@lotargo/memory_plugin 1.4.621 → 1.5.0

package/mcp-server/admin/auth.js

@@ -1,9 +1,12 @@
 import http from "node:http";
 import crypto from "node:crypto";
 import { spawn } from "node:child_process";
-import { saveSecrets, deleteSecrets, loadSecrets, resolveEnvSecrets, getSecretsSource } from "../config/auth_store.js";
+import { saveSecrets, deleteSecrets, loadSecrets, resolveEnvSecrets, getSecretsSource, invalidateAuthCache, onSecretsChanged } from "../config/auth_store.js";
 import { getConfig, updateConfig } from "../config/config_manager.js";
 
+// Register callback so resolveCloudSecrets() cache is cleared when secrets change
+onSecretsChanged(() => { _cachedResolvedSecrets = undefined; _cachedResolvedAt = 0; });
+
 export const TURSO_API_BASE = () => process.env.TURSO_API_BASE || "https://api.turso.tech";
 
 function openBrowser(url) {
@@ -541,9 +544,23 @@ export async function loginFromEnv({ persist = false } = {}) {
 // Used by database.js at startup so a raw TURSO_API_TOKEN environment token
 // (which can only call the Platform API, not libsql) gets minted into a
 // per-database JWT without any interactive step.
+let _cachedResolvedSecrets = undefined;
+let _cachedResolvedAt = 0;
+const RESOLVED_CACHE_TTL_MS = 60_000;  // 60s — avoids re-minting JWT on every getDatabase()
+
+export function invalidateResolvedCache() {
+  _cachedResolvedSecrets = undefined;
+  _cachedResolvedAt = 0;
+}
+
 export async function resolveCloudSecrets() {
+  const now = Date.now();
+  if (_cachedResolvedSecrets !== undefined && (now - _cachedResolvedAt) < RESOLVED_CACHE_TTL_MS) {
+    return _cachedResolvedSecrets;
+  }
+
   const secrets = loadSecrets();
-  if (!secrets) return null;
+  if (!secrets) { _cachedResolvedSecrets = null; return null; }
   if (secrets.apiToken && secrets.needsResolution) {
     const resolved = await loginWithApiToken({
       token: secrets.apiToken,
@@ -552,9 +569,13 @@ export async function resolveCloudSecrets() {
       username: secrets.username || null,
       persist: false,
     });
-    return { ...resolved, source: "env" };
+    _cachedResolvedSecrets = { ...resolved, source: "env" };
+    _cachedResolvedAt = Date.now();
+    return _cachedResolvedSecrets;
   }
-  return secrets;
+  _cachedResolvedSecrets = secrets;
+  _cachedResolvedAt = Date.now();
+  return _cachedResolvedSecrets;
 }
 
 // Store/replace a Turso account API token. Alias of the headless login flow:
@@ -577,9 +598,13 @@ export function clearApiKey() {
   delete rest.apiToken;
   if (rest.token && rest.dbUrl) {
     saveSecrets({ ...rest, authorized: true });
+    invalidateAuthCache();
+    invalidateResolvedCache();
     return { removed: true, keptDbSession: true };
   }
   deleteSecrets();
+  invalidateAuthCache();
+  invalidateResolvedCache();
   return { removed: true, keptDbSession: false };
 }
 
@@ -604,6 +629,8 @@ export function getAuthStatus() {
 // Logout and reset configurations
 export function logoutFromCloud() {
   const deleted = deleteSecrets();
+  invalidateAuthCache();
+  invalidateResolvedCache();
   updateConfig({ tursoUrl: "", mode: "only-local", authorized: false, username: "" });
   return deleted;
 }

package/mcp-server/cli/direct_commands.js

@@ -0,0 +1,313 @@
+import { basename } from "node:path";
+import {
+  readMemory,
+  writeMemory,
+  storeFilePath,
+  canonicalPath,
+  listProjectStores,
+  migrateStoreTitles,
+  GLOBAL_KEY,
+  projectKey,
+} from "../memory.js";
+import { factBody } from "../fact_format.js";
+
+export async function handleDirectCommands(cliArgs) {
+  if (cliArgs[0] === "link") {
+    const dirIdx = cliArgs.indexOf("--dir");
+    const dir = dirIdx >= 0 && cliArgs[dirIdx + 1] ? cliArgs[dirIdx + 1] : process.cwd();
+    const remIdx = cliArgs.indexOf("--remote");
