json" \
   -d '{"query":"auth token strategy","limit":5}'
 ```
 
 ## Auth
 
-By default localhost is open and no auth is needed. When `AGENTMEMORY_SECRET` is set, every request needs `Authorization: Bearer $AGENTMEMORY_SECRET`. See agentmemory-config.
+Every endpoint except liveness requires `Authorization: Bearer <secret>`, including on localhost. The server always has a secret: `AGENTMEMORY_SECRET` when you set one, otherwise one it generates at first start. Requests without the header get `401`. Liveness is public. The example uses an explicit environment secret or the generated local secret file; if the daemon uses a secret from its `.env`, load that value locally without displaying it. For a remote daemon, require an explicit credential for that endpoint and HTTPS. Never forward a local-file secret or follow an authenticated redirect to another host. See [TROUBLESHOOTING.md](TROUBLESHOOTING.md).
 
 ## Conventions
 
 - Save returns `201`, reads return `200`, validation errors return `400`.
-- Handlers whitelist body fields and drop unknown ones, so passing extra keys is safe but ignored.
-- The port is configurable with `--port` or `--instance`; streams, viewer, and engine derive from it.
+- Use documented fields only. A successful response does not prove an unsupported field was applied.
+- The REST port defaults to `3111` and is configurable with `--port` or `--instance`. The viewer defaults to `3113`; the internal engine WebSocket defaults to `49134`.
 
 ## See also
 
 - agentmemory-mcp-tools for the MCP equivalents.
-- agentmemory-config for the port quartet and the secret.
+- agentmemory-config for local configuration and the secret.
 
 ## Reference
 

package/plugin/skills/agentmemory-rest-api/TROUBLESHOOTING.md

@@ -0,0 +1,70 @@
+<!-- AUTOGEN:troubleshooting START - generated by scripts/skills/generate.ts, do not edit by hand -->
+# Troubleshooting agentmemory skills
+
+Recovery steps for separately installed skills. This document is generated into
+each skill directory so native skill readers can open it without parent traversal.
+
+## "MCP tool not available"
+
+Missing tools can mean a stopped MCP process, a disconnected daemon, or an
+explicitly reduced tool surface. Walk these in order:
+
+1. Identify the host. In Claude Code, inspect `/plugin list` and `/mcp`.
+   In Hermes, inspect the configured memory provider and `mcp_servers` separately.
+   In OpenClaw, validate the host configuration and inspect its MCP servers and
+   native plugins separately. In Pi or OMP, inspect `/agentmemory-status` and the
+   MCP inventory separately; native save/search does not prove the broader tools
+   are connected. Do not run another host's setup commands.
+2. Restart or reload the affected host connection after configuration changes.
+3. Inspect the connected tool inventory. Hermes may namespace MCP tools; invoke
+   the actual advertised names and schemas. A native memory provider is not
+   proof that every MCP tool or shared skill is available.
+4. Check `agentmemory status` and the daemon's `AGENTMEMORY_TOOLS` setting.
+   Codex's bundled bridge lists the daemon's enabled tools. The standalone shim
+   used by other hosts can fall back to seven basic tools with a separate store.
+   Do not claim full daemon functionality based on those seven tools.
+5. If `agentmemory connect codex` and the Codex plugin are both enabled, choose
+   one MCP connection. Check `/hooks` before adding global hook fallbacks.
+
+Hermes, OpenClaw, Pi and OMP connector installations bundle skills; other hosts
+may install them separately. Check the host's skill inventory and open this file
+from the installed skill directory. Test automatic capture with a real turn and
+a recorded observation; tool connectivity alone does not establish lifecycle
+capture.
+
+An outage or timeout is not an empty search result. Report the failure. A write
+may have committed before the response was lost; inspect state before retrying.
+
+## REST fallback
+
+When the MCP tools stay unavailable but the daemon is running, call the REST
+API directly:
+
+1. Set `AGENTMEMORY_URL` to the daemon base URL (default `http://localhost:3111`).
