@ainyc/canonry 2.0.0 → 2.2.1

package/dist/{chunk-YZKLIUH4.js → chunk-2QNWFP6R.js}

@@ -1,5 +1,6 @@
 import {
   IntelligenceService,
+  agentMemory,
   agentSessions,
   apiKeys,
   auditLog,
@@ -26,7 +27,7 @@ import {
   runs,
   schedules,
   usageCounters
-} from "./chunk-GH6WGN5B.js";
+} from "./chunk-TAII35VC.js";
 
 // src/config.ts
 import fs from "fs";
@@ -337,11 +338,11 @@ function printCliError(err, format) {
 
 // src/server.ts
 import { createRequire as createRequire2 } from "module";
-import crypto23 from "crypto";
+import crypto24 from "crypto";
 import fs8 from "fs";
 import path9 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { eq as eq25 } from "drizzle-orm";
+import { eq as eq26 } from "drizzle-orm";
 import Fastify from "fastify";
 
 // ../contracts/src/config-schema.ts
@@ -1404,6 +1405,20 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+// ../contracts/src/agent.ts
+import { z as z13 } from "zod";
+var memorySourceSchema = z13.enum(["aero", "user", "compaction"]);
+var MemorySources = memorySourceSchema.enum;
+var AGENT_MEMORY_VALUE_MAX_BYTES = 2 * 1024;
+var AGENT_MEMORY_KEY_MAX_LENGTH = 128;
+var agentMemoryUpsertRequestSchema = z13.object({
+  key: z13.string().min(1).max(AGENT_MEMORY_KEY_MAX_LENGTH),
+  value: z13.string().min(1)
+});
+var agentMemoryDeleteRequestSchema = z13.object({
+  key: z13.string().min(1).max(AGENT_MEMORY_KEY_MAX_LENGTH)
+});
+
 // ../api-routes/src/auth.ts
 import crypto2 from "crypto";
 import { eq } from "drizzle-orm";
@@ -14787,8 +14802,8 @@ var RunCoordinator = class {
 };
 
 // src/agent/session-registry.ts
-import crypto22 from "crypto";
-import { eq as eq23 } from "drizzle-orm";
+import crypto23 from "crypto";
+import { eq as eq24 } from "drizzle-orm";
 
 // src/agent/session.ts
 import fs7 from "fs";
@@ -14814,7 +14829,7 @@ var AGENT_PROVIDERS = {
   [AgentProviderIds.gemini]: {
     piAiProvider: "google",
     label: "Google (Gemini)",
-    defaultModel: "gemini-2.5-pro",
+    defaultModel: "gemini-2.5-flash",
     autoDetectPriority: 2
   },
   [AgentProviderIds.zai]: {
@@ -15005,6 +15020,105 @@ function buildSkillDocTools() {
 
 // src/agent/tools.ts
 import { Type as Type2 } from "@sinclair/typebox";
+
+// src/agent/memory-store.ts
+import crypto22 from "crypto";
+import { and as and11, desc as desc9, eq as eq23, like, sql as sql6 } from "drizzle-orm";
+var COMPACTION_KEY_PREFIX = "compaction:";
+var COMPACTION_NOTES_PER_SESSION = 3;
+function rowToDto(row) {
+  return {
+    id: row.id,
+    key: row.key,
+    value: row.value,
+    source: row.source,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function listMemoryEntries(db, projectId, opts = {}) {
+  const query = db.select().from(agentMemory).where(eq23(agentMemory.projectId, projectId)).orderBy(desc9(agentMemory.updatedAt));
+  const rows = opts.limit === void 0 ? query.all() : query.limit(opts.limit).all();
+  return rows.map(rowToDto);
+}
+function upsertMemoryEntry(db, args) {
+  if (Buffer.byteLength(args.value, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+    throw new Error(
+      `memory value exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes (got ${Buffer.byteLength(args.value, "utf8")})`
+    );
+  }
+  if (args.source !== MemorySources.compaction && args.key.startsWith(COMPACTION_KEY_PREFIX)) {
+    throw new Error(`memory key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`);
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const id = crypto22.randomUUID();
+  db.insert(agentMemory).values({
+    id,
+    projectId: args.projectId,
+    key: args.key,
+    value: args.value,
+    source: args.source,
+    createdAt: now,
+    updatedAt: now
+  }).onConflictDoUpdate({
+    target: [agentMemory.projectId, agentMemory.key],
+    set: {
+      value: args.value,
+      source: args.source,
+      updatedAt: now
+    }
+  }).run();
+  const row = db.select().from(agentMemory).where(and11(eq23(agentMemory.projectId, args.projectId), eq23(agentMemory.key, args.key))).get();
+  if (!row) throw new Error("memory upsert produced no row");
+  return rowToDto(row);
+}
+function deleteMemoryEntry(db, projectId, key) {
+  const result = db.delete(agentMemory).where(and11(eq23(agentMemory.projectId, projectId), eq23(agentMemory.key, key))).run();
+  const changes = result.changes ?? 0;
+  return changes > 0;
+}
+function loadRecentForHydrate(db, projectId, limit) {
+  return listMemoryEntries(db, projectId, { limit });
+}
+function writeCompactionNote(db, args) {