+    const remote = remIdx >= 0 && cliArgs[remIdx + 1] ? cliArgs[remIdx + 1] : null;
+
+    try {
+      const { getDatabase } = await import("../db/database.js");
+      const { resolveProjectIdentity, upsertIdentity, registerAlias, normalizeRemoteUrl } = await import("../identity.js");
+      const db = await getDatabase();
+
+      const identity = await resolveProjectIdentity(dir);
+      if (!identity && !remote) {
+        console.error("Error: No Git repository detected and no remote URL specified.");
+        process.exit(1);
+      }
+
+      let key = identity ? identity.key : `git:${normalizeRemoteUrl(remote)}`;
+      let name = identity ? identity.name : basename(dir) || "unbound";
+      let primaryRemote = remote ? normalizeRemoteUrl(remote) : (identity ? identity.primaryRemote : null);
+
+      await upsertIdentity(db, { key, name, primaryRemote });
+
+      const aliases = [];
+      if (primaryRemote) {
+        aliases.push({ alias: `remote:${primaryRemote}`, kind: "remote" });
+      }
+      aliases.push({ alias: `path:${canonicalPath(dir)}`, kind: "path" });
+      aliases.push({ alias: `basename:${name}`, kind: "basename" });
+
+      for (const a of aliases) {
+        await registerAlias(db, { alias: a.alias, identityKey: key, kind: a.kind });
+      }
+
+      console.log(`\n  [OK] Linked directory "${dir}" successfully to identity key: ${key}\n`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs[0] === "unlink") {
+    const dirIdx = cliArgs.indexOf("--dir");
+    const dir = dirIdx >= 0 && cliArgs[dirIdx + 1] ? cliArgs[dirIdx + 1] : process.cwd();
+    const purge = cliArgs.includes("--purge");
+
+    try {
+      const { getDatabase } = await import("../db/database.js");
+      const { unregisterAlias, removeIdentity, resolveProjectIdentity } = await import("../identity.js");
+      const db = await getDatabase();
+
+      const alias = `path:${canonicalPath(dir)}`;
+      await unregisterAlias(db, alias);
+
+      if (purge) {
+        const identity = await resolveProjectIdentity(dir);
+        if (identity) {
+          await removeIdentity(db, identity.key);
+        }
+      }
+
+      console.log(`\n  [OK] Unlinked directory "${dir}" successfully.\n`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs[0] === "relink") {
+    const dirIdx = cliArgs.indexOf("--dir");
+    const dir = dirIdx >= 0 && cliArgs[dirIdx + 1] ? cliArgs[dirIdx + 1] : process.cwd();
+    const remIdx = cliArgs.indexOf("--remote");
+    const remote = remIdx >= 0 && cliArgs[remIdx + 1] ? cliArgs[remIdx + 1] : null;
+
+    if (!remote) {
+      console.error("Error: --remote parameter is required for relink.");
+      process.exit(1);
+    }
+
+    try {
+      const { getDatabase } = await import("../db/database.js");
+      const { resolveProjectIdentity, upsertIdentity, removeIdentity, normalizeRemoteUrl } = await import("../identity.js");
+      const db = await getDatabase();
+
+      const sourceIdentity = await resolveProjectIdentity(dir);
+      if (!sourceIdentity) {
+        console.error("Error: Source project identity not detected.");
+        process.exit(1);
+      }
+
+      const targetKey = `git:${normalizeRemoteUrl(remote)}`;
+      const sourceKey = sourceIdentity.key;
+
+      if (sourceKey === targetKey) {
+        console.log("Source and target identities are already identical.");
+        return true;
+      }
+
+      const sourceFacts = await readMemory(sourceKey);
+      const targetFacts = await readMemory(targetKey);
+      const seen = new Set(targetFacts.map((e) => factBody(e).toLowerCase().trim()));
+
+      let mergedCount = 0;
+      for (const f of sourceFacts) {
+        const body = factBody(f).toLowerCase().trim();
