@memfork/cli 0.1.44 → 0.1.46

package/dist/branch.d.ts

@@ -48,9 +48,13 @@ export declare function pickBranch(sources: BranchSources): string;
 /**
  * Resolve the branch a command should operate on, applying the full
  * precedence chain (reads MEMFORK_BRANCH and the current git branch).
+ *
+ * Prints a warning when no git branch is detected and no fallback is
+ * configured — the caller will operate on "main" which may be unintended.
  */
 export declare function resolveBranch(opts?: {
     explicit?: string;
     configDefault?: string;
     cwd?: string;
+    silent?: boolean;
 }): string;

package/dist/branch.js

@@ -18,6 +18,7 @@
  * the core guarantees those integrations are unaffected by this logic.
  */
 import { execSync } from "node:child_process";
+import chalk from "chalk";
 /**
  * Read the current git branch, or undefined when there is no usable answer.
  *
@@ -63,12 +64,32 @@ export function pickBranch(sources) {
 /**
  * Resolve the branch a command should operate on, applying the full
  * precedence chain (reads MEMFORK_BRANCH and the current git branch).
+ *
+ * Prints a warning when no git branch is detected and no fallback is
+ * configured — the caller will operate on "main" which may be unintended.
  */
 export function resolveBranch(opts = {}) {
-    return pickBranch({
+    const git = gitBranch(opts.cwd);
+    const branch = pickBranch({
         explicit: opts.explicit,
         env: process.env["MEMFORK_BRANCH"],
-        git: gitBranch(opts.cwd),
+        git,
         configDefault: opts.configDefault,
     });
+    // Warn when we fell all the way through to "main" because there is no git
+    // repo and no other source — this is almost always unintended.
+    if (!opts.silent &&
+        branch === "main" &&
+        !opts.explicit &&
+        !process.env["MEMFORK_BRANCH"] &&
+        !git &&
+        !opts.configDefault) {
+        process.stderr.write(chalk.yellow("⚠") +
+            " No git branch detected — committing to " +
+            chalk.bold("main") +
+            ". Run " +
+            chalk.dim("git init && git checkout -b <branch>") +
+            " to use branch-scoped memory.\n");
+    }
+    return branch;
 }

package/dist/commands/doctor.js

@@ -125,8 +125,10 @@ export async function cmdDoctor() {
         process.exit(1);
     }
     // ── 5. MemoryTree on-chain ──────────────────────────────────────────────────
+    let treeOwner;
     try {
         const tree = await client.getTree();
+        treeOwner = tree.owner;
         checks.push({
             label: "MemoryTree on-chain",
             status: "ok",
@@ -141,7 +143,72 @@ export async function cmdDoctor() {
             fix: "Check the treeId in .memfork/config.json or run `memfork init`",
         });
     }
-    // ── 6. Signer balance (warn if low) ─────────────────────────────────────────
+    // ── 6. Signer role (owner vs delegate) ──────────────────────────────────────
+    const signerAddr = client.keypair.toSuiAddress();
+    if (treeOwner) {
+        if (signerAddr === treeOwner) {
+            checks.push({
+                label: "Signer role",
+                status: "ok",
+                detail: `owner  (${signerAddr.slice(0, 10)}…)`,
+            });
+        }
+        else {
+            // Look for a DelegateCap owned by this signer for this tree.
+            try {
+                if (!cfg.packageId)
+                    throw new Error("packageId unknown");
+                const capType = `${cfg.packageId}::tree::DelegateCap`;
+                const owned = await client.suiClient.getOwnedObjects({
+                    owner: signerAddr,
+                    filter: { StructType: capType },
+                    options: { showContent: true },
+                });
+                const cap = owned.data.find((o) => {
+                    if (!o.data?.content || o.data.content.dataType !== "moveObject")
+                        return false;
+                    const f = o.data.content.fields;
+                    return f["tree_id"] === cfg.treeId && !f["revoked"];
+                });
+                if (cap && cap.data?.content && cap.data.content.dataType === "moveObject") {
+                    const f = cap.data.content.fields;
+                    const raw = Number(f["permissions"] ?? 0);
+                    const labels = [];
+                    if (raw & 0x01)
+                        labels.push("READ");
+                    if (raw & 0x02)
+                        labels.push("WRITE");
+                    if (raw & 0x04)
+                        labels.push("FORK");
+                    if (raw & 0x08)
+                        labels.push("MERGE");
+                    if (raw & 0x10)
+                        labels.push("PROPOSE");
+                    checks.push({
+                        label: "Signer role",
+                        status: "ok",
+                        detail: `delegate · ${labels.join(" · ") || "no permissions"}  (${signerAddr.slice(0, 10)}…)`,
+                    });
+                }
+                else {
+                    checks.push({
+                        label: "Signer role",
+                        status: "warn",
+                        detail: `no delegate cap found for this tree  (${signerAddr.slice(0, 10)}…)`,
+                        fix: "Ask the tree owner to run: memfork grant --agent " + signerAddr,
+                    });
+                }
+            }
+            catch {
+                checks.push({
+                    label: "Signer role",
+                    status: "skip",
+                    detail: "could not query delegate cap",
+                });
+            }
+        }
+    }
+    // ── 7. Signer balance (warn if low) ─────────────────────────────────────────
     try {
         const addr = client.keypair.toSuiAddress();
         const balance = await client.suiClient.getBalance({ owner: addr });
@@ -157,7 +224,7 @@ export async function cmdDoctor() {
     catch {
         checks.push({ label: "Signer balance", status: "skip", detail: "could not fetch" });
     }
-    // ── 7. MemWal reachable ──────────────────────────────────────────────────────
+    // ── 8. MemWal reachable ──────────────────────────────────────────────────────
     try {
         const resp = await fetch(cfg.memwalRelayer + "/health", { signal: AbortSignal.timeout(5000) });
         checks.push({
@@ -175,7 +242,7 @@ export async function cmdDoctor() {
             fix: "Check your network. MemWal read/write will be unavailable.",
         });
     }
-    // ── 8. Artifact storage (optional) ──────────────────────────────────────────
+    // ── 9. Artifact storage (optional) ──────────────────────────────────────────
     if (cfg.artifacts.enabled) {
         // Artifacts require WAL tokens. Fetch the signer's WAL coin balance.
         // The WAL package ID is identical on mainnet and testnet.