+  if (Buffer.byteLength(args.summary, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+    throw new Error(
+      `compaction summary exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes; summarizer produced too much text`
+    );
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const key = `${COMPACTION_KEY_PREFIX}${args.sessionId}:${now}`;
+  const id = crypto22.randomUUID();
+  let inserted;
+  db.transaction((tx) => {
+    tx.insert(agentMemory).values({
+      id,
+      projectId: args.projectId,
+      key,
+      value: args.summary,
+      source: MemorySources.compaction,
+      createdAt: now,
+      updatedAt: now
+    }).run();
+    const sessionPrefix = `${COMPACTION_KEY_PREFIX}${args.sessionId}:`;
+    const existing = tx.select({ id: agentMemory.id, updatedAt: agentMemory.updatedAt }).from(agentMemory).where(
+      and11(
+        eq23(agentMemory.projectId, args.projectId),
+        like(agentMemory.key, `${sessionPrefix}%`)
+      )
+    ).orderBy(desc9(agentMemory.updatedAt)).all();
+    const stale = existing.slice(COMPACTION_NOTES_PER_SESSION).map((r) => r.id);
+    if (stale.length > 0) {
+      tx.delete(agentMemory).where(sql6`${agentMemory.id} IN (${sql6.join(stale.map((s) => sql6`${s}`), sql6`, `)})`).run();
+    }
+    const row = tx.select().from(agentMemory).where(and11(eq23(agentMemory.projectId, args.projectId), eq23(agentMemory.key, key))).get();
+    if (row) inserted = rowToDto(row);
+  });
+  if (!inserted) throw new Error("compaction note write produced no row");
+  return inserted;
+}
+
+// src/agent/tools.ts
 var MAX_TOOL_RESULT_CHARS = 2e4;
 function truncate(json) {
   if (json.length <= MAX_TOOL_RESULT_CHARS) return json;
@@ -15144,6 +15258,27 @@ function buildGetRunTool(ctx) {
     }
   };
 }
+var RecallSchema = Type2.Object({
+  limit: Type2.Optional(
+    Type2.Number({
+      description: "Max notes to return, ordered newest-first. Default 50. Max 100.",
+      minimum: 1,
+      maximum: 100
+    })
+  )
+});
+function buildRecallTool(ctx) {
+  return {
+    name: "recall",
+    label: "Recall memory",
+    description: "Read project-scoped durable notes Aero has stored via `remember` (plus compaction summaries). Returns entries newest-first. The N most-recent entries are also injected into the system prompt at session start, so you usually do not need to call this \u2014 reach for it when you need older context or the full note value.",
+    parameters: RecallSchema,
+    execute: async (_toolCallId, params) => {
+      const entries = listMemoryEntries(ctx.db, ctx.projectId, { limit: params.limit ?? 50 });
+      return textResult2({ entries });
+    }
+  };
+}
 function buildReadTools(ctx) {
   return [
     buildGetStatusTool(ctx),
@@ -15152,7 +15287,8 @@ function buildReadTools(ctx) {
     buildGetInsightsTool(ctx),
     buildListKeywordsTool(ctx),
     buildListCompetitorsTool(ctx),
-    buildGetRunTool(ctx)
+    buildGetRunTool(ctx),
+    buildRecallTool(ctx)
   ];
 }
 var RunSweepSchema = Type2.Object({
@@ -15307,6 +15443,58 @@ function buildAttachAgentWebhookTool(ctx) {
     }
   };
 }
+var RememberSchema = Type2.Object({
+  key: Type2.String({
+    description: `Stable identifier for this note (max ${AGENT_MEMORY_KEY_MAX_LENGTH} chars). Writing the same key overwrites the prior value. Do NOT use the "${COMPACTION_KEY_PREFIX}" prefix \u2014 that namespace is reserved for transcript compaction summaries.`,
+    minLength: 1,
+    maxLength: AGENT_MEMORY_KEY_MAX_LENGTH
+  }),
+  value: Type2.String({
+    description: `Plain-text note to persist (max ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes). Use for durable operator preferences, migration context, or non-obvious reasoning you'll want on a future turn. Do NOT duplicate data canonry already tracks (runs, insights, timelines) \u2014 query those instead.`,
+    minLength: 1
+  })
+});
+function buildRememberTool(ctx) {
+  return {
+    name: "remember",
+    label: "Remember",
+    description: "Persist a project-scoped durable note visible to every future Aero session for this project. Upsert \u2014 writing the same key replaces the prior value. Capped at 2 KB per note.",
+    parameters: RememberSchema,
+    execute: async (_toolCallId, params) => {
+      const entry = upsertMemoryEntry(ctx.db, {
+        projectId: ctx.projectId,
+        key: params.key,
+        value: params.value,
+        source: MemorySources.aero
+      });
+      return textResult2({ status: "remembered", entry });
+    }
+  };
+}
+var ForgetSchema = Type2.Object({
+  key: Type2.String({
