@cmetech/otto 1.1.1 → 1.2.5

package/packages/coworker-memory/src/local-sqlite-backend.test.ts

@@ -0,0 +1,110 @@
+// packages/coworker-memory/src/local-sqlite-backend.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { LocalSqliteBackend } from './local-sqlite-backend.js';
+
+function tmp(): string { return mkdtempSync(join(tmpdir(), 'lb-')); }
+
+describe('LocalSqliteBackend', () => {
+  it('bootstraps schema and is ready', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    const st = await be.status();
+    assert.equal(st.ready, true);
+    assert.equal(st.drawer_count, 0);
+    assert.equal(st.schema_version, 2);
+    await be.close();
+  });
+  it('retain + recall round-trip; result includes snippet with <mark>', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    await be.retain({ wing: 'global', room: 'inbox', kind: 'paste',
+      content: 'customer said the load balancer started returning 503s around 14:00 UTC',
+      metadata: {}, redacted: false });
+    const results = await be.recall({ query: 'load balancer' });
+    assert.equal(results.length, 1);
+    assert.equal(results[0]!.drawer.kind, 'paste');
+    assert.match(results[0]!.snippet, /<mark>load<\/mark>/);
+    assert.ok(results[0]!.score > 0);
+    await be.close();
+  });
+  it('filters by wing, room, kind, days_back', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    await be.retain({ wing: 'a', room: 'r1', kind: 'turn', content: 'red apples', metadata: {}, redacted: false });
+    await be.retain({ wing: 'b', room: 'r2', kind: 'paste', content: 'red apples', metadata: {}, redacted: false });
+    const filteredWing = await be.recall({ query: 'apples', wing: 'a' });
+    assert.equal(filteredWing.length, 1);
+    assert.equal(filteredWing[0]!.drawer.wing, 'a');
+    const filteredKind = await be.recall({ query: 'apples', kind: 'paste' });
+    assert.equal(filteredKind.length, 1);
+    assert.equal(filteredKind[0]!.drawer.kind, 'paste');
+    await be.close();
+  });
+  it('escapes FTS5 special characters in query', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    await be.retain({ wing: 'g', room: 'r', kind: 'note', content: 'CIDR is 10.0.0.0/24', metadata: {}, redacted: false });
+    const r = await be.recall({ query: '10.0.0.0/24 "AND" *' });   // would otherwise blow up
+    assert.equal(r.length, 1);
+    await be.close();
+  });
+  it('listWings + listRooms reflect inserted data', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    await be.retain({ wing: 'w1', room: 'r1', kind: 'turn', content: 'a', metadata: {}, redacted: false });
+    await be.retain({ wing: 'w2', room: 'r2', kind: 'turn', content: 'b', metadata: {}, redacted: false });
+    assert.deepEqual((await be.listWings()).sort(), ['w1', 'w2']);
+    assert.deepEqual(await be.listRooms('w1'), ['r1']);
+    await be.close();
+  });
+  it('clear({wing}) deletes only that wing\'s drawers', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    await be.retain({ wing: 'w1', room: 'r1', kind: 'turn', content: 'a', metadata: {}, redacted: false });
+    await be.retain({ wing: 'w2', room: 'r2', kind: 'turn', content: 'b', metadata: {}, redacted: false });
+    const out = await be.clear({ wing: 'w1', confirm: true });
+    assert.equal(out.deleted, 1);
+    assert.deepEqual(await be.listWings(), ['w2']);
+    await be.close();
+  });
+  it('retain preserves redacted flag', async () => {
+    const dir = tmp();
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    const d = await be.retain({ wing: 'g', room: 'r', kind: 'paste', content: 'x [REDACTED:aws_access_key_id] y', metadata: {}, redacted: true });
+    assert.equal(d.redacted, true);
+    const r = await be.recall({ query: 'REDACTED' });
+    assert.equal(r[0]!.drawer.redacted, true);
+    await be.close();
+  });
+});
+
+describe('Local backend migrations (Phase 4 Task 8)', () => {
+  it('migration 002 lets us insert kind:artifact', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'be-mig-'));
+    const be = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+    await be.open();
+    const st = await be.status();
+    assert.equal(st.schema_version, 2);
+    const drawer = await be.retain({
+      wing: 'g', room: 'r', kind: 'artifact',
+      content: JSON.stringify({ slug: 'rca-1', kind: 'report', uri: 'artifact://rca-1' }),
+      metadata: { scratchpad: 'p1' }, redacted: false,
+    });
+    assert.equal(drawer.kind, 'artifact');
+    const r = await be.recall({ query: 'rca', kind: 'artifact' });
+    assert.equal(r.length, 1);
+    assert.equal(r[0]!.drawer.kind, 'artifact');
+    await be.close();
+  });
+});

