@iamem/amem 0.1.0

package/dist/attest.d.ts

@@ -0,0 +1,52 @@
+import { type LoadedPolicy } from "./policy.js";
+import { licenseStatus } from "./license.js";
+import { embedStatus } from "./embed.js";
+import { vaultStatus } from "./vault.js";
+export type AttestReport = {
+    tool: "amem";
+    version: string;
+    package_integrity: {
+        package_json_sha256: string | null;
+    };
+    attested_at: string;
+    privacy: {
+        telemetry: false;
+        network_egress: "none";
+        ui_bind: string;
+        ui_enabled: boolean;
+        memory_home: string;
+        memory_home_mode: string | null;
+        db_path: string;
+        db_exists: boolean;
+    };
+    policy: {
+        sources: LoadedPolicy["sources"];
+        effective: LoadedPolicy["policy"];
+        builtin_deny_claim_patterns: string[];
+        effective_deny_claim_patterns: string[];
+    };
+    repo: {
+        root_path: string;
+        repo_key: string;
+        remote_url: string | null;
+        bound: boolean;
+        platform: string | null;
+    };
+    platforms: {
+        cursor_issues: string[];
+        claude_issues: string[];
+    };
+    license: ReturnType<typeof licenseStatus>;
+    embed: ReturnType<typeof embedStatus>;
+    sku?: {
+        tier: string;
+        airgap: true;
+        network_egress: "none";
+        vault: ReturnType<typeof vaultStatus>;
+        host_health: Record<string, string[]>;
+    };
+    ok: boolean;
+    issues: string[];
+};
+export declare function buildAttestReport(cwd?: string): AttestReport;
+export declare function formatAttestHuman(report: AttestReport): string;