+        if (!seen.has(body)) {
+          seen.add(body);
+          targetFacts.push(f);
+          mergedCount++;
+        }
+      }
+
+      await writeMemory(targetKey, targetFacts);
+      await db.prepare("UPDATE project_aliases SET identity_key = ? WHERE identity_key = ?;").run(targetKey, sourceKey);
+      await upsertIdentity(db, { key: targetKey, name: sourceIdentity.name, primaryRemote: normalizeRemoteUrl(remote) });
+      await removeIdentity(db, sourceKey);
+
+      try {
+        const sourceFp = storeFilePath(sourceKey);
+        const { existsSync } = await import("node:fs");
+        if (existsSync(sourceFp)) {
+          const { unlink } = await import("fs/promises");
+          await unlink(sourceFp);
+        }
+      } catch (e) {}
+
+      console.log(`\n  [OK] Relinked and merged ${mergedCount} facts successfully!\n`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs[0] === "identity") {
+    const dirIdx = cliArgs.indexOf("--dir");
+    const dir = dirIdx >= 0 && cliArgs[dirIdx + 1] ? cliArgs[dirIdx + 1] : process.cwd();
+
+    try {
+      const { resolveProjectIdentity } = await import("../identity.js");
+      const identity = await resolveProjectIdentity(dir);
+      console.log(`\n  PROJECT IDENTITY`);
+      if (identity) {
+        console.log(`  - Key: ${identity.key}`);
+        console.log(`  - Name: ${identity.name}`);
+        console.log(`  - Primary Remote: ${identity.primaryRemote || "none"}`);
+        console.log(`  - Toplevel Directory: ${identity.toplevel}`);
+      } else {
+        console.log("  No Git repository detected.");
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs[0] === "migrate_titles") {
+    const keyIdx = cliArgs.indexOf("--key");
+    const key = keyIdx >= 0 && cliArgs[keyIdx + 1] ? cliArgs[keyIdx + 1] : null;
+
+    try {
+      const targets = [];
+      if (key) {
+        targets.push(key);
+      } else {
+        const gitKey = await projectKey(process.cwd(), null);
+        if (gitKey) targets.push(gitKey);
+        targets.push(GLOBAL_KEY);
+        const stores = await listProjectStores();
+        for (const s of stores) {
+          if (!targets.includes(s.key)) targets.push(s.key);
+        }
+      }
+
+      let total = 0;
+      for (const k of targets) {
+        const res = await migrateStoreTitles(k);
+        if (res.ok) {
+          total += res.changed;
+          console.log(`  [OK] ${k}: ${res.changed} fact(s) titled`);
+        } else {
+          console.log(`  [SKIP] ${k}: ${res.reason}`);
+        }
+      }
+      console.log(`\n  Done. ${total} fact(s) updated across ${targets.length} store(s).\n`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs.includes("--enable-prompt") || cliArgs.includes("enable-prompt")) {
+    const { enableGlobalPrompt } = await import("../prompt_manager.js");
+    const results = await enableGlobalPrompt();
+    console.log("\n  [OK] Global prompt enabled across client configurations:\n");
+    results.forEach((r) => console.log(`  - ${r.name}: ${r.filePath} (${r.status})`));
+    console.log("");
+    return true;
+  }
+
+  if (cliArgs.includes("--disable-prompt") || cliArgs.includes("disable-prompt")) {
+    const { disableGlobalPrompt } = await import("../prompt_manager.js");
+    const results = await disableGlobalPrompt();
+    console.log("\n  [OK] Global prompt disabled across client configurations:\n");
+    results.forEach((r) => console.log(`  - ${r.name}: ${r.filePath} (${r.status})`));
+    console.log("");
+    return true;
+  }
+
+  if (cliArgs.includes("login")) {
+    console.log("\n  [CLOUD] Starting Turso cloud authorization...");
+    const loginIdx = cliArgs.indexOf("login");
+    const loginArgs = cliArgs.slice(loginIdx + 1);
+    const flagValue = (name) => {