package/packages/coworker-memory/src/local-sqlite-backend.ts

@@ -0,0 +1,185 @@
+// packages/coworker-memory/src/local-sqlite-backend.ts
+import Database, { type Database as DB } from 'better-sqlite3';
+import { readFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { v4 as uuid } from 'uuid';
+import type { MemoryBackend } from './memory-backend.js';
+import type { Drawer, RecallQuery, RecallResult, BackendStatus, Wing, Room } from './types.js';
+import { RecallQueryMalformed, BackendUnavailable } from './errors.js';
+
+export interface LocalSqliteBackendOptions {
+  dbPath: string;
+  now?: () => string;
+  busyTimeoutMs?: number;
+}
+
+function migrationDir(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), 'migrations');
+}
+
+function escapeFts5(q: string): string {
+  // Wrap each word containing special chars in double quotes; doubled internal quotes.
+  // Empty query → throw upstream.
+  const tokens = q.match(/\S+/g) ?? [];
+  return tokens.map(t => `"${t.replace(/"/g, '""')}"`).join(' OR ');
+}
+
+export class LocalSqliteBackend implements MemoryBackend {
+  private db: DB | null = null;
+  private readonly path: string;
+  private readonly now: () => string;
+  private readonly busyTimeoutMs: number;
+
+  constructor(opts: LocalSqliteBackendOptions) {
+    this.path = opts.dbPath;
+    this.now = opts.now ?? (() => new Date().toISOString());
+    this.busyTimeoutMs = opts.busyTimeoutMs ?? 2000;
+  }
+
+  async open(): Promise<void> {
+    if (this.db) return;
+    mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+    try {
+      this.db = new Database(this.path);
+      this.db.pragma(`busy_timeout = ${this.busyTimeoutMs}`);
+      const dir = migrationDir();
+      const migrations = [
+        { version: 1, file: '001-init.sql' },
+        { version: 2, file: '002-artifact-kind.sql' },
+      ];
+      const userVersion = this.db.pragma('user_version', { simple: true }) as number;
+      for (const m of migrations) {
+        if (userVersion < m.version) {
+          const sql = readFileSync(join(dir, m.file), 'utf8');
+          this.db.exec(sql);
+        }
+      }
+    } catch (err) {
+      throw new BackendUnavailable(`open failed: ${(err as Error).message}`);
+    }
+  }
+
+  async close(): Promise<void> {
+    this.db?.close();
+    this.db = null;
+  }
+
+  private requireDb(): DB {
+    if (!this.db) throw new BackendUnavailable('not opened');
+    return this.db;
+  }
+
+  async retain(input: Omit<Drawer, 'id' | 'created_at'>): Promise<Drawer> {
+    const db = this.requireDb();
+    const id = uuid();
+    const created_at = this.now();
+    const stmt = db.prepare(`
+      INSERT INTO drawers (id, wing, room, kind, content, metadata_json, parent_id, redacted, created_at)
+      VALUES (@id, @wing, @room, @kind, @content, @metadata_json, @parent_id, @redacted, @created_at)
+    `);
+    stmt.run({
+      id, wing: input.wing, room: input.room, kind: input.kind, content: input.content,
+      metadata_json: JSON.stringify(input.metadata ?? {}),
+      parent_id: input.parent_id ?? null,
+      redacted: input.redacted ? 1 : 0,
+      created_at,
+    });
+    return { id, created_at, ...input };
+  }
+
+  async recall(query: RecallQuery): Promise<RecallResult[]> {
+    if (!query.query || !query.query.trim()) throw new RecallQueryMalformed('empty query');
+    const db = this.requireDb();
+    const matchExpr = escapeFts5(query.query.trim());
+    const conditions: string[] = ['drawers_fts MATCH ?'];
+    const params: unknown[] = [matchExpr];
+
+    if (query.wing) {