package/dist/attest.js

@@ -0,0 +1,192 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getRepoByCwd, getSetupState, openDb } from "./db.js";
+import { claudeInstallHealth } from "./install/claude.js";
+import { cursorInstallHealth } from "./install/cursor.js";
+import { amemHome, dbPath, ensureAmemHome } from "./paths.js";
+import { BUILTIN_DENY_CLAIM_PATTERNS, effectiveDenyPatterns, loadPolicy, } from "./policy.js";
+import { detectRepoIdentity } from "./repo-identity.js";
+import { FEATURE_ATTEST_SKU, hasFeature, licenseStatus } from "./license.js";
+import { embedIndexIssues, embedStatus } from "./embed.js";
+import { vaultStatus } from "./vault.js";
+import { hostInstallHealth } from "./install/hosts.js";
+function packageRoot() {
+    const here = fileURLToPath(new URL(".", import.meta.url));
+    // dist/ -> package root
+    return join(here, "..");
+}
+function readVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function sha256File(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        return createHash("sha256").update(readFileSync(path)).digest("hex");
+    }
+    catch {
+        return null;
+    }
+}
+function modeOctal(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        return (statSync(path).mode & 0o777).toString(8).padStart(3, "0");
+    }
+    catch {
+        return null;
+    }
+}
+export function buildAttestReport(cwd = process.cwd()) {
+    ensureAmemHome();
+    const loaded = loadPolicy(true);
+    const identity = detectRepoIdentity(cwd);
+    const repo = getRepoByCwd(cwd);
+    const issues = [];
+    for (const src of loaded.sources) {
+        if (src.error)
+            issues.push(`Policy ${src.role} (${src.path}): ${src.error}`);
+    }
+    if (loaded.policy.telemetry) {
+        issues.push("telemetry unexpectedly enabled (hard-stop failed)");
+    }
+    if (loaded.policy.ui_bind !== "127.0.0.1" && loaded.policy.ui_bind !== "localhost") {
+        issues.push(`ui_bind must be loopback, got ${loaded.policy.ui_bind}`);
+    }
+    const homeMode = modeOctal(amemHome());
+    if (homeMode && homeMode !== "700") {
+        issues.push(`amem home mode is ${homeMode}, expected 700`);
+    }
+    let cursorIssues = [];
+    let claudeIssues = [];
+    let platforms = [];
+    if (repo) {
+        try {
+            const setup = getSetupState(repo.id);
+            platforms = setup ? JSON.parse(setup.platforms) : [];
+        }
+        catch {
+            platforms = [];
+        }
+        if (platforms.length === 0 && repo.platform)
+            platforms = [repo.platform];
+    }
+    const checkCursor = platforms.includes("cursor") || repo?.platform === "cursor" || platforms.length === 0;
+    const checkClaude = platforms.includes("claude") || repo?.platform === "claude" || platforms.length === 0;
+    if (repo) {
+        if (checkCursor)
+            cursorIssues = cursorInstallHealth(identity.rootPath);
+        if (checkClaude)
+            claudeIssues = claudeInstallHealth();
+    }
+    else {
+        issues.push("Repo not initialized — run amem init");
+    }
+    issues.push(...cursorIssues, ...claudeIssues);
+    const license = licenseStatus();
+    issues.push(...license.issues.map((i) => `license: ${i}`));
+    const embed = embedStatus();
+    if (embed.requested === "ngram" && !embed.licensed) {
+        issues.push("embed_backend ngram requested but license is not Pro/IT — using hash");
+    }
+    try {
+        issues.push(...embedIndexIssues(openDb()));
+    }
+    catch {
+        // Locked vault: the vault section already reports that.
+    }
+    const pkgPath = join(packageRoot(), "package.json");
+    const sku = hasFeature(FEATURE_ATTEST_SKU)
+        ? {
+            tier: license.tier,
+            airgap: true,
+            network_egress: "none",
+            vault: vaultStatus(),
+            host_health: {
+                continue: hostInstallHealth("continue"),
+                zed: hostInstallHealth("zed"),
+                windsurf: hostInstallHealth("windsurf"),
+            },
+        }
+        : undefined;
+    return {
+        tool: "amem",
+        version: readVersion(),
+        package_integrity: {
+            package_json_sha256: sha256File(pkgPath),
+        },
+        attested_at: new Date().toISOString(),
+        privacy: {
+            telemetry: false,
+            network_egress: "none",
+            ui_bind: loaded.policy.ui_bind,
+            ui_enabled: loaded.policy.ui_enabled,
+            memory_home: amemHome(),
+            memory_home_mode: homeMode,
+            db_path: dbPath(),
+            db_exists: existsSync(dbPath()),
+        },
+        policy: {
+            sources: loaded.sources,
+            effective: loaded.policy,
+            builtin_deny_claim_patterns: [...BUILTIN_DENY_CLAIM_PATTERNS],
+            effective_deny_claim_patterns: effectiveDenyPatterns(loaded.policy),
+        },
+        repo: {
+            root_path: identity.rootPath,
+            repo_key: identity.repoKey,
+            remote_url: identity.remoteUrl,
+            bound: Boolean(repo),
+            platform: repo?.platform ?? null,
+        },
+        platforms: {
+            cursor_issues: cursorIssues,
+            claude_issues: claudeIssues,
+        },
+        license,
+        embed,
+        sku,
+        ok: issues.length === 0,
+        issues,
+    };
+}
+export function formatAttestHuman(report) {
+    const lines = [
+        `amem attest ${report.ok ? "OK" : "ISSUES"} · v${report.version}`,
+        `attested_at: ${report.attested_at}`,
+        `memory_home: ${report.privacy.memory_home} (mode ${report.privacy.memory_home_mode ?? "n/a"})`,
+        `db: ${report.privacy.db_path} (${report.privacy.db_exists ? "present" : "absent"})`,
+        `telemetry: ${report.privacy.telemetry}`,
+        `network_egress: ${report.privacy.network_egress}`,
+        `ui: enabled=${report.privacy.ui_enabled} bind=${report.privacy.ui_bind}`,
+        `allow_export: ${report.policy.effective.allow_export}`,
+        `allowed_platforms: ${report.policy.effective.allowed_platforms.join(", ") || "(any)"}`,
+        `allowed_remote_hosts: ${report.policy.effective.allowed_remote_hosts.join(", ") || "(any)"}`,
+        `deny_patterns: ${report.policy.effective_deny_claim_patterns.length} (builtin + policy)`,
+        `repo: ${report.repo.root_path}`,
+        `remote: ${report.repo.remote_url ?? "(none)"}`,
+        `bound: ${report.repo.bound}`,
+        `license: ${report.license.tier} (${report.license.kind}${report.license.valid ? "" : ", invalid"})`,
+        `embed: ${report.embed.backend} dim=${report.embed.dim}`,
+    ];
+    if (report.sku) {
+        lines.push(`sku: IT airgap packet · vault locked=${report.sku.vault.encryptedAtRest} · backup=${report.sku.vault.backup.scheduled ? "scheduled" : "off"}`);
+    }
+    const applied = report.policy.sources.filter((s) => s.applied).map((s) => `${s.role}:${s.path}`);
+    lines.push(`policy_sources: ${applied.join(" → ")}`);
+    if (report.issues.length) {
+        lines.push("issues:");
+        for (const issue of report.issues)
+            lines.push(`- ${issue}`);
+    }
+    return lines.join("\n");
+}

