@merittdev/horus 0.21.6 → 0.21.7

package/dist/index.cjs

@@ -3057,7 +3057,7 @@ var init_version = __esm({
   "../../packages/core/src/version.ts"() {
     "use strict";
     init_cjs_shims();
-    HORUS_VERSION = true ? "0.21.6" : "dev";
+    HORUS_VERSION = true ? "0.21.7" : "dev";
     PINNED_SOURCE_VERSION = HORUS_VERSION;
     SOURCE_PIN_ENFORCED = HORUS_VERSION !== "dev";
     EXPECTED_INDEX_CAPABILITY = 2;
@@ -77378,6 +77378,35 @@ var CloudClient = class {
       `/v1/projects/${projectId}/memory-items${qs ? `?${qs}` : ""}`
     );
   }
+  // ── Team memory (HOR-464 / M4) ────────────────────────────────────────────
+  /**
+   * One-way PROMOTE local items into the workspace's shared team-memory store. Server-wins &
+   * idempotent (`ON CONFLICT (workspace_id, origin_client_id) DO NOTHING`); it clamps/skips
+   * confirmed-outcome (privacy). The body is a positive allowlist — vectors NEVER cross the wire.
+   */
+  promoteTeamMemory(projectId, body2) {
+    return this.request(
+      "POST",
+      `/v1/projects/${projectId}/team-memory/promote`,
+      body2
+    );
+  }
+  /**
+   * Read the workspace's team-memory items with `seq > since`, ORDER BY seq ASC. The v1 client pulls
+   * `since:'0'` and paginates on `nextCursor` until `hasMore` is false, then reconciles the local
+   * cache. `includeDeleted` surfaces tombstones (deletedAt) so the cache can drop removed rows.
+   */
+  listTeamMemorySince(projectId, q2) {
+    const params = new URLSearchParams();
+    params.set("since", q2.since);
+    if (q2.limit !== void 0) params.set("limit", String(q2.limit));
+    if (q2.includeDeleted) params.set("includeDeleted", "true");
+    if (q2.search) params.set("search", q2.search);
+    return this.request(
+      "GET",
+      `/v1/projects/${projectId}/team-memory?${params.toString()}`
+    );
+  }
 };
 
 // ../../packages/cli/src/lib/cloud/auth-store.ts
@@ -84445,6 +84474,21 @@ var memoryItem = pgTable(
     userId: text("user_id"),
     visibility: text("visibility").notNull().default("private"),
     // private|team
+    // HOR-464 (M4): team-memory cache provenance. `origin` distinguishes a locally-authored row
+    // (`local`) from a disposable read-cache row pulled from the cloud team store (`cloud`). The
+    // cloud-owned copy is server-authoritative — `origin='cloud'` rows are readonly locally (any
+    // local mutation throws `MemoryCacheReadonlyError`; re-promote to change) and are NEVER re-pushed
+    // by `memory sync` (which pushes `origin='local'` only). `cloudId` is the server team-memory id,
+    // `authorName` the promoting teammate (DISPLAY-ONLY — never feeds rank), `pulledAt` the last
+    // refresh time (staleness).
+    origin: text("origin").notNull().default("local"),
+    // local|cloud
+    cloudId: text("cloud_id"),
+    // server team_memory id (provenance/join)
+    authorName: text("author_name"),
+    // promoting teammate's display name (attribution, display-only)
+    pulledAt: timestamp("pulled_at", { withTimezone: true }),
+    // last cache-refresh time
     payload: jsonb("payload"),
     // forward-compat, zero-migration extension
     // Incident-family recall keys, populated at WRITE for incident-derived kinds
@@ -84461,7 +84505,9 @@ var memoryItem = pgTable(
     index("memory_item_scope_idx").on(t2.scope),
     index("memory_item_status_idx").on(t2.status),
     index("memory_item_tenancy_idx").on(t2.orgId, t2.workspaceId, t2.repo, t2.userId),
-    index("memory_item_signature_idx").on(t2.signature)
+    index("memory_item_signature_idx").on(t2.signature),
+    // HOR-464: fast repo-scoped split of local-authored vs cloud-cached rows (pull reconcile + sync filter).