+2. The REST API requires a bearer credential by default. Use the host's explicit
+   `AGENTMEMORY_SECRET`; for loopback URLs only, fall back to the secret in
+   `~/.agentmemory/.env` and then `~/.agentmemory/secret`. Load the value locally
+   without displaying it. Never send a local-file secret to a remote URL.
+   If `AGENTMEMORY_CREDENTIAL_MODE=explicit`, require the explicit host credential
+   and do not read local credential files.
+   Authenticated REST fallback requests require HTTPS for non-loopback
+   URLs; HTTP is allowed for loopback URLs (`localhost`, `127.0.0.0/8`, or `[::1]`).
+   Reject redirects on authenticated requests. Do not print or save the secret.
+
+Endpoint map by skill:
+
+| Skill           | REST call                                                        |
+| --------------- | --------------------------------------------------------------- |
+| remember        | `POST /agentmemory/remember`                                     |
+| recall          | `POST /agentmemory/smart-search`                                 |
+| recap           | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| handoff         | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| session-history | `GET /agentmemory/sessions`                                      |
+| commit-context  | `GET /agentmemory/session/by-commit?sha=<sha>`                   |
+| commit-history  | `GET /agentmemory/commits` (URL-encode every query param)       |
+
+The MCP host reads the plugin MCP configuration. Restart the daemon after
+changing its configuration, then restart or reconnect the host MCP process after
+changing its URL or explicit secret. The local bridge reads the credential files
+for each request; it does not inherit other daemon `.env` settings.
+<!-- AUTOGEN:troubleshooting END -->

package/plugin/skills/commit-context/SKILL.md

@@ -61,4 +61,4 @@ session. From `git show`: it changed token rotation in refresh.ts."
 
 ## Troubleshooting
 
-See ../_shared/TROUBLESHOOTING.md if `memory_commit_lookup` is not available.
+See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) if `memory_commit_lookup` is not available.

package/plugin/skills/commit-context/TROUBLESHOOTING.md

@@ -0,0 +1,70 @@
+<!-- AUTOGEN:troubleshooting START - generated by scripts/skills/generate.ts, do not edit by hand -->
+# Troubleshooting agentmemory skills
+
+Recovery steps for separately installed skills. This document is generated into
+each skill directory so native skill readers can open it without parent traversal.
+
+## "MCP tool not available"
+
+Missing tools can mean a stopped MCP process, a disconnected daemon, or an
+explicitly reduced tool surface. Walk these in order:
+
+1. Identify the host. In Claude Code, inspect `/plugin list` and `/mcp`.
+   In Hermes, inspect the configured memory provider and `mcp_servers` separately.
+   In OpenClaw, validate the host configuration and inspect its MCP servers and
+   native plugins separately. In Pi or OMP, inspect `/agentmemory-status` and the
+   MCP inventory separately; native save/search does not prove the broader tools
+   are connected. Do not run another host's setup commands.
+2. Restart or reload the affected host connection after configuration changes.
+3. Inspect the connected tool inventory. Hermes may namespace MCP tools; invoke
+   the actual advertised names and schemas. A native memory provider is not
+   proof that every MCP tool or shared skill is available.
+4. Check `agentmemory status` and the daemon's `AGENTMEMORY_TOOLS` setting.
+   Codex's bundled bridge lists the daemon's enabled tools. The standalone shim
+   used by other hosts can fall back to seven basic tools with a separate store.
+   Do not claim full daemon functionality based on those seven tools.
+5. If `agentmemory connect codex` and the Codex plugin are both enabled, choose
+   one MCP connection. Check `/hooks` before adding global hook fallbacks.
+
+Hermes, OpenClaw, Pi and OMP connector installations bundle skills; other hosts
+may install them separately. Check the host's skill inventory and open this file
+from the installed skill directory. Test automatic capture with a real turn and
+a recorded observation; tool connectivity alone does not establish lifecycle
+capture.
+
+An outage or timeout is not an empty search result. Report the failure. A write
+may have committed before the response was lost; inspect state before retrying.
