@empirical-gauzza/cli 1.0.21 → 1.0.22

package/lib/installers/hooks.js

@@ -643,20 +643,20 @@ try {
 // The message itself is generated per-install from the actual plugin set being installed, not one
 // fixed string for everyone - e.g. someone who declined empirical-scar-tissue at install time
 // never sees a scar-tissue reminder, since that capability isn't actually available to them.
-function buildPromptReminderMessage(pluginNames, platform) {
+function buildPromptReminderMessage(pluginNames, platform) {
   const names = normalizePluginNames(pluginNames);
   const lines = [
     'Before responding: if this task needs prior context (research, debugging, a spec or status update, a handoff), query Empirical memory first via the empirical-memory skill or empirical memory query - do not assume you already have enough context.'
   ];
-  if (names.includes('empirical-work-history')) {
-    lines.push('If you are picking up previously completed work, check for a recent work-history entry before assuming there is none.');
-    // Codex Stop runs after its final response has already been emitted, so it can only be an
-    // advisory reminder. Put the completion gate into the pre-response context instead, where
-    // Codex can still act on it. Keep this Codex-specific: Claude and Copilot have their own
-    // stop-hook control flows and should not receive a changed prompt contract here.
-    if (platform === 'codex') {
-      lines.push('If this turn results in meaningful completed work, BEFORE sending your final response you MUST use the empirical-work-history skill or record it via Empirical. The entry must carry tag work-history and mass 1; verify the create receipt. CLI fallback must use --json-file with data.session and data.git; do not use the shorthand record command for coding work. Do not wait for the Stop hook.');
-    }
+  if (names.includes('empirical-work-history')) {
+    lines.push('If you are picking up previously completed work, check for a recent work-history entry before assuming there is none.');
+    // Codex Stop runs after its final response has already been emitted, so it can only be an
+    // advisory reminder. Put the completion gate into the pre-response context instead, where
+    // Codex can still act on it. Keep this Codex-specific: Claude and Copilot have their own
+    // stop-hook control flows and should not receive a changed prompt contract here.
+    if (platform === 'codex') {
+      lines.push('If this turn results in meaningful completed work, BEFORE sending your final response you MUST use the empirical-work-history skill or record it via Empirical. The entry must carry tag work-history and mass 1; verify the create receipt. CLI fallback must use --json-file with data.session and data.git; do not use the shorthand record command for coding work. Do not wait for the Stop hook.');
+    }
   }
   if (names.includes('empirical-scar-tissue')) {
     lines.push('Check for scar tissue before repeating a past mistake in this area.');
@@ -685,8 +685,8 @@ function buildPromptReminderMessage(pluginNames, platform) {
 //  - default (Claude/Copilot's plain console.log was the old assumption for both - WRONG for
 //    Copilot, which requires valid JSON on stdout for every event, confirmed via the same fetch
 //    above): plain console.log, confirmed correct for Claude only.
-function buildUserPromptSubmitHookSource(pluginNames, platform) {
-  const messageLiteral = JSON.stringify(buildPromptReminderMessage(pluginNames, platform));
+function buildUserPromptSubmitHookSource(pluginNames, platform) {
+  const messageLiteral = JSON.stringify(buildPromptReminderMessage(pluginNames, platform));
 
   let stdinHelper = '';
   let outputStatement;

package/lib/memoryCommands.js

@@ -55,6 +55,7 @@ const MEMORY_SUBCOMMAND_USAGE = {
   merge: 'Usage: empirical memory merge --canonical-id <id> --duplicate-id <id> [--no-merge-tags] [--no-merge-relationships]',
   export: 'Usage: empirical memory export --scope <personal|workspace> [--out <path>] [--workspace-id <id>]',
   import: 'Usage: empirical memory import <file> [--dry-run]',
+  'bulk-import': 'Usage: empirical memory bulk-import <file> [--dry-run]\nFile format: { "memories": [{ "localKey": "...", "category": "...", "nodeType": "...", "summary": "...", "data": {...} }], "relationships": [{ "fromLocalKey": "...", "toLocalKey": "...", "type": "..." }] }',
   stats: 'Usage: empirical memory stats [--format table]',
   compact: 'Usage: empirical memory compact [--apply] [--category <cat>]'
 };
@@ -762,6 +763,53 @@ async function runMemoryImport(args) {
   log(JSON.stringify({ imported, failed, total: memories.length, errors: errors.slice(0, 20) }));
 }
 