+    description: "Exact key of the note to remove. No-op (status=missing) when no note exists for that key.",
+    minLength: 1,
+    maxLength: AGENT_MEMORY_KEY_MAX_LENGTH
+  })
+});
+function buildForgetTool(ctx) {
+  return {
+    name: "forget",
+    label: "Forget",
+    description: "Delete a durable note by key. Use when a previously-remembered fact is wrong or no longer relevant.",
+    parameters: ForgetSchema,
+    execute: async (_toolCallId, params) => {
+      if (params.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw new Error(
+          `cannot forget compaction notes directly \u2014 they are pruned automatically (key prefix "${COMPACTION_KEY_PREFIX}" is reserved)`
+        );
+      }
+      const removed = deleteMemoryEntry(ctx.db, ctx.projectId, params.key);
+      return textResult2({ status: removed ? "forgotten" : "missing", key: params.key });
+    }
+  };
+}
 function buildWriteTools(ctx) {
   return [
     buildRunSweepTool(ctx),
@@ -15314,7 +15502,9 @@ function buildWriteTools(ctx) {
     buildAddKeywordsTool(ctx),
     buildAddCompetitorsTool(ctx),
     buildUpdateScheduleTool(ctx),
-    buildAttachAgentWebhookTool(ctx)
+    buildAttachAgentWebhookTool(ctx),
+    buildRememberTool(ctx),
+    buildForgetTool(ctx)
   ];
 }
 function buildAllTools(ctx) {
@@ -15366,7 +15556,13 @@ function createAeroSession(opts) {
   if (!provider) throw new Error(missingProviderMessage());
   const model = resolveAeroModel(provider, opts.modelId);
   const toolScope = opts.toolScope ?? "all";
-  const stateTools = toolScope === "read-only" ? buildReadTools({ client: opts.client, projectName: opts.projectName }) : buildAllTools({ client: opts.client, projectName: opts.projectName });
+  const toolCtx = {
+    client: opts.client,
+    projectName: opts.projectName,
+    db: opts.db,
+    projectId: opts.projectId
+  };
+  const stateTools = toolScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
   const defaultTools = [...stateTools, ...buildSkillDocTools()];
   const tools = opts.tools ?? defaultTools;
   return new Agent({
@@ -15387,13 +15583,151 @@ function resolveSessionProviderAndModel(config, opts) {
   return { provider, modelId };
 }
 
+// src/agent/compaction.ts
+import { complete } from "@mariozechner/pi-ai";
+
+// src/agent/compaction-config.ts
+var COMPACTION_TOKEN_THRESHOLD = 6e4;
+var COMPACTION_TARGET_RATIO = 0.5;
+var COMPACTION_PRESERVE_TAIL_MESSAGES = 10;
+var COMPACTION_MAX_MESSAGES = 400;
+
+// src/agent/token-counter.ts
+var CHARS_PER_TOKEN = 4;
+function estimateMessageTokens(message) {
+  const content = message.content;
+  if (content === void 0) return 0;
+  if (typeof content === "string") {
+    return Math.ceil(content.length / CHARS_PER_TOKEN);
+  }
+  if (!Array.isArray(content)) return 0;
+  let chars = 0;
+  for (const part of content) {
+    if (part && typeof part === "object" && "type" in part) {
+      const p = part;
+      switch (p.type) {
+        case "text":
+          chars += (p.text ?? "").length;
+          break;
+        case "thinking":
+          chars += (p.thinking ?? "").length;
+          break;
+        case "toolCall":
+          try {
+            chars += JSON.stringify(p.arguments ?? {}).length;
+          } catch {
+            chars += 64;
+          }
+          break;
+        case "image":
+          chars += 1024;
+          break;
+        default:
+          break;
+      }
+    }
+  }
+  return Math.ceil(chars / CHARS_PER_TOKEN);
+}
+function estimateTranscriptTokens(messages) {
+  let total = 0;
+  for (const m of messages) total += estimateMessageTokens(m);
+  return total;
+}
+
+// src/agent/compaction.ts
+function shouldCompact(messages) {
+  if (messages.length >= COMPACTION_MAX_MESSAGES) return true;
+  return estimateTranscriptTokens(messages) >= COMPACTION_TOKEN_THRESHOLD;
+}
+function findSafeSplit(messages, targetIndex) {
+  const maxSplit = messages.length - COMPACTION_PRESERVE_TAIL_MESSAGES;
+  if (maxSplit <= 0) return 0;
+  const boundedTarget = Math.max(0, Math.min(targetIndex, maxSplit));
+  for (let i = boundedTarget; i <= maxSplit; i++) {
+    const m = messages[i];
+    if (m && m.role === "user") return i;
+  }
+  return 0;
+}
+function toLlmMessages(messages) {
+  const out = [];
+  for (const m of messages) {
+    if (m.role === "user" || m.role === "assistant" || m.role === "toolResult") {
+      out.push(m);
+    }
+  }
+  return out;
+}
+var SUMMARY_SYSTEM_PROMPT = `You compress an AI agent conversation transcript into a short durable note.