+
+## REST fallback
+
+When the MCP tools stay unavailable but the daemon is running, call the REST
+API directly:
+
+1. Set `AGENTMEMORY_URL` to the daemon base URL (default `http://localhost:3111`).
+2. The REST API requires a bearer credential by default. Use the host's explicit
+   `AGENTMEMORY_SECRET`; for loopback URLs only, fall back to the secret in
+   `~/.agentmemory/.env` and then `~/.agentmemory/secret`. Load the value locally
+   without displaying it. Never send a local-file secret to a remote URL.
+   If `AGENTMEMORY_CREDENTIAL_MODE=explicit`, require the explicit host credential
+   and do not read local credential files.
+   Authenticated REST fallback requests require HTTPS for non-loopback
+   URLs; HTTP is allowed for loopback URLs (`localhost`, `127.0.0.0/8`, or `[::1]`).
+   Reject redirects on authenticated requests. Do not print or save the secret.
+
+Endpoint map by skill:
+
+| Skill           | REST call                                                        |
+| --------------- | --------------------------------------------------------------- |
+| remember        | `POST /agentmemory/remember`                                     |
+| recall          | `POST /agentmemory/smart-search`                                 |
+| recap           | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| handoff         | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| session-history | `GET /agentmemory/sessions`                                      |
+| commit-context  | `GET /agentmemory/session/by-commit?sha=<sha>`                   |
+| commit-history  | `GET /agentmemory/commits` (URL-encode every query param)       |
+
+The MCP host reads the plugin MCP configuration. Restart the daemon after
+changing its configuration, then restart or reconnect the host MCP process after
+changing its URL or explicit secret. The local bridge reads the credential files
+for each request; it does not inherit other daemon `.env` settings.
+<!-- AUTOGEN:troubleshooting END -->

package/plugin/skills/commit-history/SKILL.md

@@ -59,4 +59,4 @@ appending to `GET /agentmemory/commits`.
 
 ## Troubleshooting
 
-See ../_shared/TROUBLESHOOTING.md if `memory_commits` is not available.
+See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) if `memory_commits` is not available.

package/plugin/skills/commit-history/TROUBLESHOOTING.md

@@ -0,0 +1,70 @@
+<!-- AUTOGEN:troubleshooting START - generated by scripts/skills/generate.ts, do not edit by hand -->
+# Troubleshooting agentmemory skills
+
+Recovery steps for separately installed skills. This document is generated into
+each skill directory so native skill readers can open it without parent traversal.
+
+## "MCP tool not available"
+
+Missing tools can mean a stopped MCP process, a disconnected daemon, or an
+explicitly reduced tool surface. Walk these in order:
+
+1. Identify the host. In Claude Code, inspect `/plugin list` and `/mcp`.
+   In Hermes, inspect the configured memory provider and `mcp_servers` separately.
+   In OpenClaw, validate the host configuration and inspect its MCP servers and
+   native plugins separately. In Pi or OMP, inspect `/agentmemory-status` and the
+   MCP inventory separately; native save/search does not prove the broader tools
+   are connected. Do not run another host's setup commands.
+2. Restart or reload the affected host connection after configuration changes.
+3. Inspect the connected tool inventory. Hermes may namespace MCP tools; invoke
+   the actual advertised names and schemas. A native memory provider is not
+   proof that every MCP tool or shared skill is available.
+4. Check `agentmemory status` and the daemon's `AGENTMEMORY_TOOLS` setting.
+   Codex's bundled bridge lists the daemon's enabled tools. The standalone shim
+   used by other hosts can fall back to seven basic tools with a separate store.
+   Do not claim full daemon functionality based on those seven tools.
+5. If `agentmemory connect codex` and the Codex plugin are both enabled, choose
+   one MCP connection. Check `/hooks` before adding global hook fallbacks.