+      if (Array.isArray(query.wing)) {
+        conditions.push(`d.wing IN (${query.wing.map(() => '?').join(',')})`);
+        params.push(...query.wing);
+      } else {
+        conditions.push('d.wing = ?');
+        params.push(query.wing);
+      }
+    }
+    if (query.room) { conditions.push('d.room = ?'); params.push(query.room); }
+    if (query.kind) {
+      const kinds = Array.isArray(query.kind) ? query.kind : [query.kind];
+      conditions.push(`d.kind IN (${kinds.map(() => '?').join(',')})`);
+      params.push(...kinds);
+    }
+    if (query.days_back && query.days_back > 0) {
+      const cutoff = new Date(Date.now() - query.days_back * 86400_000).toISOString();
+      conditions.push('d.created_at >= ?');
+      params.push(cutoff);
+    }
+    const limit = Math.min(Math.max(query.max_results ?? 8, 1), 64);
+    params.push(limit);
+
+    const sql = `
+      SELECT d.id, d.wing, d.room, d.kind, d.content, d.metadata_json, d.parent_id, d.redacted, d.created_at,
+             bm25(drawers_fts) AS rank,
+             snippet(drawers_fts, 0, '<mark>', '</mark>', '...', 16) AS snippet
+      FROM drawers_fts
+      JOIN drawers d ON d.rowid = drawers_fts.rowid
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY rank
+      LIMIT ?
+    `;
+    const rows = db.prepare(sql).all(...params) as Array<{
+      id: string; wing: string; room: string; kind: Drawer['kind']; content: string;
+      metadata_json: string; parent_id: string | null; redacted: number; created_at: string;
+      rank: number; snippet: string;
+    }>;
+    return rows.map(r => ({
+      drawer: {
+        id: r.id, wing: r.wing, room: r.room, kind: r.kind, content: r.content,
+        metadata: JSON.parse(r.metadata_json) as Record<string, unknown>,
+        parent_id: r.parent_id ?? undefined, redacted: r.redacted === 1,
+        created_at: r.created_at,
+      },
+      score: -r.rank, // BM25 lower=better in sqlite; invert for descending
+      snippet: r.snippet,
+    }));
+  }
+
+  async listRooms(wing?: Wing): Promise<Room[]> {
+    const db = this.requireDb();
+    const sql = wing
+      ? `SELECT DISTINCT room FROM drawers WHERE wing = ? ORDER BY room`
+      : `SELECT DISTINCT room FROM drawers ORDER BY room`;
+    const rows = wing ? db.prepare(sql).all(wing) : db.prepare(sql).all();
+    return (rows as Array<{ room: string }>).map(r => r.room);
+  }
+
+  async listWings(): Promise<Wing[]> {
+    const db = this.requireDb();
+    const rows = db.prepare(`SELECT DISTINCT wing FROM drawers ORDER BY wing`).all() as Array<{ wing: string }>;
+    return rows.map(r => r.wing);
+  }
+
+  async status(): Promise<BackendStatus> {
+    const db = this.requireDb();
+    const { c } = db.prepare(`SELECT COUNT(*) AS c FROM drawers`).get() as { c: number };
+    const { user_version } = db.prepare(`PRAGMA user_version`).get() as { user_version: number };
+    return {
+      ready: true,
+      workspace_wing: '',  // caller (memory-singleton) overlays this from scope info
+      drawer_count: c,
+      layer_b_db_path: this.path,
+      schema_version: user_version,
+    };
+  }
+
+  async clear(args: { wing?: Wing; confirm: true }): Promise<{ deleted: number }> {
+    if (args.confirm !== true) throw new RecallQueryMalformed('confirm must be true');
+    const db = this.requireDb();
+    const stmt = args.wing
+      ? db.prepare(`DELETE FROM drawers WHERE wing = ?`)
+      : db.prepare(`DELETE FROM drawers`);
+    const result = args.wing ? stmt.run(args.wing) : stmt.run();
+    return { deleted: result.changes };
+  }
+}