package/dist/commands/install.js

@@ -163,9 +163,41 @@ function installCodex(cwd) {
             console.log(dim(`    Run manually: codex plugin add memforks@memforks`));
         }
     }
-    // ── Summary ────────────────────────────────────────────────────────────────
-    console.log("");
-    console.log(chalk.bold("Done.") + " Restart Codex to pick up the plugin and MCP server.");
+    // ── 3. Project-scoped Codex config (.codex/config.toml) ──────────────────
+    //
+    // Codex defaults to read-only sandbox, which blocks `memfork commit` (it
+    // needs to write ~/.memfork/ and hit the network). A project-level override
+    // turns on workspace-write + network without touching the user's global
+    // Codex config or any other project.
+    const projectCodexDir = path.join(cwd, ".codex");
+    const projectCodexCfg = path.join(projectCodexDir, "config.toml");
+    fs.mkdirSync(projectCodexDir, { recursive: true });
+    const sandboxBlock = `# Written by memfork install codex
+# workspace-write + network_access lets the agent run \`memfork commit\`
+# without escalation prompts, scoped to this project only.
+sandbox_mode = "workspace-write"
+
+[sandbox_workspace_write]
+network_access = true
+`;
+    if (!fs.existsSync(projectCodexCfg)) {
+        fs.writeFileSync(projectCodexCfg, sandboxBlock, "utf8");
+        console.log(ok(`Sandbox:    ${dim(projectCodexCfg)}  (workspace-write + network)`));
+    }
+    else {
+        // File already exists — only patch if the keys are missing.
+        const existing = fs.readFileSync(projectCodexCfg, "utf8");
+        let patched = existing;
+        if (!existing.includes("sandbox_mode")) {
+            patched += "\n" + sandboxBlock;
+            fs.writeFileSync(projectCodexCfg, patched, "utf8");
+            console.log(ok(`Sandbox:    ${dim(projectCodexCfg)}  (patched workspace-write + network)`));
+        }
+        else {
+            console.log(ok(`Sandbox:    ${dim(projectCodexCfg)}  (already configured)`));
+        }
+    }
+    // ── Summary (Codex) ────────────────────────────────────────────────────────
     console.log("");
     console.log(tip("The agent now has:"));
     console.log(dim("    memwal_recall / memwal_remember  — memory storage via MemWal MCP"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memfork/cli",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "description": "MemForks CLI — init, commit, recall, merge, install plugins",
   "repository": {
     "type": "git",