+
+Extract only:
+- User intents and requests
+- Actions the agent took and their outcomes
+- Key findings, insights, decisions
+- Outstanding TODOs or deferred follow-ups
+
+Style: dense bullet points. No preamble, no closing remarks, no agent self-commentary. Keep the note under 1500 characters.`;
+function truncateToByteLimit(text, maxBytes) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  const suffix = "\u2026[truncated]";
+  const budget = maxBytes - Buffer.byteLength(suffix, "utf8");
+  let buf = Buffer.from(text, "utf8").subarray(0, budget);
+  while (buf.length > 0 && (buf[buf.length - 1] & 192) === 128) {
+    buf = buf.subarray(0, buf.length - 1);
+  }
+  return buf.toString("utf8") + suffix;
+}
+async function runSummaryLlm(args) {
+  const context = {
+    systemPrompt: SUMMARY_SYSTEM_PROMPT,
+    messages: toLlmMessages(args.chunk)
+  };
+  const apiKey = args.getApiKey?.(args.model.provider);
+  const resp = await complete(args.model, context, apiKey ? { apiKey } : {});
+  const parts = resp.content.filter((p) => p.type === "text");
+  const text = parts.map((p) => p.text).join("\n").trim();
+  if (!text) throw new Error("summary LLM returned no text content");
+  return text;
+}
+async function compactMessages(args) {
+  const target = Math.floor(args.messages.length * COMPACTION_TARGET_RATIO);
+  const split = findSafeSplit(args.messages, target);
+  if (split === 0) return null;
+  const chunk = args.messages.slice(0, split);
+  const suffix = args.messages.slice(split);
+  const summarize = args.summarize ?? runSummaryLlm;
+  const rawSummary = await summarize({ model: args.model, chunk, getApiKey: args.getApiKey });
+  const summary = truncateToByteLimit(rawSummary, AGENT_MEMORY_VALUE_MAX_BYTES);
+  writeCompactionNote(args.db, {
+    projectId: args.projectId,
+    sessionId: args.sessionId,
+    summary,
+    removedCount: chunk.length
+  });
+  return { messages: suffix, removedCount: chunk.length, summary };
+}
+
 // src/agent/session-registry.ts
 var log7 = createLogger("SessionRegistry");
+var MAX_HYDRATE_NOTES = 20;
+var MAX_HYDRATE_BYTES = 32 * 1024;
+function escapeMemoryFragment(value) {
+  return value.replace(/<(\/?)memory>/gi, "<$1\u200Cmemory>");
+}
 var SessionRegistry = class {
   live = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   /** Last tool scope used on the live Agent for a project. Read in getOrCreate to know when to swap. */
   scopes = /* @__PURE__ */ new Map();
+  /** Cached resolved project id per project name, used so alignScope can rebuild tool context without a DB roundtrip. */
+  projectIds = /* @__PURE__ */ new Map();
+  /**
+   * In-flight compaction promises keyed by project name. A second
+   * `acquireForTurn` that arrives while the first is still summarizing
+   * awaits the same promise instead of kicking off a duplicate LLM call.