+      const i = loginArgs.indexOf(name);
+      return i >= 0 && loginArgs[i + 1] ? loginArgs[i + 1] : null;
+    };
+    const { loginToCloud, loginWithApiToken, loginWithDatabaseToken, loginFromEnv } = await import("../admin/auth.js");
+    try {
+      let secrets;
+      if (loginArgs.includes("--from-env")) {
+        const res = await loginFromEnv({ persist: false });
+        if (!res.ok) throw new Error(res.reason);
+        secrets = res.secrets;
+      } else if (loginArgs.includes("--db-url") && loginArgs.includes("--db-token")) {
+        secrets = await loginWithDatabaseToken({
+          dbUrl: flagValue("--db-url"),
+          token: flagValue("--db-token"),
+          username: flagValue("--username") || "",
+          org: flagValue("--org") || "",
+          db: flagValue("--database") || "",
+          validate: !loginArgs.includes("--no-validate"),
+        });
+      } else if (loginArgs.includes("--token") || loginArgs.includes("--api-token") || loginArgs.includes("--api-key")) {
+        const token = flagValue("--token") || flagValue("--api-token") || flagValue("--api-key");
+        if (!token) throw new Error("Missing token value. Usage: memory_plugin login --api-token <TOKEN> [--org <ORG>] [--database <DB>]");
+        secrets = await loginWithApiToken({
+          token,
+          org: flagValue("--org") || null,
+          databaseName: flagValue("--database") || null,
+        });
+      } else {
+        secrets = await loginToCloud();
+      }
+      console.log(`\n  \x1b[32m[OK] Successfully signed in to the cloud! Connected to endpoint: ${secrets.dbUrl}\x1b[0m\n`);
+    } catch (e) {
+      console.error(`\n  \x1b[31m[ERROR] Authorization failed: ${e.message}\x1b[0m\n`);
+      process.exit(1);
+    }
+    return true;
+  }
+
+  if (cliArgs.includes("logout")) {
+    const { logoutFromCloud, clearApiKey } = await import("../admin/auth.js");
+    if (cliArgs.includes("--api-key")) {
+      const res = clearApiKey();
+      if (res.removed) {
+        console.log(
+          res.keptDbSession
+            ? "  \x1b[32m[OK] API token removed. The resolved database session is kept and stays authorized.\x1b[0m\n"
+            : "  \x1b[32m[OK] API token removed. Encrypted secrets purged.\x1b[0m\n"
+        );
+      } else {
+        console.log("  [*] No stored API token to remove.\x1b[0m\n");
+      }
+      return true;
+    }
+    console.log("\n  [CLOUD] Signing out of the cloud...");
+    const deleted = logoutFromCloud();
+    if (deleted) {
+      console.log("  \x1b[32m[OK] You have been signed out. Encrypted secrets removed. Mode reverted to only-local.\x1b[0m\n");
+    } else {
+      console.log("  [*] Mode reverted to only-local. No session tokens were found.\x1b[0m\n");
+    }
+    return true;
+  }
+
+  if (cliArgs.includes("auth-status") || cliArgs.includes("auth_status") || cliArgs.includes("auth")) {
+    const { getAuthStatus } = await import("../admin/auth.js");
+    const st = getAuthStatus();
+    console.log("\n  [CLOUD] Authentication status:");
+    console.log(`    Source:        ${st.source}`);
+    console.log(`    Authorized:    ${st.authorized ? "YES" : "no"}`);
+    console.log(`    API Key:       ${st.hasApiKey ? "SET" : "not set"}`);
+    console.log(`    Endpoint:      ${st.dbUrl || "(none)"}`);
+    console.log(`    Username:      ${st.username || "(unknown)"}`);
+    console.log(`    Organization:  ${st.org || "(unknown)"}`);
+    console.log(`    Database:      ${st.database || "(unknown)"}`);
+    console.log(`    Mode:          ${st.mode}`);
+    console.log("");
+    return true;
+  }
+
+  return false;
+}

package/mcp-server/cli/handlers/cloud_actions.js

@@ -0,0 +1,138 @@