package/dist/backup-schedule.d.ts

@@ -0,0 +1,25 @@
+export declare const BACKUP_LABEL = "co.amem.backup";
+export declare const BACKUP_SYSTEMD_SERVICE = "amem-backup.service";
+export declare const BACKUP_SYSTEMD_TIMER = "amem-backup.timer";
+export type BackupScheduleOpts = {
+    outDir?: string;
+    /** Hour of day local time 0–23 (default 3). */
+    hour?: number;
+};
+export declare function backupLaunchAgentPath(): string;
+export declare function backupSystemdServicePath(): string;
+export declare function backupSystemdTimerPath(): string;
+export declare function backupWindowsStartupPath(): string;
+export declare function isBackupScheduleInstalled(): boolean;
+export declare function backupSchedulePath(): string;
+export declare function installBackupSchedule(opts?: BackupScheduleOpts): {
+    path: string;
+    outDir: string;
+    platform: string;
+};
+export declare function uninstallBackupSchedule(): {
+    path: string;
+    platform: string;
+};
+/** Write a tiny wrapper script under ~/.amem for manual cron users. */
+export declare function writeBackupHelperScript(outDir?: string): string;

package/dist/backup-schedule.js

@@ -0,0 +1,216 @@
+/**
+ * Schedule local encrypted backups (no cloud sync).
+ * Uses LaunchAgent (macOS), systemd user timer (Linux), or Startup cmd (Windows).
+ */
+import { existsSync, mkdirSync, unlinkSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { defaultBackupDir } from "./crypto.js";
+import { amemHome } from "./paths.js";
+import { resolveAmemProgramArgs } from "./install/skills.js";
+export const BACKUP_LABEL = "co.amem.backup";
+export const BACKUP_SYSTEMD_SERVICE = "amem-backup.service";
+export const BACKUP_SYSTEMD_TIMER = "amem-backup.timer";
+function escapeXml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function backupArgs(outDir) {
+    return resolveAmemProgramArgs("backup", "--out", outDir);
+}
+function shellQuote(args) {
+    return args.map((a) => (/\s/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a)).join(" ");
+}
+export function backupLaunchAgentPath() {
+    return join(homedir(), "Library", "LaunchAgents", `${BACKUP_LABEL}.plist`);
+}
+export function backupSystemdServicePath() {
+    return join(homedir(), ".config", "systemd", "user", BACKUP_SYSTEMD_SERVICE);
+}
+export function backupSystemdTimerPath() {
+    return join(homedir(), ".config", "systemd", "user", BACKUP_SYSTEMD_TIMER);
+}
+export function backupWindowsStartupPath() {
+    const appData = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+    return join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "amem-backup.cmd");
+}
+export function isBackupScheduleInstalled() {
+    if (process.platform === "darwin")
+        return existsSync(backupLaunchAgentPath());
+    if (process.platform === "linux")
+        return existsSync(backupSystemdTimerPath());
+    if (process.platform === "win32")
+        return existsSync(backupWindowsStartupPath());
+    return false;
+}
+export function backupSchedulePath() {
+    if (process.platform === "darwin")
+        return backupLaunchAgentPath();
+    if (process.platform === "linux")
+        return backupSystemdTimerPath();
+    if (process.platform === "win32")
+        return backupWindowsStartupPath();
+    return "";
+}
+function uid() {
+    return String(process.getuid?.() ?? "");
+}
+export function installBackupSchedule(opts = {}) {
+    const outDir = opts.outDir || defaultBackupDir();
+    mkdirSync(outDir, { recursive: true, mode: 0o700 });
+    const hour = Math.min(23, Math.max(0, opts.hour ?? 3));
+    const args = backupArgs(outDir);
+    if (process.platform === "darwin") {
+        const path = backupLaunchAgentPath();
+        mkdirSync(join(homedir(), "Library", "LaunchAgents"), { recursive: true });
+        const argXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+        const body = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${BACKUP_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${argXml}
+  </array>
+  <key>StartCalendarInterval</key>
+  <dict>
+    <key>Hour</key>
+    <integer>${hour}</integer>
+    <key>Minute</key>
+    <integer>15</integer>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(join(amemHome(), "backup.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(join(amemHome(), "backup.err.log"))}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  </dict>
+</dict>
+</plist>
+`;
+        writeFileSync(path, body, "utf8");
+        try {
+            execFileSync("launchctl", ["bootout", `gui/${uid()}`, path], {
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch {
+            // not loaded
+        }
+        try {
+            execFileSync("launchctl", ["bootstrap", `gui/${uid()}`, path], {
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch {
+            // next login picks it up
+        }
+        return { path, outDir, platform: "darwin" };
+    }
+    if (process.platform === "linux") {
+        const unitDir = join(homedir(), ".config", "systemd", "user");
+        mkdirSync(unitDir, { recursive: true });
+        const svc = backupSystemdServicePath();
+        const timer = backupSystemdTimerPath();
+        writeFileSync(svc, `[Unit]
+Description=amem local encrypted backup
+[Service]
+Type=oneshot
+ExecStart=${shellQuote(args)}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin:${homedir()}/.local/bin
+`, "utf8");
+        writeFileSync(timer, `[Unit]
+Description=Daily amem local backup
+[Timer]
+OnCalendar=*-*-* ${String(hour).padStart(2, "0")}:15:00
+Persistent=true
+[Install]
+WantedBy=timers.target
+`, "utf8");
+        try {
+            execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+            execFileSync("systemctl", ["--user", "enable", "--now", BACKUP_SYSTEMD_TIMER], {
+                stdio: "ignore",
+            });
+        }
+        catch {
+            // unit files are on disk
+        }
+        return { path: timer, outDir, platform: "linux" };
+    }
+    if (process.platform === "win32") {
+        const path = backupWindowsStartupPath();
+        mkdirSync(join(path, ".."), { recursive: true });
+        writeFileSync(path, `@echo off\r\nrem amem daily backup (runs at login)\r\n${shellQuote(args)}\r\n`, "utf8");
+        return { path, outDir, platform: "win32" };
+    }
+    throw new Error(`Backup scheduling not supported on ${process.platform}`);
+}
+export function uninstallBackupSchedule() {
+    if (process.platform === "darwin") {
+        const path = backupLaunchAgentPath();
+        if (existsSync(path)) {
+            try {
+                execFileSync("launchctl", ["bootout", `gui/${uid()}`, path], {
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+            }
+            catch {
+                // ignore
+            }
+            unlinkSync(path);
+        }
+        return { path, platform: "darwin" };
+    }
+    if (process.platform === "linux") {
+        const timer = backupSystemdTimerPath();
+        const svc = backupSystemdServicePath();
+        try {
+            execFileSync("systemctl", ["--user", "disable", "--now", BACKUP_SYSTEMD_TIMER], {
+                stdio: "ignore",
+            });
+        }
+        catch {
+            // ignore
+        }
+        if (existsSync(timer))
+            unlinkSync(timer);
+        if (existsSync(svc))
+            unlinkSync(svc);
+        return { path: timer, platform: "linux" };
+    }
+    if (process.platform === "win32") {
+        const path = backupWindowsStartupPath();
+        if (existsSync(path))
+            unlinkSync(path);
+        return { path, platform: "win32" };
+    }
+    throw new Error(`Backup scheduling not supported on ${process.platform}`);
+}
+/** Write a tiny wrapper script under ~/.amem for manual cron users. */
+export function writeBackupHelperScript(outDir) {
+    const dir = outDir || defaultBackupDir();
+    const script = join(amemHome(), "bin", "amem-backup.sh");
+    mkdirSync(join(amemHome(), "bin"), { recursive: true, mode: 0o700 });
+    const body = `#!/usr/bin/env bash
+set -euo pipefail
+exec ${shellQuote(backupArgs(dir))}
+`;
+    writeFileSync(script, body, { mode: 0o700 });
+    try {
+        chmodSync(script, 0o700);
+    }
+    catch {
+        // ignore
+    }
+    return script;
+}