+   */
+  compactions = /* @__PURE__ */ new Map();
   opts;
   constructor(opts) {
     this.opts = opts;
@@ -15424,19 +15758,22 @@ var SessionRegistry = class {
           modelProvider: effectiveProvider,
           modelId: effectiveModelId,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        }).where(eq23(agentSessions.projectId, projectId)).run();
+        }).where(eq24(agentSessions.projectId, projectId)).run();
       }
       const agent2 = createAeroSession({
         projectName,
         client: this.opts.client,
         config: this.opts.config,
+        db: this.opts.db,
+        projectId,
         provider: effectiveProvider,
         modelId: effectiveModelId,
-        systemPromptOverride: row.systemPrompt,
+        systemPromptOverride: this.buildHydratedSystemPrompt(projectId, row.systemPrompt),
         initialMessages: persistedMessages,
         toolScope: preferences?.toolScope
       });
       this.scopes.set(projectName, preferences?.toolScope ?? "all");
+      this.projectIds.set(projectName, projectId);
       if (queued.length > 0) {
         this.appendPending(projectName, queued);
         this.updateRow(projectId, { followUpQueue: "[]" });
@@ -15451,14 +15788,21 @@ var SessionRegistry = class {
       projectName,
       client: this.opts.client,
       config: this.opts.config,
+      db: this.opts.db,
+      projectId,
       provider,
       modelId,
-      systemPromptOverride: systemPrompt,
+      // Hydrate on the fresh path too — a brand-new session may still see
+      // notes if they were seeded via CLI/API before the first prompt.
+      systemPromptOverride: this.buildHydratedSystemPrompt(projectId, systemPrompt),
       toolScope: preferences?.toolScope
     });
     this.scopes.set(projectName, preferences?.toolScope ?? "all");
+    this.projectIds.set(projectName, projectId);
     this.insertRow({
       projectId,
+      // Persist the raw (unhydrated) prompt so the DB remains canonical —
+      // the `<memory>` block is rebuilt from the notes table on every load.
       systemPrompt,
       modelProvider: provider,
       modelId,
@@ -15469,6 +15813,63 @@ var SessionRegistry = class {
     this.registerDrainHook(agent, projectName);
     return agent;
   }
+  /**
+   * Append the `<memory>` block to a base system prompt, sourced from the
+   * `agent_memory` table. Returns the base prompt unchanged when no notes
+   * exist — an empty block would just be prompt noise. Truncates to
+   * `MAX_HYDRATE_BYTES`, dropping oldest-first, so the block is bounded
+   * even when notes sit near their 2 KB cap.
+   *
+   * Note values come from LLM-authored compaction summaries and operator
+   * input, so they are treated as untrusted data: closing tags that could
+   * escape the `<memory>` wrapper are neutralized before interpolation.
+   */
+  buildHydratedSystemPrompt(projectId, basePrompt) {
+    const entries = loadRecentForHydrate(this.opts.db, projectId, MAX_HYDRATE_NOTES);
+    if (entries.length === 0) return basePrompt;
+    let totalBytes = 0;
+    const kept = [];
+    for (const entry of entries) {
+      const escaped = {
+        source: escapeMemoryFragment(entry.source),
+        key: escapeMemoryFragment(entry.key),
+        value: escapeMemoryFragment(entry.value)
+      };
+      const line = `- [${escaped.source}] ${escaped.key}: ${escaped.value}
+`;
+      const bytes = Buffer.byteLength(line, "utf8");
+      if (totalBytes + bytes > MAX_HYDRATE_BYTES) break;
+      kept.push(escaped);
+      totalBytes += bytes;
+    }
+    if (kept.length === 0) return basePrompt;
+    const lines = kept.map((e) => `- [${e.source}] ${e.key}: ${e.value}`);
+    return `${basePrompt.trimEnd()}
+
+---
+
+<memory>
+Project-scoped durable notes (newest first). Use remember/forget/recall to manage. Entries tagged [compaction] are LLM-summarized transcript slices.
+
+${lines.join("\n")}
+</memory>`;
+  }
+  /**
+   * Rebuild the live agent's system prompt from the latest `agent_memory`
+   * rows. Called after out-of-band memory writes (CLI/API PUT/DELETE) so
+   * the next turn on a hot session sees the updated notes without waiting
+   * for compaction or a cold restart. No-op when no live agent exists —
+   * the next `getOrCreate` will hydrate from DB anyway.
+   */
+  rehydrateLiveMemory(projectName) {
+    const agent = this.live.get(projectName);
+    if (!agent) return;
+    const projectId = this.tryResolveProjectId(projectName);
+    if (!projectId) return;
+    const row = this.loadRow(projectId);
+    if (!row) return;
+    agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
+  }
   /**
    * Acquire the Agent for an upcoming prompt/turn.
    *
@@ -15484,7 +15885,7 @@ var SessionRegistry = class {
    * Persists the new model choice to the DB row so subsequent invocations
    * stay on it unless overridden again.
    */
-  acquireForTurn(projectName, preferences) {
+  async acquireForTurn(projectName, preferences) {
     const agent = this.getOrCreate(projectName);
     if (agent.state.isStreaming) {
       throw agentBusy(projectName);
@@ -15493,11 +15894,70 @@ var SessionRegistry = class {
     if (preferences?.provider || preferences?.modelId) {
       this.alignModel(projectName, agent, preferences);
     }
+    await this.maybeCompact(projectName, agent);
     return agent;
   }
+  /**
+   * Summarize the oldest half of the transcript into a `compaction:`
+   * memory row when the transcript crosses the token/message threshold.