package/packages/coworker-memory/src/memory-backend.ts

@@ -0,0 +1,10 @@
+import type { Drawer, RecallQuery, RecallResult, BackendStatus, Wing, Room } from './types.js';
+
+export interface MemoryBackend {
+  recall(query: RecallQuery): Promise<RecallResult[]>;
+  retain(input: Omit<Drawer, 'id' | 'created_at'>): Promise<Drawer>;
+  listRooms(wing?: Wing): Promise<Room[]>;
+  listWings(): Promise<Wing[]>;
+  status(): Promise<BackendStatus>;
+  clear(args: { wing?: Wing; confirm: true }): Promise<{ deleted: number }>;
+}

package/packages/coworker-memory/src/memory-integration.test.ts

@@ -0,0 +1,89 @@
+// packages/coworker-memory/src/memory-integration.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createMemoryBundle } from '../../../src/resources/extensions/coworker-memory/memory-singleton.js';
+import { runMemorize } from '../../../src/resources/extensions/coworker-memory/memorize-tool.js';
+import { runRecall } from '../../../src/resources/extensions/coworker-memory/recall-tool.js';
+import { onSessionStart, onSessionShutdown } from '../../../src/resources/extensions/coworker-memory/session-hooks.js';
+
+describe('Memory integration — Day-2 verbatim recall', () => {
+  it('paste Monday → recall Tuesday in a fresh session', async () => {
+    const homeMon = mkdtempSync(join(tmpdir(), 'mem-home-mon-'));
+    const ws = mkdtempSync(join(tmpdir(), 'mem-ws-mon-'));
+    mkdirSync(ws, { recursive: true });
+
+    // ===== MONDAY =====
+    const monBundle = await createMemoryBundle({
+      globalDir: homeMon, workspaceDir: ws,
+      scopeMode: 'per-project-tagged',
+      currentScratchpadName: () => 'p1-1234',
+    });
+    await monBundle.recorder.recordPaste({
+      sessionId: 'sess-mon',
+      content: 'customer says the load balancer started returning 503s around 14:00 UTC; the on-call escalated to the network team at 14:18',
+      turnId: 't1',
+    });
+    await onSessionShutdown(monBundle);
+
+    // Simulate a different Otto process by re-creating the bundle with the same workspace.
+    // ===== TUESDAY =====
+    const tueBundle = await createMemoryBundle({
+      globalDir: homeMon /* same as Monday */, workspaceDir: ws,
+      scopeMode: 'per-project-tagged',
+      currentScratchpadName: () => null,
+    });
+    const start = await onSessionStart(tueBundle, { tokenLimit: 3000 });
+    // Layer A was empty Monday, so the inject is empty on Tuesday.
+    assert.equal(start.contextBlock, '');
+    const r = await runRecall(tueBundle, { query: 'load balancer' });
+    assert.equal(r.results.length, 1);
+    assert.match(r.results[0]!.drawer.content, /load balancer started returning 503s around 14:00 UTC/);
+    assert.equal(r.results[0]!.drawer.room, 'p1-1234');
+    assert.match(r.markdown, /drawer:\/\//);
+    await onSessionShutdown(tueBundle);
+  });
+  it('memorize lessons → next session_start injects them', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'mem-home-A-'));
+    const ws = mkdtempSync(join(tmpdir(), 'mem-ws-A-'));
+    mkdirSync(ws, { recursive: true });
+    const b1 = await createMemoryBundle({
+      globalDir: home, workspaceDir: ws,
+      scopeMode: 'per-project-tagged', currentScratchpadName: () => null,
+    });
+    await runMemorize(b1, { text: 'MTTR target is 30 minutes for P1', kind: 'lesson' });
+    await runMemorize(b1, { text: 'Always escalate to mgr within 5 min on customer-facing P1', kind: 'rule' });
+    await onSessionShutdown(b1);
+
+    const b2 = await createMemoryBundle({
+      globalDir: home, workspaceDir: ws,
+      scopeMode: 'per-project-tagged', currentScratchpadName: () => null,
+    });
+    const start = await onSessionStart(b2, { tokenLimit: 3000 });
+    assert.match(start.contextBlock, /MTTR target is 30 minutes/);
+    assert.match(start.contextBlock, /Always escalate to mgr/);
+    await onSessionShutdown(b2);
+  });
+  it('secret in paste is redacted; recall surrounding context still works', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'mem-home-B-'));
+    const ws = mkdtempSync(join(tmpdir(), 'mem-ws-B-'));
+    mkdirSync(ws, { recursive: true });
+    const b = await createMemoryBundle({
+      globalDir: home, workspaceDir: ws,
+      scopeMode: 'per-project-tagged', currentScratchpadName: () => null,
+    });
+    await b.recorder.recordPaste({
+      sessionId: 's',
+      content: 'login token AKIAABCDEFGHIJKLMNOP, used for Datadog API',
+      turnId: 't',
+    });
+    const r = await runRecall(b, { query: 'Datadog' });
+    assert.equal(r.results.length, 1);
+    assert.match(r.results[0]!.drawer.content, /\[REDACTED:aws_access_key_id\]/);
+    assert.equal(r.results[0]!.drawer.content.includes('AKIAABCDEFGHIJKLMNOP'), false);
+    assert.equal(r.results[0]!.drawer.redacted, true);
+    await onSessionShutdown(b);
+  });
+});