+    index("memory_item_origin_idx").on(t2.repo, t2.origin)
   ]
 );
 var memoryLink = pgTable(
@@ -92771,6 +92817,16 @@ WHERE im.investigation_id IS NOT NULL AND im.project IS NULL;`,
 WHERE "project" IS NULL AND incident_input->>'repo' IS NOT NULL;`,
       'CREATE INDEX "investigations_project_created_idx" ON "investigations" ("project","created_at");'
     ]
+  },
+  {
+    "tag": "0012_memory_item_origin",
+    "statements": [
+      `ALTER TABLE "memory_item" ADD COLUMN "origin" text DEFAULT 'local' NOT NULL;`,
+      'ALTER TABLE "memory_item" ADD COLUMN "cloud_id" text;',
+      'ALTER TABLE "memory_item" ADD COLUMN "author_name" text;',
+      'ALTER TABLE "memory_item" ADD COLUMN "pulled_at" timestamp with time zone;',
+      'CREATE INDEX IF NOT EXISTS "memory_item_origin_idx" ON "memory_item" ("repo","origin");'
+    ]
   }
 ];
 
@@ -96403,6 +96459,16 @@ var MemorySecretError = class extends Error {
     this.kind = kind;
   }
 };
+var MemoryCacheReadonlyError = class extends Error {
+  id;
+  constructor(id) {
+    super(
+      `refusing to mutate a cloud-owned cached memory item (${id}); the team store owns it \u2014 re-promote to change it`
+    );
+    this.name = "MemoryCacheReadonlyError";
+    this.id = id;
+  }
+};
 var CLAIM_SECRET_PATTERNS = [
   { label: "private-key", re: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/ },
   { label: "jwt", re: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/ },
@@ -96562,6 +96628,7 @@ function createLocalMemoryStore(db) {
     async update(id, patch, opts) {
       const current = await getById(id);
       if (current === null) throw new Error(`memory item not found: ${id}`);
+      if (current.origin === "cloud") throw new MemoryCacheReadonlyError(id);
       const set = {};
       if (patch.claim !== void 0) {
         assertClaimClean(patch.claim);
@@ -96594,6 +96661,7 @@ function createLocalMemoryStore(db) {
       if (repo === "") return [];
       const conds = [eq(memoryItem.repo, repo)];
       if (q2.scope !== void 0) conds.push(eq(memoryItem.scope, q2.scope));
+      if (q2.origin !== void 0) conds.push(eq(memoryItem.origin, q2.origin));
       if (q2.visibility !== void 0) conds.push(eq(memoryItem.visibility, q2.visibility));
       if (q2.orgId !== void 0) conds.push(eq(memoryItem.orgId, q2.orgId));
       if (q2.workspaceId !== void 0) conds.push(eq(memoryItem.workspaceId, q2.workspaceId));
@@ -96614,6 +96682,7 @@ function createLocalMemoryStore(db) {
     async setStatus(id, status, audit) {
       const current = await getById(id);
       if (current === null) throw new Error(`memory item not found: ${id}`);
+      if (current.origin === "cloud") throw new MemoryCacheReadonlyError(id);
       await db.update(memoryItem).set({ status }).where(eq(memoryItem.id, id));
       await appendAudit({
         memoryId: id,
@@ -96627,6 +96696,7 @@ function createLocalMemoryStore(db) {
     async setVisibility(id, v4, audit) {
       const current = await getById(id);
       if (current === null) throw new Error(`memory item not found: ${id}`);
+      if (current.origin === "cloud") throw new MemoryCacheReadonlyError(id);
       await db.update(memoryItem).set({ visibility: v4 }).where(eq(memoryItem.id, id));
       await appendAudit({
         memoryId: id,
@@ -96771,6 +96841,96 @@ function createLocalMemoryStore(db) {
     },
     async history(id) {
       return db.select().from(memoryAudit).where(eq(memoryAudit.memoryId, id)).orderBy(desc(memoryAudit.at), desc(memoryAudit.id));
+    },
+    // ---- HOR-464 / M4: disposable team-memory read-cache + one-way promote ----
+    async upsertCached(item, audit) {
+      assertClaimClean(item.claim);
+      const repo = (item.repo ?? "").trim();
+      if (repo === "") throw new Error("memory_item requires a repo (HOR-46 fail-closed)");
+      const id = (item.id ?? "").trim();
+      if (id === "") throw new Error("upsertCached requires a stable item id (the origin client id)");
+      const status = item.status ?? "fresh";
+      const now = /* @__PURE__ */ new Date();
+      const values2 = {
+        ...item,
+        id,
+        repo,
+        status,
+        origin: "cloud",
+        pulledAt: now,
+        signature: null,
+        tags: null
+      };
+      await db.insert(memoryItem).values(values2).onConflictDoUpdate({
+        target: memoryItem.id,
+        set: {
+          kind: values2.kind,
+          claim: values2.claim,
+          scope: values2.scope,
+          source: values2.source,
+          status,
+          confidence: values2.confidence,
+          visibility: values2.visibility ?? "team",
+          evidence: values2.evidence,
+          cloudId: values2.cloudId ?? null,
+          authorName: values2.authorName ?? null,
+          lastVerifiedAt: values2.lastVerifiedAt ?? null,
+          lastVerifiedHash: values2.lastVerifiedHash ?? null,
+          origin: "cloud",
+          // Re-scope to the repo we're pulling into. The cache is disposable and
+          // project-isolated (HOR-46): a team item's id is the promoter's local id and is
+          // stable across a workspace, so pulling it from a different repo on the same store
+          // must move the cache row to the current repo — otherwise "pull here" silently
+          // leaves it invisible here, stuck in whichever repo first pulled it.