+async function runMemoryBulkImport(args) {
+  const filePath = args.find((a) => a && !a.startsWith('--')) || '';
+  const dryRun = parseFlag(args, '--dry-run');
+
+  if (!filePath) {
+    warn('Usage: empirical memory bulk-import <file> [--dry-run]');
+    process.exit(1);
+  }
+
+  let plan;
+  try {
+    plan = JSON.parse(fs.readFileSync(path.resolve(filePath), 'utf8'));
+  } catch (error) {
+    warn(JSON.stringify({ error: true, code: 'json_file_error', message: error.message }));
+    process.exit(1);
+  }
+
+  const memories = Array.isArray(plan && plan.memories) ? plan.memories : null;
+  if (!memories) {
+    warn(JSON.stringify({
+      error: true,
+      code: 'invalid_format',
+      message: 'File must have a top-level "memories" array. See `empirical memory bulk-import --help`.'
+    }));
+    process.exit(1);
+  }
+  const relationships = Array.isArray(plan.relationships) ? plan.relationships : [];
+
+  if (dryRun) {
+    log(JSON.stringify({ dryRun: true, wouldImportMemories: memories.length, wouldImportRelationships: relationships.length }));
+    return;
+  }
+
+  const accessToken = requireAccessToken();
+  const baseUrl = resolveApiBaseUrl();
+  const bulkUrl = new URL('/api/v1/memories/bulk', baseUrl).toString();
+
+  try {
+    const response = await httpJson(bulkUrl, 'POST', { memories, relationships }, buildApiAuthHeaders(accessToken));
+    const data = (response && response.data) ? response.data : response;
+    log(JSON.stringify(data));
+  } catch (error) {
+    printApiError(error);
+    process.exit(1);
+  }
+}
+
 async function runMemoryStats(args) {
   const format = parseOption(args, '--format', 'json');
 
@@ -842,6 +890,7 @@ async function runMemoryCommand(subArgs) {
       if (sub === 'merge') return runMemoryMerge(rest);
       if (sub === 'export') return runMemoryExport(rest);
       if (sub === 'import') return runMemoryImport(rest);
+      if (sub === 'bulk-import') return runMemoryBulkImport(rest);
       if (sub === 'stats') return runMemoryStats(rest);
       if (sub === 'compact') return runMemoryCompact(rest);
 
@@ -867,6 +916,7 @@ module.exports = {
   runMemoryMerge,
   runMemoryExport,
   runMemoryImport,
+  runMemoryBulkImport,
   runMemoryStats,
   runMemoryCompact,
   runMemoryDeleteBulk,