package/packages/coworker-memory/src/memory-recorder.test.ts

@@ -0,0 +1,101 @@
+// packages/coworker-memory/src/memory-recorder.test.ts
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { AuditLog, SecretScanner } from '@otto/coworker-utils';
+import { LocalSqliteBackend } from './local-sqlite-backend.js';
+import { MemoryRecorder } from './memory-recorder.js';
+
+async function ctx() {
+  const dir = mkdtempSync(join(tmpdir(), 'mr-'));
+  const audit = new AuditLog({ path: join(dir, 'audit.jsonl') });
+  const scanner = new SecretScanner();
+  const backend = new LocalSqliteBackend({ dbPath: join(dir, 'layer-b.db') });
+  await backend.open();
+  return { dir, audit, scanner, backend };
+}
+
+describe('MemoryRecorder', () => {
+  it('recordTurn writes kind:turn drawer for short text', async () => {
+    const c = await ctx();
+    const recorder = new MemoryRecorder({
+      backend: c.backend, scanner: c.scanner, audit: c.audit,
+      writeWing: 'global', currentScratchpadName: () => null,
+    });
+    await recorder.recordTurn({ sessionId: 's', userText: 'hi', turnId: 't1' });
+    const wings = await c.backend.listWings();
+    assert.deepEqual(wings, ['global']);
+    const rooms = await c.backend.listRooms('global');
+    assert.deepEqual(rooms, ['inbox']);
+    await c.backend.close();
+  });
+  it('recordTurn writes kind:paste drawer for long text', async () => {
+    const c = await ctx();
+    const recorder = new MemoryRecorder({
+      backend: c.backend, scanner: c.scanner, audit: c.audit,
+      writeWing: 'global', currentScratchpadName: () => 'p1',
+    });
+    // Use whitespace-separated tokens so FTS5 can index/match (single huge token wouldn't match 'x').
+    const longText = 'lorem ipsum '.repeat(60); // > 500 chars, tokenizable
+    await recorder.recordTurn({ sessionId: 's', userText: longText, turnId: 't1' });
+    const r = await c.backend.recall({ query: 'lorem' });
+    assert.equal(r[0]!.drawer.kind, 'paste');
+    assert.equal(r[0]!.drawer.room, 'p1');
+    await c.backend.close();
+  });
+  it('redacts secret content and sets redacted=true', async () => {
+    const c = await ctx();
+    const recorder = new MemoryRecorder({
+      backend: c.backend, scanner: c.scanner, audit: c.audit,
+      writeWing: 'global', currentScratchpadName: () => null,
+    });
+    await recorder.recordPaste({ sessionId: 's', content: 'token AKIAABCDEFGHIJKLMNOP', turnId: 't1' });
+    const r = await c.backend.recall({ query: 'token' });
+    assert.equal(r[0]!.drawer.redacted, true);
+    assert.match(r[0]!.drawer.content, /\[REDACTED:aws_access_key_id\]/);
+    const rows: { action: string }[] = [];
+    for await (const x of c.audit.read({ producer: 'memory', action: 'redact' })) rows.push(x as never);
+    assert.equal(rows.length, 1);
+    await c.backend.close();
+  });
+  it('recordFileLoad stores structured JSON in content', async () => {
+    const c = await ctx();
+    const recorder = new MemoryRecorder({
+      backend: c.backend, scanner: c.scanner, audit: c.audit,
+      writeWing: 'global', currentScratchpadName: () => 'p1',
+    });
+    await recorder.recordFileLoad({
+      scratchpadName: 'p1', collector: 'file', uri: 'file:///x.csv',
+      bytes: 1000, rows_loaded: 50, schema: { cols: ['a','b'] }, turnId: 't1',
+    });
+    const r = await c.backend.recall({ query: 'file' });
+    assert.equal(r[0]!.drawer.kind, 'file_load');
+    const parsed = JSON.parse(r[0]!.drawer.content);
+    assert.equal(parsed.uri, 'file:///x.csv');
+    assert.equal(parsed.rows_loaded, 50);
+    await c.backend.close();
+  });
+});
+
+describe('MemoryRecorder.recordArtifact (Phase 4 Task 8)', () => {
+  it('writes a kind:artifact drawer with slug/kind/uri JSON content', async () => {
+    const c = await ctx();
+    const recorder = new MemoryRecorder({
+      backend: c.backend, scanner: c.scanner, audit: c.audit,
+      writeWing: 'global', currentScratchpadName: () => null,
+    });
+    await recorder.recordArtifact({
+      scratchpadName: 'p1', slug: 'rca-1', kind: 'report',
+      uri: 'artifact://rca-1', turnId: 't1',
+    });
+    const r = await c.backend.recall({ query: 'rca', kind: 'artifact' });
+    assert.equal(r.length, 1);
+    const parsed = JSON.parse(r[0]!.drawer.content);
+    assert.equal(parsed.slug, 'rca-1');
+    assert.equal(parsed.uri, 'artifact://rca-1');
+    assert.equal(r[0]!.drawer.room, 'p1');
+    await c.backend.close();
+  });
+});