+import { updateConfig } from "../../config/config_manager.js";
+import { selectSimpleMenu, promptText, waitForEnter } from "../ui.js";
+
+export async function handleCloudAction(value, config) {
+  switch (value) {
+    case "cloud_login": {
+      console.clear();
+      console.log("\n  [CLOUD] Turso cloud authorization\n");
+      const methodItems = [
+        { label: "Browser OAuth (GUI)", value: "browser", info: "Opens the system browser for the loopback OAuth flow (requires a desktop session)" },
+        { label: "Account API Token", value: "api_token", info: "Paste a Turso account API token — works headless (Docker, Google Jules, VPS/VDS)" },
+        { label: "Database URL + Token", value: "db_token", info: "Paste a libsql:// endpoint and its database auth token — no Platform API needed" },
+        { label: "Import From Environment", value: "env", info: "Pick up TURSO_DB_URL / TURSO_DB_TOKEN / TURSO_API_TOKEN from env vars or MEMORY_DIR/.env" },
+        { label: "< Cancel", value: "cancel", info: "Return to the main menu" },
+      ];
+      const methodRes = await selectSimpleMenu({
+        title: "CHOOSE LOGIN METHOD",
+        subtitle: "Browser login needs a GUI. Token / env methods work in Docker, Google Jules and on VPS/VDS.",
+        items: methodItems,
+      });
+      if (methodRes.action !== "select" || methodRes.value === "cancel") break;
+
+      const { loginToCloud, loginWithApiToken, loginWithDatabaseToken, loginFromEnv } = await import("../../admin/auth.js");
+      try {
+        let secrets;
+        if (methodRes.value === "browser") {
+          secrets = await loginToCloud();
+        } else if (methodRes.value === "api_token") {
+          const token = await promptText("Paste your Turso account API token\n  (create one at https://console.turso.tech or via `turso auth api-tokens create`)");
+          if (!token) throw new Error("Empty API token.");
+          secrets = await loginWithApiToken({ token });
+        } else if (methodRes.value === "db_token") {
+          const dbUrl = await promptText("Paste your database URL (libsql://<database>-<org>.turso.io)");
+          const token = await promptText("Paste your database auth token");
+          if (!dbUrl || !token) throw new Error("Empty URL or token.");
+          secrets = await loginWithDatabaseToken({ dbUrl, token, validate: false });
+        } else if (methodRes.value === "env") {
+          const res = await loginFromEnv({ persist: true });
+          if (!res.ok) throw new Error(res.reason);
+          secrets = res.secrets;
+        }
+        console.log(`\n  \x1b[32m[OK] Successfully signed in to the cloud! Connected to endpoint: ${secrets.dbUrl}\x1b[0m\n`);
+      } catch (e) {
+        console.error(`\n  \x1b[31m[ERROR] Authorization failed: ${e.message}\x1b[0m\n`);
+      }
+      await waitForEnter();
+      break;
+    }
+    case "cloud_logout": {
+      console.clear();
+      console.log("\n  [CLOUD] Signing out of the cloud...");
+      const { logoutFromCloud } = await import("../../admin/auth.js");
+      const deleted = logoutFromCloud();
+      if (deleted) {
+        console.log("  \x1b[32m[OK] You have been signed out. Encrypted secrets removed. Mode reverted to only-local.\x1b[0m\n");
+      } else {
+        console.log("  [*] Mode reverted to only-local. No session tokens were found.\x1b[0m\n");
+      }
+      await waitForEnter();
+      break;
+    }
+    case "cloud_api_set": {
+      console.clear();
+      console.log("\n  [API KEY] Set / replace the Turso account API token\n");
+      const { setApiKey } = await import("../../admin/auth.js");
+      try {
+        const token = await promptText(
+          "Paste your Turso account API token\n  (create one at https://console.turso.tech or via `turso auth api-tokens create`)"