+
+Hermes, OpenClaw, Pi and OMP connector installations bundle skills; other hosts
+may install them separately. Check the host's skill inventory and open this file
+from the installed skill directory. Test automatic capture with a real turn and
+a recorded observation; tool connectivity alone does not establish lifecycle
+capture.
+
+An outage or timeout is not an empty search result. Report the failure. A write
+may have committed before the response was lost; inspect state before retrying.
+
+## REST fallback
+
+When the MCP tools stay unavailable but the daemon is running, call the REST
+API directly:
+
+1. Set `AGENTMEMORY_URL` to the daemon base URL (default `http://localhost:3111`).
+2. The REST API requires a bearer credential by default. Use the host's explicit
+   `AGENTMEMORY_SECRET`; for loopback URLs only, fall back to the secret in
+   `~/.agentmemory/.env` and then `~/.agentmemory/secret`. Load the value locally
+   without displaying it. Never send a local-file secret to a remote URL.
+   If `AGENTMEMORY_CREDENTIAL_MODE=explicit`, require the explicit host credential
+   and do not read local credential files.
+   Authenticated REST fallback requests require HTTPS for non-loopback
+   URLs; HTTP is allowed for loopback URLs (`localhost`, `127.0.0.0/8`, or `[::1]`).
+   Reject redirects on authenticated requests. Do not print or save the secret.
+
+Endpoint map by skill:
+
+| Skill           | REST call                                                        |
+| --------------- | --------------------------------------------------------------- |
+| remember        | `POST /agentmemory/remember`                                     |
+| recall          | `POST /agentmemory/smart-search`                                 |
+| recap           | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| handoff         | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| session-history | `GET /agentmemory/sessions`                                      |
+| commit-context  | `GET /agentmemory/session/by-commit?sha=<sha>`                   |
+| commit-history  | `GET /agentmemory/commits` (URL-encode every query param)       |
+
+The MCP host reads the plugin MCP configuration. Restart the daemon after
+changing its configuration, then restart or reconnect the host MCP process after
+changing its URL or explicit secret. The local bridge reads the credential files
+for each request; it does not inherit other daemon `.env` settings.
+<!-- AUTOGEN:troubleshooting END -->

package/plugin/skills/forget/EXAMPLES.md

@@ -1,75 +1,40 @@
 # forget worked examples
 
-## 1. Delete a leaked secret
+## Delete a selected durable memory
 
 User: "Forget that note where I pasted the API key."
 
-Search:
-
-```json
-memory_smart_search { "query": "api key", "limit": 20 }
-```
-
-Response:
-
 ```json
-{
-  "results": [
-    { "id": "abc12345", "sessionId": "7f3a9c21", "title": "Pasted staging API key",
-      "narrative": "STAGING_KEY=sk-live-..." }
-  ]
-}
+memory_smart_search { "query": "api key", "targetLayer": "memory", "project": "app", "limit": 20 }
 ```
 
-Present and gate:
+Show the returned memory ID and title without displaying the secret value:
 
-> Found 1 match:
-> - `abc12345` (session `7f3a9c2`) "Pasted staging API key"
->
-> Delete this memory? (yes/no)
+> Found memory `abc12345` in project `app`: "Staging API configuration".
+> Delete this memory?
 
-After the user says yes:
+After explicit confirmation:
 
 ```json
-memory_governance_delete { "memoryIds": ["abc12345"], "reason": "user privacy request" }
+memory_governance_delete { "memoryIds": "abc12345", "reason": "user privacy request" }
 ```
 
-Response:
-
-```json
-{ "deleted": 1 }
-```
-
-Present:
-
-> Deleted 1 memory (`abc12345`).
+If the response reports `deleted: 1`, report one deletion. If it reports
+`deleted: 0` and `notFound: ["abc12345"]`, report that the memory was not found.
+For mixed results, state the actual count and any failed or missing IDs.
 
-## 2. Drop a whole session's observations
+## A request to erase a whole session
 
 User: "Delete everything from the throwaway spike session."