package/packages/coworker-memory/src/memory-recorder.ts

@@ -0,0 +1,95 @@
+// packages/coworker-memory/src/memory-recorder.ts
+import { AuditLog, SecretScanner } from '@otto/coworker-utils';
+import type { MemoryBackend } from './memory-backend.js';
+import type { Wing, Room, Drawer } from './types.js';
+import { detectPaste } from './paste-detector.js';
+
+export interface CurrentScratchpadProvider {
+  (sessionId: string): string | null;
+}
+
+export interface MemoryRecorderOptions {
+  backend: MemoryBackend;
+  scanner: SecretScanner;
+  audit: AuditLog;
+  writeWing: Wing;
+  currentScratchpadName: CurrentScratchpadProvider;
+  pasteOptions?: { lengthThreshold?: number; newlineThreshold?: number };
+}
+
+export class MemoryRecorder {
+  constructor(private readonly opts: MemoryRecorderOptions) {}
+
+  async recordTurn(args: { sessionId: string; userText: string; turnId: string; room?: Room }): Promise<Drawer> {
+    const kind = detectPaste(args.userText, this.opts.pasteOptions);
+    const room = args.room ?? this.opts.currentScratchpadName(args.sessionId) ?? 'inbox';
+    return this.writeDrawer({
+      wing: this.opts.writeWing, room, kind,
+      content: args.userText, metadata: { turn_id: args.turnId, session_id: args.sessionId },
+    });
+  }
+
+  async recordPaste(args: { sessionId: string; content: string; turnId: string; room?: Room }): Promise<Drawer> {
+    const room = args.room ?? this.opts.currentScratchpadName(args.sessionId) ?? 'inbox';
+    return this.writeDrawer({
+      wing: this.opts.writeWing, room, kind: 'paste',
+      content: args.content, metadata: { turn_id: args.turnId, session_id: args.sessionId },
+    });
+  }
+
+  async recordFileLoad(args: {
+    scratchpadName: string; collector: string; uri: string;
+    bytes: number; rows_loaded?: number; schema?: object; turnId: string;
+  }): Promise<Drawer> {
+    const content = JSON.stringify({
+      collector: args.collector, uri: args.uri, bytes: args.bytes,
+      rows_loaded: args.rows_loaded, schema: args.schema,
+    });
+    return this.writeDrawer({
+      wing: this.opts.writeWing, room: args.scratchpadName, kind: 'file_load',
+      content, metadata: { turn_id: args.turnId, scratchpad: args.scratchpadName },
+    });
+  }
+
+  async recordArtifact(args: {
+    scratchpadName: string; slug: string; kind: string; uri: string;
+    turnId: string;
+  }): Promise<Drawer> {
+    const content = JSON.stringify({
+      slug: args.slug, kind: args.kind, uri: args.uri,
+    });
+    return this.writeDrawer({
+      wing: this.opts.writeWing, room: args.scratchpadName, kind: 'artifact',
+      content, metadata: { turn_id: args.turnId, scratchpad: args.scratchpadName },