package/lib/oauthClient.js

@@ -1,222 +1,222 @@
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { readJsonIfExists, writeFile, ensureDir } = require('./fsUtils');
-const { getEnv } = require('./env');
-const { runResolvedCommand } = require('./fsUtils');
-
-function getLocalOAuthClientPath() {
-  return path.join(os.homedir(), '.empirical', 'oauth-client.json');
-}
-
-function readStoredOAuthClient() {
-  const stored = readJsonIfExists(getLocalOAuthClientPath());
-  if (!stored || typeof stored !== 'object') return null;
-  const clientId = String(stored.clientId || '').trim();
-  if (!clientId) return null;
-  return {
-    clientId,
-    clientSecret: String(stored.clientSecret || '')
-  };
-}
-
-function writeStoredOAuthClient(clientId, clientSecret) {
-  const payload = {
-    clientId: String(clientId || '').trim(),
-    clientSecret: String(clientSecret || '').trim(),
-    updatedAt: new Date().toISOString()
-  };
-  writeFile(getLocalOAuthClientPath(), `${JSON.stringify(payload, null, 2)}\n`);
-}
-
-function clearStoredOAuthClient() {
-  const storePath = getLocalOAuthClientPath();
-  if (fs.existsSync(storePath)) {
-    fs.unlinkSync(storePath);
-  }
-}
-
-function maskSecret(value) {
-  const raw = String(value || '');
-  if (!raw) return '(not set)';
-  if (raw.length <= 8) return '*'.repeat(raw.length);
-  return `${raw.slice(0, 4)}...${raw.slice(-4)}`;
-}
-
-function generateRandomString(length = 32) {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
-  let result = '';
-  for (let i = 0; i < length; i += 1) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
-}
-
-function base64url(buf) {
-  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-
-function generatePKCE() {
-  const crypto = require('crypto');
-  const codeVerifier = generateRandomString(128);
-  const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
-  return { codeVerifier, codeChallenge };
-}
-
-function decodeJwtPayload(token) {
-  try {
-    const parts = String(token).split('.');
-    if (parts.length !== 3) return null;
-    return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-  } catch (_error) {
-    return null;
-  }
-}
-
-function isJwtToken(token) {
-  return typeof token === 'string' && token.split('.').length === 3;
-}
-
-function isJwtExpired(token, skewSeconds = 30) {
-  const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload.exp !== 'number') return true;
-  return payload.exp < Math.floor(Date.now() / 1000) + skewSeconds;
-}
-
-function getHeadlessTokenPath() {
-  return path.resolve(getEnv('EMPIRICAL_TOKEN_OUTPUT', '.empirical/headless-token.json'));
-}
-
-function getOAuthSessionPath() {
-  return path.join(os.homedir(), '.empirical', 'oauth-session.json');
-}
-
-function readOAuthSession() {
-  const session = readJsonIfExists(getOAuthSessionPath());
-  if (!session || typeof session !== 'object') return null;
-  return session;
-}
-
-function writeOAuthSession(session) {
-  if (!session?.accessToken) return;
-  writeFile(getOAuthSessionPath(), `${JSON.stringify(session, null, 2)}\n`);
-}
-
-function clearOAuthSession() {
-  const sessionPath = getOAuthSessionPath();
-  if (fs.existsSync(sessionPath)) fs.unlinkSync(sessionPath);
-}
-
-function readHeadlessToken() {
-  const tokenPath = getHeadlessTokenPath();
-  if (!fs.existsSync(tokenPath)) return null;
-  try {
-    const parsed = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
-    if (!parsed || typeof parsed !== 'object') {
-      return null;
-    }
-
-    const normalized = { ...parsed };
-    if (!normalized.clientId && normalized.authClientId) {
-      normalized.clientId = normalized.authClientId;
-    }
-    if (!normalized.clientSecret && normalized.authClientSecret) {
-      normalized.clientSecret = normalized.authClientSecret;
-    }
-    if (!normalized.apiKey) {
-      normalized.apiKey = normalized.clientSecret || normalized.authClientSecret || null;
-    }
-    return normalized;
-  } catch (_error) {
-    return null;
-  }
-}
-
-function getAccessTokenExpiryMs(token) {
-  if (!token || !token.accessToken) return 0;
-  const obtainedAtMs = Date.parse(String(token.obtainedAt || ''));
-  const expiresInSeconds = Number(token.expiresIn || 0);
-  if (!Number.isFinite(obtainedAtMs) || !Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    return 0;
-  }
-  return obtainedAtMs + (expiresInSeconds * 1000);
-}
-
-function hasFreshAccessToken(token, skewSeconds = 120) {
-  const expiryMs = getAccessTokenExpiryMs(token);
-  if (!expiryMs) return false;
-  return expiryMs > (Date.now() + (skewSeconds * 1000));
-}
-
-function persistAccessToken(accessToken) {
-  if (!accessToken) return;
-  process.env.EMPIRICAL_ACCESS_TOKEN = accessToken;