 
-Search, identify the session, then collect every memory id in it:
-
-```json
-memory_smart_search { "query": "spike prototype throwaway", "limit": 20 }
-```
-
-Response has 4 results all with `sessionId: c98f1100`. Show all four, get a yes,
-then pass every id:
-
-```json
-memory_governance_delete {
-  "memoryIds": ["m1", "m2", "m3", "m4"],
-  "reason": "drop throwaway spike session"
-}
-```
-
-Never send `{ "sessionId": "c98f1100" }`; the MCP deletes by memory id only.
-
-## 3. User declines
+Explain that this tool deletes selected durable memories only. A relevance
+search limited to 20 results cannot enumerate all session data, and observation
+IDs are not accepted as durable-memory IDs. Do not claim complete erasure.
+Offer a review of matching durable memories with the scope clearly stated.
+Lessons have a separate `memory_lesson_delete` operation.
 
-User: "Actually, on second thought, keep them."
+## User declines
 
-Do not call delete. Confirm:
+User: "Actually, keep them."
 
-> Understood, nothing deleted. The 4 memories from session `c98f110` are intact.
+Do not call delete. Report that nothing was deleted.

package/plugin/skills/forget/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: forget
-description: Delete specific observations from agentmemory after showing them and getting explicit confirmation. Use when the user says "forget this", "delete memory", "remove that note", or wants to scrub specific data for privacy.
+description: Delete selected durable memories from agentmemory after showing them and getting explicit confirmation. Use when the user says "forget this", "delete memory", "remove that note", or wants to scrub specific data for privacy.
 argument-hint: "[what to forget - session ID, file path, or search term]"
 user-invocable: true
 ---
@@ -10,13 +10,13 @@ The user wants to remove data from agentmemory: $ARGUMENTS
 ## Quick start
 
 ```json
-memory_smart_search { "query": "old api key in config", "limit": 20 }
+memory_smart_search { "query": "old api key in config", "targetLayer": "memory", "limit": 20 }
 ```
 
 Show the matches, get a yes, then:
 
 ```json
-memory_governance_delete { "memoryIds": ["abc12345", "def67890"], "reason": "user privacy request" }
+memory_governance_delete { "memoryIds": "abc12345,def67890", "reason": "user privacy request" }
 ```
 
 Expected output:
@@ -32,17 +32,21 @@ an explicit yes before calling delete. Delete by memory ID, never a bare session
 
 ## Workflow
 
-1. Search with `memory_smart_search`, the user's text as `query`, `limit: 20`.
-2. Show what matched: session ids, memory ids, titles. Ask for explicit
+1. Search with `memory_smart_search`, the user's text as `query`,
+   `targetLayer: "memory"`, `limit: 20`, and the requested project/agent scope.
+   These are selected relevance matches, not an exhaustive inventory.
+2. Show what matched: memory ids, titles, and scope. Redact secret values. Ask for explicit
    confirmation. Do not proceed on silence or a vague "sure, whatever".
-3. On confirmation, call `memory_governance_delete` with `memoryIds` (array or
-   comma-separated string) and optional `reason` (default `plugin skill request`).
-4. To drop a whole session, collect every memory id in that session from the
-   search results and pass them all. The MCP does not accept a bare `sessionId`.
+3. On confirmation, call `memory_governance_delete` with `memoryIds` as a
+   comma-separated string and optional `reason` (default `plugin skill request`).
+4. Observation or whole-session erasure is not supported by this operation.
+   Explain that limit before proceeding; never label selected memory deletion
+   as a complete session wipe. Do not pass observation IDs or a `sessionId`.
 5. Lessons are separate: delete one with `memory_lesson_delete` and its
    `lessonId`; `memory_governance_delete` does not touch lessons.
-6. Report the deletion count back. A count of 0 means the ids did not exist;
-   say so instead of claiming a delete.
+6. Check `deleted`, `notFound`, and `failed` in the response. Report actual
+   deletions and unresolved IDs separately. Recheck the selected IDs before
+   retrying a failed request; an interrupted response may hide a completed write.