+    });
+  }
+
+  private async writeDrawer(input: Omit<Drawer, 'id' | 'created_at' | 'redacted'>): Promise<Drawer> {
+    const hits = this.opts.scanner.scan(input.content);
+    let content = input.content;
+    let redacted = false;
+    if (hits.length > 0) {
+      content = this.opts.scanner.redact(input.content);
+      redacted = true;
+      const ts = new Date().toISOString();
+      for (const h of hits) {
+        this.opts.audit.append({
+          _schema: 1, ts, producer: 'memory', action: 'redact', severity: 'warn',
+          detail: {
+            wing: input.wing, room: input.room, kind: input.kind,
+            secret_kind: h.kind, offset: h.start, length: h.end - h.start,
+          },
+        });
+      }
+    }
+    const drawer = await this.opts.backend.retain({ ...input, content, redacted });
+    this.opts.audit.append({
+      _schema: 1, ts: new Date().toISOString(), producer: 'memory', action: 'write-drawer',
+      detail: {
+        wing: drawer.wing, room: drawer.room, kind: drawer.kind,
+        byte_count: Buffer.byteLength(content, 'utf8'), redacted,
+      },
+    });
+    return drawer;
+  }
+}

package/packages/coworker-memory/src/migrations/001-init.sql

@@ -0,0 +1,38 @@
+-- packages/coworker-memory/src/migrations/001-init.sql
+PRAGMA journal_mode = WAL;
+PRAGMA user_version = 1;
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS drawers (
+  id TEXT PRIMARY KEY,
+  wing TEXT NOT NULL,
+  room TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('turn','paste','file_load','ticket','email','rca','note')),
+  content TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  parent_id TEXT REFERENCES drawers(id) ON DELETE SET NULL,
+  redacted INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_drawers_wing_room ON drawers (wing, room);
+CREATE INDEX IF NOT EXISTS idx_drawers_kind ON drawers (kind);
+CREATE INDEX IF NOT EXISTS idx_drawers_created_at ON drawers (created_at);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS drawers_fts USING fts5 (
+  content,
+  content='drawers',
+  content_rowid='rowid',
+  tokenize='unicode61 remove_diacritics 2'
+);
+
+CREATE TRIGGER IF NOT EXISTS drawers_ai AFTER INSERT ON drawers BEGIN
+  INSERT INTO drawers_fts (rowid, content) VALUES (new.rowid, new.content);
+END;
+CREATE TRIGGER IF NOT EXISTS drawers_ad AFTER DELETE ON drawers BEGIN
+  INSERT INTO drawers_fts (drawers_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+END;
+CREATE TRIGGER IF NOT EXISTS drawers_au AFTER UPDATE ON drawers BEGIN
+  INSERT INTO drawers_fts (drawers_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+  INSERT INTO drawers_fts (rowid, content) VALUES (new.rowid, new.content);
+END;