+   * Runs before the caller's next `agent.prompt()` so the model sees the
+   * trimmed transcript + a refreshed `<memory>` block that now includes
+   * the new summary.
+   *
+   * Races are deduped through `this.compactions`: a concurrent call for
+   * the same project awaits the in-flight promise instead of launching a
+   * duplicate summarizer run. Failures are logged and swallowed — a flaky
+   * summarizer must never block a user turn.
+   */
+  async maybeCompact(projectName, agent) {
+    const inflight = this.compactions.get(projectName);
+    if (inflight) {
+      await inflight;
+      return;
+    }
+    if (!shouldCompact(agent.state.messages)) return;
+    const promise = this.runCompaction(projectName, agent).finally(() => {
+      this.compactions.delete(projectName);
+    });
+    this.compactions.set(projectName, promise);
+    await promise;
+  }
+  async runCompaction(projectName, agent) {
+    const projectId = this.projectIds.get(projectName) ?? this.resolveProjectId(projectName);
+    this.projectIds.set(projectName, projectId);
+    const row = this.loadRow(projectId);
+    if (!row) return;
+    try {
+      const result = await compactMessages({
+        db: this.opts.db,
+        projectId,
+        sessionId: row.id,
+        messages: agent.state.messages,
+        model: agent.state.model,
+        getApiKey: buildApiKeyResolver(this.opts.config)
+      });
+      if (!result) return;
+      agent.state.messages = result.messages;
+      agent.state.systemPrompt = this.buildHydratedSystemPrompt(projectId, row.systemPrompt);
+      this.save(projectName);
+      log7.info("compaction.completed", {
+        projectName,
+        removedCount: result.removedCount,
+        summaryBytes: Buffer.byteLength(result.summary, "utf8")
+      });
+    } catch (err) {
+      log7.error("compaction.failed", {
+        projectName,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
   alignScope(projectName, agent, wantScope) {
     if (this.scopes.get(projectName) === wantScope) return;
-    const stateTools = wantScope === "read-only" ? buildReadTools({ client: this.opts.client, projectName }) : buildAllTools({ client: this.opts.client, projectName });
+    const projectId = this.projectIds.get(projectName) ?? this.resolveProjectId(projectName);
+    this.projectIds.set(projectName, projectId);
+    const toolCtx = { client: this.opts.client, projectName, db: this.opts.db, projectId };
+    const stateTools = wantScope === "read-only" ? buildReadTools(toolCtx) : buildAllTools(toolCtx);
     agent.state.tools = [...stateTools, ...buildSkillDocTools()];
     this.scopes.set(projectName, wantScope);
   }
@@ -15516,7 +15976,7 @@ var SessionRegistry = class {
       modelProvider: nextProvider,
       modelId: nextModelId,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).where(eq23(agentSessions.projectId, projectId)).run();
+    }).where(eq24(agentSessions.projectId, projectId)).run();
   }
   /** Persist a session's transcript back to the DB. Call after any run settles. */
   save(projectName) {
@@ -15573,7 +16033,7 @@ var SessionRegistry = class {
       let agent;
       try {
         const scope = this.scopes.get(projectName) ?? "read-only";
-        agent = this.acquireForTurn(projectName, { toolScope: scope });
+        agent = await this.acquireForTurn(projectName, { toolScope: scope });
       } catch (err) {
         if (err.code === "AGENT_BUSY") return;
         throw err;
@@ -15608,6 +16068,7 @@ var SessionRegistry = class {
     this.live.delete(projectName);
     this.pending.delete(projectName);
     this.scopes.delete(projectName);
+    this.projectIds.delete(projectName);
   }
   /** Evict every live Agent. Durable state in DB is untouched. */
   clear() {
@@ -15677,17 +16138,17 @@ var SessionRegistry = class {
     return id;
   }
   tryResolveProjectId(projectName) {
-    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq23(projects.name, projectName)).get();
+    const row = this.opts.db.select({ id: projects.id }).from(projects).where(eq24(projects.name, projectName)).get();
     return row?.id;
   }
   loadRow(projectId) {
-    const row = this.opts.db.select().from(agentSessions).where(eq23(agentSessions.projectId, projectId)).get();
+    const row = this.opts.db.select().from(agentSessions).where(eq24(agentSessions.projectId, projectId)).get();
     return row ?? null;
   }
   insertRow(params) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.opts.db.insert(agentSessions).values({
-      id: crypto22.randomUUID(),
+      id: crypto23.randomUUID(),
       projectId: params.projectId,
       systemPrompt: params.systemPrompt,
       modelProvider: params.provider ?? params.modelProvider ?? AgentProviderIds.claude,