 
 ## Anti-patterns
 
@@ -66,4 +70,4 @@ an explicit yes.
 
 ## Troubleshooting
 
-See ../_shared/TROUBLESHOOTING.md if `memory_smart_search` or `memory_governance_delete` is not available.
+See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) if `memory_smart_search` or `memory_governance_delete` is not available.

package/plugin/skills/forget/TROUBLESHOOTING.md

@@ -0,0 +1,70 @@
+<!-- AUTOGEN:troubleshooting START - generated by scripts/skills/generate.ts, do not edit by hand -->
+# Troubleshooting agentmemory skills
+
+Recovery steps for separately installed skills. This document is generated into
+each skill directory so native skill readers can open it without parent traversal.
+
+## "MCP tool not available"
+
+Missing tools can mean a stopped MCP process, a disconnected daemon, or an
+explicitly reduced tool surface. Walk these in order:
+
+1. Identify the host. In Claude Code, inspect `/plugin list` and `/mcp`.
+   In Hermes, inspect the configured memory provider and `mcp_servers` separately.
+   In OpenClaw, validate the host configuration and inspect its MCP servers and
+   native plugins separately. In Pi or OMP, inspect `/agentmemory-status` and the
+   MCP inventory separately; native save/search does not prove the broader tools
+   are connected. Do not run another host's setup commands.
+2. Restart or reload the affected host connection after configuration changes.
+3. Inspect the connected tool inventory. Hermes may namespace MCP tools; invoke
+   the actual advertised names and schemas. A native memory provider is not
+   proof that every MCP tool or shared skill is available.
+4. Check `agentmemory status` and the daemon's `AGENTMEMORY_TOOLS` setting.
+   Codex's bundled bridge lists the daemon's enabled tools. The standalone shim
+   used by other hosts can fall back to seven basic tools with a separate store.
+   Do not claim full daemon functionality based on those seven tools.
+5. If `agentmemory connect codex` and the Codex plugin are both enabled, choose
+   one MCP connection. Check `/hooks` before adding global hook fallbacks.
+
+Hermes, OpenClaw, Pi and OMP connector installations bundle skills; other hosts
+may install them separately. Check the host's skill inventory and open this file
+from the installed skill directory. Test automatic capture with a real turn and
+a recorded observation; tool connectivity alone does not establish lifecycle
+capture.
+
+An outage or timeout is not an empty search result. Report the failure. A write
+may have committed before the response was lost; inspect state before retrying.
+
+## REST fallback
+
+When the MCP tools stay unavailable but the daemon is running, call the REST
+API directly:
+
+1. Set `AGENTMEMORY_URL` to the daemon base URL (default `http://localhost:3111`).
+2. The REST API requires a bearer credential by default. Use the host's explicit
+   `AGENTMEMORY_SECRET`; for loopback URLs only, fall back to the secret in
+   `~/.agentmemory/.env` and then `~/.agentmemory/secret`. Load the value locally
+   without displaying it. Never send a local-file secret to a remote URL.
+   If `AGENTMEMORY_CREDENTIAL_MODE=explicit`, require the explicit host credential
+   and do not read local credential files.
+   Authenticated REST fallback requests require HTTPS for non-loopback
+   URLs; HTTP is allowed for loopback URLs (`localhost`, `127.0.0.0/8`, or `[::1]`).
+   Reject redirects on authenticated requests. Do not print or save the secret.
+
+Endpoint map by skill:
+
+| Skill           | REST call                                                        |
+| --------------- | --------------------------------------------------------------- |
+| remember        | `POST /agentmemory/remember`                                     |
+| recall          | `POST /agentmemory/smart-search`                                 |
+| recap           | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| handoff         | `GET /agentmemory/sessions` + `POST /agentmemory/smart-search`   |
+| session-history | `GET /agentmemory/sessions`                                      |
+| commit-context  | `GET /agentmemory/session/by-commit?sha=<sha>`                   |
+| commit-history  | `GET /agentmemory/commits` (URL-encode every query param)       |
+
+The MCP host reads the plugin MCP configuration. Restart the daemon after
+changing its configuration, then restart or reconnect the host MCP process after
+changing its URL or explicit secret. The local bridge reads the credential files
+for each request; it does not inherit other daemon `.env` settings.