+        );
+        if (!token) throw new Error("Empty API token.");
+        const res = await setApiKey(token);
+        console.log(
+          `\n  \x1b[32m[OK] API token stored. Authorized as "${res.secrets.username}" — endpoint: ${res.secrets.dbUrl}\x1b[0m\n`
+        );
+      } catch (e) {
+        console.error(`\n  \x1b[31m[ERROR] Failed to set API key: ${e.message}\x1b[0m\n`);
+      }
+      await waitForEnter();
+      break;
+    }
+    case "cloud_api_clear": {
+      console.clear();
+      console.log("\n  [API KEY] Removing the stored account API token...");
+      const { clearApiKey } = await import("../../admin/auth.js");
+      const res = clearApiKey();
+      if (res.removed) {
+        console.log(
+          res.keptDbSession
+            ? "  \x1b[32m[OK] API token removed. The resolved database session is kept and stays authorized.\x1b[0m\n"
+            : "  \x1b[32m[OK] API token removed. Encrypted secrets purged.\x1b[0m\n"
+        );
+      } else {
+        console.log("  [*] No stored API token to remove.\x1b[0m\n");
+      }
+      await waitForEnter();
+      break;
+    }
+    case "cloud_mode": {
+      const modeItems = [
+        { label: "only-local (Local only)", value: "only-local", info: "Fully private, offline-first mode (everything stored on disk)" },
+        { label: "only-cloud (Cloud only)", value: "only-cloud", info: "Fully serverless cloud mode with no local caching" },
+        { label: "hybrid-sync (Local with background sync)", value: "hybrid-sync", info: "Instant local operations with a background sync daemon" },
+      ];
+      const initialIdx = Math.max(0, modeItems.findIndex((i) => i.value === config.mode));
+      const subRes = await selectSimpleMenu({
+        title: "CHOOSE OPERATIONAL MODE",
+        subtitle: "Configure database storage and cloud sync behavior",
+        items: modeItems,
+        initialIndex: initialIdx,
+      });
+
+      if (subRes.action === "select") {
+        updateConfig({ mode: subRes.value });
+      }
+      break;
+    }
+    case "conflict_strategy": {
+      const strategyItems = [
+        { label: "merge (Union local + cloud)", value: "merge", info: "Facts from both sides are merged and deduplicated — no data loss (recommended)" },
+        { label: "cloud-wins (Cloud overwrites local)", value: "cloud-wins", info: "On conflict, the cloud copy replaces the local store" },
+        { label: "local-wins (Local overwrites cloud)", value: "local-wins", info: "On conflict, the local copy replaces the cloud store" },
+      ];
+      const initialIdx = Math.max(0, strategyItems.findIndex((i) => i.value === (config.conflictStrategy || "merge")));
+      const subRes = await selectSimpleMenu({
+        title: "CHOOSE CONFLICT STRATEGY",
+        subtitle: "How hybrid-sync resolves differing local vs cloud stores",
+        items: strategyItems,
+        initialIndex: initialIdx,
+      });
+
+      if (subRes.action === "select") {
+        updateConfig({ conflictStrategy: subRes.value });
+        console.log(`\n  [OK] Conflict strategy set to: ${subRes.value}`);
+      }
+      break;
+    }
+  }
+}

package/mcp-server/cli/handlers/diagnostics_actions.js

@@ -0,0 +1,107 @@
+import { getConfig, updateConfig, resetConfig } from "../../config/config_manager.js";
+import { hybridQuery } from "../../retrieval/retriever.js";
+import {
+  selectSimpleMenu,
+  readTextInput,
+  waitForEnter,
+} from "../ui.js";
+
+export async function handleDiagnosticsAction(value, config, stats) {
+  switch (value) {
+    case "test": {
+      const queryRes = await readTextInput("Enter Test Verification Query", "sqlite compact database");
+      if (queryRes.action === "submit" && queryRes.value) {