@@ -15700,14 +16161,14 @@ var SessionRegistry = class {
   }
   updateRow(projectId, patch) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq23(agentSessions.projectId, projectId)).run();
+    this.opts.db.update(agentSessions).set({ ...patch, updatedAt: now }).where(eq24(agentSessions.projectId, projectId)).run();
   }
 };
 
 // src/agent/agent-routes.ts
-import { eq as eq24 } from "drizzle-orm";
+import { eq as eq25 } from "drizzle-orm";
 function resolveProject2(db, name) {
-  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq24(projects.name, name)).get();
+  const row = db.select({ id: projects.id, name: projects.name }).from(projects).where(eq25(projects.name, name)).get();
   if (!row) throw notFound("project", name);
   return row;
 }
@@ -15716,7 +16177,7 @@ function registerAgentRoutes(app, opts) {
     "/projects/:name/agent/transcript",
     async (request) => {
       const project = resolveProject2(opts.db, request.params.name);
-      const row = opts.db.select().from(agentSessions).where(eq24(agentSessions.projectId, project.id)).get();
+      const row = opts.db.select().from(agentSessions).where(eq25(agentSessions.projectId, project.id)).get();
       if (!row) {
         return { messages: [], modelProvider: null, modelId: null, updatedAt: null };
       }
@@ -15740,7 +16201,7 @@ function registerAgentRoutes(app, opts) {
     async (request) => {
       const project = resolveProject2(opts.db, request.params.name);
       opts.sessionRegistry.reset(project.name);
-      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq24(agentSessions.projectId, project.id)).run();
+      opts.db.update(agentSessions).set({ messages: "[]", followUpQueue: "[]", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(agentSessions.projectId, project.id)).run();
       return { status: "reset" };
     }
   );
@@ -15749,7 +16210,7 @@ function registerAgentRoutes(app, opts) {
     const promptText = (request.body?.prompt ?? "").trim();
     if (!promptText) throw validationError('"prompt" is required');
     const requestedScope = request.body?.scope === "all" ? "all" : "read-only";
-    const agent = opts.sessionRegistry.acquireForTurn(project.name, {
+    const agent = await opts.sessionRegistry.acquireForTurn(project.name, {
       provider: request.body?.provider,
       modelId: request.body?.modelId,
       toolScope: requestedScope
@@ -15800,6 +16261,57 @@ function registerAgentRoutes(app, opts) {
     }
     return reply;
   });
+  app.get(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      return { entries: listMemoryEntries(opts.db, project.id) };
+    }
+  );
+  app.put(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const parsed = agentMemoryUpsertRequestSchema.safeParse(request.body);
+      if (!parsed.success) {
+        throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+      }
+      if (parsed.data.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw validationError(
+          `key prefix "${COMPACTION_KEY_PREFIX}" is reserved for compaction notes`
+        );
+      }
+      if (Buffer.byteLength(parsed.data.value, "utf8") > AGENT_MEMORY_VALUE_MAX_BYTES) {
+        throw validationError(`"value" exceeds ${AGENT_MEMORY_VALUE_MAX_BYTES} bytes`);
+      }
+      const entry = upsertMemoryEntry(opts.db, {
+        projectId: project.id,
+        key: parsed.data.key,
+        value: parsed.data.value,
+        source: MemorySources.user
+      });
+      opts.sessionRegistry.rehydrateLiveMemory(project.name);
+      return { status: "ok", entry };
+    }
+  );
+  app.delete(
+    "/projects/:name/agent/memory",
+    async (request) => {
+      const project = resolveProject2(opts.db, request.params.name);
+      const parsed = agentMemoryDeleteRequestSchema.safeParse(request.body);
+      if (!parsed.success) {
+        throw validationError(parsed.error.issues.map((i) => i.message).join("; "));
+      }
+      if (parsed.data.key.startsWith(COMPACTION_KEY_PREFIX)) {
+        throw validationError(
+          `key prefix "${COMPACTION_KEY_PREFIX}" is reserved; compaction notes are pruned automatically`
+        );
+      }
+      const removed = deleteMemoryEntry(opts.db, project.id, parsed.data.key);
+      if (removed) opts.sessionRegistry.rehydrateLiveMemory(project.name);
+      return { status: removed ? "forgotten" : "missing", key: parsed.data.key };
+    }
+  );
 }
 
 // src/client.ts
@@ -15915,6 +16427,26 @@ var ApiClient = class {
       `/projects/${encodeURIComponent(project)}/agent/providers`
     );
   }
+  async listAgentMemory(project) {
+    return this.request(
+      "GET",
+      `/projects/${encodeURIComponent(project)}/agent/memory`
+    );
+  }
+  async setAgentMemory(project, body) {