package/dist/capture.d.ts

@@ -0,0 +1,34 @@
+import { type ProposalDraftRow, type RepoRow, type UsageEventRow } from "./db.js";
+import { type Proposal } from "./proposal.js";
+export declare function isUsefulCaptureText(text: string): boolean;
+export declare function extractCaptureAnchors(text: string, repoRoot: string): string[];
+/** High-quality durable facts apply without waiting for amem_remember. */
+export declare function shouldAutoApplyProposal(proposal: Proposal): boolean;
+/** Apply pending drafts (skips quality.reject). Used when auto-approve is turned on. */
+export declare function applyPendingDrafts(repoId?: string): {
+    applied: string[];
+    skipped: number;
+};
+export declare function captureSessionDraft(input: {
+    repo: RepoRow;
+    platform: string;
+    sessionId?: string | null;
+    prompt: string;
+    answer?: string;
+    notes?: Array<{
+        role: string;
+        text: string;
+    }>;
+}): ProposalDraftRow | null;
+export declare function findRecentContextMisses(repoId: string, opts?: {
+    sessionId?: string | null;
+    limit?: number;
+}): UsageEventRow[];
+export declare function captureMissLearnDraft(input: {
+    repo: RepoRow;
+    platform: string;
+    sessionId?: string | null;
+    miss: UsageEventRow;
+    answer: string;
+}): ProposalDraftRow | null;
+export declare function pendingDraftCount(repoId: string): number;