+        console.clear();
+        console.log(`\n  \x1b[1m\x1b[37mSEARCH QUERY EXECUTION\x1b[0m`);
+        console.log(`\n  [SEARCH] Executing query: "\x1b[36m${queryRes.value}\x1b[0m"...\n`);
+        try {
+          const results = await hybridQuery({ query: queryRes.value, limit: 3 });
+          if (!results || results.length === 0) {
+            console.log("  [*] No matching results found in knowledge base.");
+          } else {
+            results.forEach((r, i) => {
+              console.log(`\n  \x1b[1m[Hit #${i + 1}] ${r.doc_title || "Doc"} > ${r.breadcrumbs || ""}\x1b[0m`);
+              console.log(`  Score: \x1b[33m${r.score}\x1b[0m (RSF: ${r.rsf_score}, RRF: ${r.rrf_score}, CosSim: ${r.cosine_sim})`);
+              console.log(`  Snippet: \x1b[90m${r.snippet ? r.snippet.substring(0, 100).replace(/\n/g, " ") : ""}...\x1b[0m`);
+            });
+          }
+        } catch (err) {
+          console.error("  [ERROR] Query execution failed:", err.message);
+        }
+        await waitForEnter();
+      }
+      break;
+    }
+
+    case "graph_test": {
+      console.clear();
+      console.log(`\n  \x1b[1m\x1b[37mGRAPH & NOTEBOOK LINKING VERIFICATION\x1b[0m\n`);
+
+      const sampleDoc = `# Ода о единороге (Секретный проект Unicorn)
+
+## Раздел 1: Введение
+Разработка нового высоконагруженного сервиса Unicorn.
+
+## Раздел 2: Стандарты
+Строка 7: Бэкенд пишется исключительно на Go.
+Строка 8: Хранилище транзакций — PostgreSQL 16.
+`;
+
+      const { ingestDocument } = await import("../../ingest/pipeline.js");
+      const { linkFactToDocument, getLinksForFact } = await import("../../graph/knowledge_linker.js");
+      const { readMemoryRaw, writeMemory, scopeKey } = await import("../../memory.js");
+
+      console.log("  1. Ingesting test document 'Ода о единороге'...");
+      const ingRes = await ingestDocument({
+        content: sampleDoc,
+        type: "text",
+        title: "Ода о единороге",
+        path: "virtual://oda_unicorna.md",
+        generateEmbeddings: false,
+      });
+      console.log(`     [OK] Document ingested. Doc ID: ${ingRes.docId}`);
+
+      console.log("\n  2. Saving Notebook fact & linking to lines L7-L8...");
+      const factText = "Project Unicorn backend services must use Go with PostgreSQL 16";
+      const factKey = scopeKey("project", "cli_test_repo", null);
+
+      const entries = await readMemoryRaw(factKey);
+      entries.push(`[2026-07-30] ${factText}`);
+      await writeMemory(factKey, entries);
+
+      const linkRes = linkFactToDocument({
+        factKey,
+        factText,
+        docId: ingRes.docId,
+        startLine: 7,
+        endLine: 8,
+        relationType: "RULES_FOR",
+      });
+      console.log(`     [OK] Graph Edge created. Link ID: ${linkRes.linkId} -> L7-L8`);
+
+      console.log("\n  3. Recalling memory (Verifying Graph Document Tag)...");
+      const rawFacts = await readMemoryRaw(factKey);
+      rawFacts.forEach((f, i) => {
+        const links = getLinksForFact(factKey, f);
+        let lStr = `     ${i + 1}. ${f}`;
+        if (links && links.length > 0) {
+          const docStr = links.map(l => `${l.doc_title || l.doc_path}:L${l.start_line}-${l.end_line}`).join(", ");
+          lStr += ` \x1b[36m🔗 [Linked Docs: ${docStr}]\x1b[0m`;
+        }
+        console.log(lStr);
+      });
+
+      console.log("\n  \x1b[32m[OK] AGENT-DRIVEN GRAPH LINKING VERIFIED SUCCESSFULLY!\x1b[0m\n");
+      await waitForEnter();
+      break;
+    }
+
+    case "reset": {
+      resetConfig();
+      console.clear();
+      console.log("\n  [OK] Configuration reset to factory defaults (RSF 50/50, e5-small, no reranker).\n");
+      await waitForEnter();
+      break;
+    }
+  }
+}