+    return this.request(
+      "PUT",
+      `/projects/${encodeURIComponent(project)}/agent/memory`,
+      body
+    );
+  }
+  async forgetAgentMemory(project, key) {
+    return this.request(
+      "DELETE",
+      `/projects/${encodeURIComponent(project)}/agent/memory`,
+      { key }
+    );
+  }
   /**
    * POST a request whose response body the caller intends to consume as a
    * stream (e.g. the Aero agent SSE endpoint). Shares the probe + auth +
@@ -17074,7 +17606,7 @@ function summarizeProviderConfig(provider, config) {
   };
 }
 function hashApiKey(key) {
-  return crypto23.createHash("sha256").update(key).digest("hex");
+  return crypto24.createHash("sha256").update(key).digest("hex");
 }
 function parseCookies2(header) {
   if (!header) return {};
@@ -17232,7 +17764,7 @@ async function createServer(opts) {
     intelligenceService,
     (runId, projectId, result) => notifier.dispatchInsightWebhooks(runId, projectId, result),
     async ({ runId, projectId, insightCount, criticalOrHigh }) => {
-      const project = opts.db.select({ name: projects.name }).from(projects).where(eq25(projects.id, projectId)).get();
+      const project = opts.db.select({ name: projects.name }).from(projects).where(eq26(projects.id, projectId)).get();
       if (!project) return;
       sessionRegistry.queueFollowUp(project.name, {
         role: "user",
@@ -17326,7 +17858,7 @@ async function createServer(opts) {
       return removed;
     }
   };
-  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto23.randomBytes(32).toString("hex");
+  const googleStateSecret = process.env.GOOGLE_STATE_SECRET ?? crypto24.randomBytes(32).toString("hex");
   const googleConnectionStore = {
     listConnections: (domain) => listGoogleConnections(opts.config, domain),
     getConnection: (domain, connectionType) => getGoogleConnection(opts.config, domain, connectionType),
@@ -17372,11 +17904,11 @@ async function createServer(opts) {
   const apiPrefix = basePath ? `${basePath}api/v1` : "/api/v1";
   if (opts.config.apiKey) {
     const keyHash = hashApiKey(opts.config.apiKey);
-    const existing = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, keyHash)).get();
+    const existing = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, keyHash)).get();
     if (!existing) {
       const prefix = opts.config.apiKey.slice(0, 12);
       opts.db.insert(apiKeys).values({
-        id: `key_${crypto23.randomBytes(8).toString("hex")}`,
+        id: `key_${crypto24.randomBytes(8).toString("hex")}`,
         name: "default",
         keyHash,
         keyPrefix: prefix,
@@ -17400,7 +17932,7 @@ async function createServer(opts) {
   };
   const createSession = (apiKeyId) => {
     pruneExpiredSessions();
-    const sessionId = crypto23.randomBytes(32).toString("hex");
+    const sessionId = crypto24.randomBytes(32).toString("hex");
     sessions.set(sessionId, {
       apiKeyId,
       expiresAt: Date.now() + SESSION_TTL_MS
@@ -17424,7 +17956,7 @@ async function createServer(opts) {
   };
   const getDefaultApiKey = () => {
     if (!opts.config.apiKey) return void 0;
-    return opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
+    return opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey(opts.config.apiKey))).get();
   };
   const createPasswordSession = (reply) => {
     const key = getDefaultApiKey();
@@ -17481,12 +18013,12 @@ async function createServer(opts) {
       return reply.send({ authenticated: true });
     }
     if (apiKey) {
-      const key = opts.db.select().from(apiKeys).where(eq25(apiKeys.keyHash, hashApiKey(apiKey))).get();
+      const key = opts.db.select().from(apiKeys).where(eq26(apiKeys.keyHash, hashApiKey(apiKey))).get();
       if (!key || key.revokedAt) {
         const err2 = authInvalid();
         return reply.status(err2.statusCode).send(err2.toJSON());
       }
-      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq25(apiKeys.id, key.id)).run();
+      opts.db.update(apiKeys).set({ lastUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq26(apiKeys.id, key.id)).run();
       const sessionId = createSession(key.id);
       reply.header("set-cookie", serializeSessionCookie({
         name: SESSION_COOKIE_NAME,
@@ -17633,7 +18165,7 @@ async function createServer(opts) {
         const targetProjectIds = affectedProjectIds.length > 0 ? affectedProjectIds : [null];
         const createdAt = (/* @__PURE__ */ new Date()).toISOString();
         opts.db.insert(auditLog).values(targetProjectIds.map((projectId) => ({
-          id: crypto23.randomUUID(),
+          id: crypto24.randomUUID(),
           projectId,
           actor: "api",
           action: existing ? "provider.updated" : "provider.created",