-  if (process.platform !== 'win32') {
-    return;
-  }
-  // `setx` writes permanently into the user's Windows environment, surviving
-  // every future shell/process. Only do that for a genuinely permanent
-  // credential (a plain apiKey) — a short-lived session JWT written here
-  // would silently outlive its own expiry and shadow a valid apiKey in the
-  // token file for good, forcing a manual env-var reset roughly every hour.
-  if (isJwtToken(accessToken)) {
-    return;
-  }
-  const escaped = String(accessToken).replace(/\"/g, '""');
-  runResolvedCommand('setx', ['EMPIRICAL_ACCESS_TOKEN', escaped], { stdio: 'ignore' });
-}
-
-function toEnvSafe(value) {
-  return String(value ?? '')
-    .replace(/\\/g, '\\\\')
-    .replace(/\n/g, '\\n')
-    .replace(/\r/g, '\\r')
-    .replace(/"/g, '\\"');
-}
-
-function writeHeadlessEnvFile(result, outputPath) {
-  ensureDir(path.dirname(path.resolve(outputPath)));
-  // Prefer the API key as the access token — it never expires and works as a
-  // permanent Bearer credential with the MCP endpoint.
-  const permanentToken = result.apiKey || result.accessToken;
-  const lines = [
-    '# Generated by empirical cli',
-    `EMPIRICAL_BASE_URL="${toEnvSafe(result.baseUrl)}"`,
-    `EMPIRICAL_ACCESS_TOKEN="${toEnvSafe(permanentToken)}"`,
-    `EMPIRICAL_API_KEY="${toEnvSafe(result.apiKey || '')}"`,
-    `EMPIRICAL_REFRESH_TOKEN="${toEnvSafe(result.refreshToken || '')}"`,
-    `EMPIRICAL_CLIENT_ID="${toEnvSafe(result.clientId || '')}"`,
-    `EMPIRICAL_CLIENT_SECRET="${toEnvSafe(result.clientSecret || '')}"`,
-    `EMPIRICAL_TOKEN_TYPE="${toEnvSafe(result.tokenType || 'Bearer')}"`,
-    `EMPIRICAL_TOKEN_OBTAINED_AT="${toEnvSafe(result.obtainedAt || '')}"`,
-    `EMPIRICAL_TOKEN_EXPIRES_IN="${toEnvSafe(result.expiresIn || '')}"`
-  ];
-  fs.writeFileSync(path.resolve(outputPath), `${lines.join('\n')}\n`, 'utf8');
-}
-
-module.exports = {
-  getLocalOAuthClientPath,
-  readStoredOAuthClient,
-  writeStoredOAuthClient,
-  clearStoredOAuthClient,
-  maskSecret,
-  generateRandomString,
-  base64url,
-  generatePKCE,
-  decodeJwtPayload,
-  isJwtToken,
-  isJwtExpired,
-  getHeadlessTokenPath,
-  getOAuthSessionPath,
-  readOAuthSession,
-  writeOAuthSession,
-  clearOAuthSession,
-  readHeadlessToken,
-  getAccessTokenExpiryMs,
-  hasFreshAccessToken,
-  persistAccessToken,
-  toEnvSafe,
-  writeHeadlessEnvFile
-};
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { readJsonIfExists, writeFile, ensureDir } = require('./fsUtils');
+const { getEnv } = require('./env');
+const { runResolvedCommand } = require('./fsUtils');
+
+function getLocalOAuthClientPath() {
+  return path.join(os.homedir(), '.empirical', 'oauth-client.json');
+}
+
+function readStoredOAuthClient() {
+  const stored = readJsonIfExists(getLocalOAuthClientPath());
+  if (!stored || typeof stored !== 'object') return null;
+  const clientId = String(stored.clientId || '').trim();
+  if (!clientId) return null;
+  return {
+    clientId,
+    clientSecret: String(stored.clientSecret || '')
+  };
+}
+
+function writeStoredOAuthClient(clientId, clientSecret) {
+  const payload = {
+    clientId: String(clientId || '').trim(),
+    clientSecret: String(clientSecret || '').trim(),
+    updatedAt: new Date().toISOString()
+  };
+  writeFile(getLocalOAuthClientPath(), `${JSON.stringify(payload, null, 2)}\n`);
+}
+
+function clearStoredOAuthClient() {
+  const storePath = getLocalOAuthClientPath();
+  if (fs.existsSync(storePath)) {
+    fs.unlinkSync(storePath);
+  }
+}
+
+function maskSecret(value) {
+  const raw = String(value || '');
+  if (!raw) return '(not set)';
+  if (raw.length <= 8) return '*'.repeat(raw.length);
+  return `${raw.slice(0, 4)}...${raw.slice(-4)}`;
+}
+
+function generateRandomString(length = 32) {
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+  let result = '';
+  for (let i = 0; i < length; i += 1) {
+    result += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return result;
+}
+
+function base64url(buf) {
+  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+
+function generatePKCE() {
+  const crypto = require('crypto');
+  const codeVerifier = generateRandomString(128);
+  const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
+  return { codeVerifier, codeChallenge };
+}
+
+function decodeJwtPayload(token) {
+  try {
+    const parts = String(token).split('.');
+    if (parts.length !== 3) return null;
+    return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+  } catch (_error) {
+    return null;
+  }
+}
+
+function isJwtToken(token) {
+  return typeof token === 'string' && token.split('.').length === 3;
+}
+