+<!-- AUTOGEN:troubleshooting END -->

package/plugin/skills/handoff/EXAMPLES.md

@@ -7,7 +7,7 @@ User: "Where were we?"
 Project cwd: `/Users/dev/app`. Invocation:
 
 ```json
-memory_sessions { "limit": 20 }
+memory_sessions { "project": "app", "limit": 20 }
 ```
 
 Response:
@@ -26,7 +26,7 @@ Response:
 Pull supporting context:
 
 ```json
-memory_recall { "query": "jwt-refresh-rotation logout", "limit": 10 }
+memory_recall { "query": "jwt-refresh-rotation logout", "project": "app", "limit": 10 }
 ```
 
 Present:
@@ -43,8 +43,9 @@ Project cwd: `/Users/dev/repo-a`. Sessions include one with `cwd:
 
 A raw prefix would match `repo-a-staging`. The boundary check rejects it because
 `/Users/dev/repo-a-staging` does not equal `/Users/dev/repo-a` and does not start
-with `/Users/dev/repo-a/`. Pick the real `repo-a` session instead, or fall back
-to the most recent session overall if none matches.
+with `/Users/dev/repo-a/`. Continue through `nextCursor` when another page is
+available. If no matching session exists, report that this project has no
+recorded session; do not substitute the most recent session from another repo.
 
 ## 3. Empty session
 

package/plugin/skills/handoff/SKILL.md

@@ -10,11 +10,12 @@ The user wants to resume work. Optional cwd override: $ARGUMENTS
 ## Quick start
 
 ```json
-memory_sessions { "limit": 20 }
+memory_sessions { "project": "<current-project-id>", "limit": 20 }
 ```
 
 Pick the most recent session whose `cwd` matches this project, then:
-`memory_recall { "query": "<session top concepts>", "limit": 10 }`.
+`memory_recall { "query": "<session top concepts>", "project": "<current-project-id>", "limit": 10 }`.
+When an agent is requested, pass the same `agentId` to both calls.
 
 Expected output:
 
@@ -33,7 +34,10 @@ gets mistaken for this one. Never invent observations for an empty session.
 
 1. Resolve the project path: if `$ARGUMENTS` is given, normalize it to absolute
    (`path.resolve(process.cwd(), $ARGUMENTS)`); else use the cwd.
-2. Call `memory_sessions`. Pick the most recent session whose normalized `cwd`
+2. Call `memory_sessions` with the exact project identifier when known, and
+   `agentId` when requested. Otherwise follow `nextCursor` until the matching
+   directory is found or pagination ends. Preserve filters between pages.
+   Pick the most recent session whose normalized `cwd`
    matches by directory boundary: equality, OR `cwd.startsWith(projectPath + sep)`,
    OR `projectPath.startsWith(cwd + sep)`. Prefer `completed` over `abandoned`.
    No match: report that this project has no matching session and stop. Do not
@@ -42,7 +46,8 @@ gets mistaken for this one. Never invent observations for an empty session.
    Look in `summary` or recent `conversation` observations whose `narrative`
    ends in `?`.
 4. Summarize: title/summary, key files, key decisions or errors, using
-   `memory_recall` on the top concepts, limit 10. Check each result's session or
+   `memory_recall` on the top concepts, limit 10, preserving the chosen project
+   and agent scope. Check each result's session or
    project provenance before including it; a query alone does not enforce scope.
 5. End with one concrete "next step?" pointer.
 
@@ -67,4 +72,4 @@ a directory-boundary check that cannot cross sibling repos.
 
 ## Troubleshooting
 
-See ../_shared/TROUBLESHOOTING.md if `memory_sessions` or `memory_recall` is not available.
+See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) if `memory_sessions` or `memory_recall` is not available.