+function isJwtExpired(token, skewSeconds = 30) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.exp !== 'number') return true;
+  return payload.exp < Math.floor(Date.now() / 1000) + skewSeconds;
+}
+
+function getHeadlessTokenPath() {
+  return path.resolve(getEnv('EMPIRICAL_TOKEN_OUTPUT', '.empirical/headless-token.json'));
+}
+
+function getOAuthSessionPath() {
+  return path.join(os.homedir(), '.empirical', 'oauth-session.json');
+}
+
+function readOAuthSession() {
+  const session = readJsonIfExists(getOAuthSessionPath());
+  if (!session || typeof session !== 'object') return null;
+  return session;
+}
+
+function writeOAuthSession(session) {
+  if (!session?.accessToken) return;
+  writeFile(getOAuthSessionPath(), `${JSON.stringify(session, null, 2)}\n`);
+}
+
+function clearOAuthSession() {
+  const sessionPath = getOAuthSessionPath();
+  if (fs.existsSync(sessionPath)) fs.unlinkSync(sessionPath);
+}
+
+function readHeadlessToken() {
+  const tokenPath = getHeadlessTokenPath();
+  if (!fs.existsSync(tokenPath)) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object') {
+      return null;
+    }
+
+    const normalized = { ...parsed };
+    if (!normalized.clientId && normalized.authClientId) {
+      normalized.clientId = normalized.authClientId;
+    }
+    if (!normalized.clientSecret && normalized.authClientSecret) {
+      normalized.clientSecret = normalized.authClientSecret;
+    }
+    if (!normalized.apiKey) {
+      normalized.apiKey = normalized.clientSecret || normalized.authClientSecret || null;
+    }
+    return normalized;
+  } catch (_error) {
+    return null;
+  }
+}
+
+function getAccessTokenExpiryMs(token) {
+  if (!token || !token.accessToken) return 0;
+  const obtainedAtMs = Date.parse(String(token.obtainedAt || ''));
+  const expiresInSeconds = Number(token.expiresIn || 0);
+  if (!Number.isFinite(obtainedAtMs) || !Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
+    return 0;
+  }
+  return obtainedAtMs + (expiresInSeconds * 1000);
+}
+
+function hasFreshAccessToken(token, skewSeconds = 120) {
+  const expiryMs = getAccessTokenExpiryMs(token);
+  if (!expiryMs) return false;
+  return expiryMs > (Date.now() + (skewSeconds * 1000));
+}
+
+function persistAccessToken(accessToken) {
+  if (!accessToken) return;
+  process.env.EMPIRICAL_ACCESS_TOKEN = accessToken;
+  if (process.platform !== 'win32') {
+    return;
+  }
+  // `setx` writes permanently into the user's Windows environment, surviving
+  // every future shell/process. Only do that for a genuinely permanent
+  // credential (a plain apiKey) — a short-lived session JWT written here
+  // would silently outlive its own expiry and shadow a valid apiKey in the
+  // token file for good, forcing a manual env-var reset roughly every hour.
+  if (isJwtToken(accessToken)) {
+    return;
+  }
+  const escaped = String(accessToken).replace(/\"/g, '""');
+  runResolvedCommand('setx', ['EMPIRICAL_ACCESS_TOKEN', escaped], { stdio: 'ignore' });
+}
+
+function toEnvSafe(value) {
+  return String(value ?? '')
+    .replace(/\\/g, '\\\\')
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/"/g, '\\"');
+}
+
+function writeHeadlessEnvFile(result, outputPath) {
+  ensureDir(path.dirname(path.resolve(outputPath)));
+  // Prefer the API key as the access token — it never expires and works as a
+  // permanent Bearer credential with the MCP endpoint.
+  const permanentToken = result.apiKey || result.accessToken;
+  const lines = [
+    '# Generated by empirical cli',
+    `EMPIRICAL_BASE_URL="${toEnvSafe(result.baseUrl)}"`,
+    `EMPIRICAL_ACCESS_TOKEN="${toEnvSafe(permanentToken)}"`,
+    `EMPIRICAL_API_KEY="${toEnvSafe(result.apiKey || '')}"`,
+    `EMPIRICAL_REFRESH_TOKEN="${toEnvSafe(result.refreshToken || '')}"`,
+    `EMPIRICAL_CLIENT_ID="${toEnvSafe(result.clientId || '')}"`,
+    `EMPIRICAL_CLIENT_SECRET="${toEnvSafe(result.clientSecret || '')}"`,
+    `EMPIRICAL_TOKEN_TYPE="${toEnvSafe(result.tokenType || 'Bearer')}"`,
+    `EMPIRICAL_TOKEN_OBTAINED_AT="${toEnvSafe(result.obtainedAt || '')}"`,
+    `EMPIRICAL_TOKEN_EXPIRES_IN="${toEnvSafe(result.expiresIn || '')}"`
+  ];
+  fs.writeFileSync(path.resolve(outputPath), `${lines.join('\n')}\n`, 'utf8');
+}
+
+module.exports = {
+  getLocalOAuthClientPath,
+  readStoredOAuthClient,
+  writeStoredOAuthClient,
+  clearStoredOAuthClient,
+  maskSecret,
+  generateRandomString,
+  base64url,
+  generatePKCE,
+  decodeJwtPayload,
+  isJwtToken,
+  isJwtExpired,
+  getHeadlessTokenPath,
+  getOAuthSessionPath,
+  readOAuthSession,
+  writeOAuthSession,
+  clearOAuthSession,
+  readHeadlessToken,
+  getAccessTokenExpiryMs,
+  hasFreshAccessToken,
+  persistAccessToken,
+  toEnvSafe,
+  writeHeadlessEnvFile
+};