+          repo: values2.repo,
+          pulledAt: now
+        }
+      });
+      const row = await getById(id);
+      if (row === null) throw new Error("memory_item upsertCached returned no row");
+      await appendAudit({
+        memoryId: id,
+        action: "pulled",
+        actor: audit.actor,
+        fromStatus: null,
+        toStatus: status,
+        note: audit.note ?? null,
+        detail: { origin: "cloud", ...values2.cloudId ? { cloudId: values2.cloudId } : {} }
+      });
+      return row;
+    },
+    async reconcileCache(repo, keepIds) {
+      const r = repo.trim();
+      if (r === "") return 0;
+      const conds = keepIds.length > 0 ? and(
+        eq(memoryItem.repo, r),
+        eq(memoryItem.origin, "cloud"),
+        notInArray(memoryItem.id, keepIds)
+      ) : and(eq(memoryItem.repo, r), eq(memoryItem.origin, "cloud"));
+      const deleted = await db.delete(memoryItem).where(conds).returning();
+      return deleted.length;
+    },
+    async markPromoted(id, provenance, audit) {
+      const current = await getById(id);
+      if (current === null) throw new Error(`memory item not found: ${id}`);
+      await db.update(memoryItem).set({
+        visibility: "team",
+        origin: "cloud",
+        cloudId: provenance.cloudId,
+        authorName: provenance.authorName ?? current.authorName ?? null
+      }).where(eq(memoryItem.id, id));
+      await appendAudit({
+        memoryId: id,
+        action: "promote",
+        actor: audit.actor,
+        fromStatus: null,
+        toStatus: null,
+        note: audit.note ?? `promoted to team (cloud id ${provenance.cloudId})`,
+        detail: { origin: "cloud", visibility: "team", cloudId: provenance.cloudId }
+      });
+      const updated = await getById(id);
+      if (updated === null) throw new Error(`memory item vanished during promote: ${id}`);
+      return updated;
     }
   };
 }
@@ -122314,6 +122474,12 @@ function fromWire(r, repo) {
     repo,
     userId: r.createdByUserId ?? null,
     visibility: r.visibility,
+    // This is the write-only private mirror path (dualWrite reads local): a round-tripped record is
+    // the device's OWN authored item, so it carries no team-cache provenance (HOR-464).
+    origin: "local",
+    cloudId: null,
+    authorName: null,
+    pulledAt: null,
     payload: null,
     // Incident-family recall keys are LOCAL-ONLY context (like vectors): they never enter the
     // cloud-sync path, so a cloud-read row carries neither.
@@ -122375,6 +122541,10 @@ function createCloudMemoryStore(client, cfg) {
         repo: item.repo ?? repoFallback,
         userId: item.userId ?? null,
         visibility: input.visibility ?? "private",
+        origin: "local",
+        cloudId: null,
+        authorName: null,
+        pulledAt: null,
         payload: null,
         // Incident-family recall keys stay LOCAL-ONLY — never synced, so the cloud echo carries neither.
         signature: null,
@@ -122409,6 +122579,10 @@ function createCloudMemoryStore(client, cfg) {
         repo: repoFallback,
         userId: null,
         visibility: "private",
+        origin: "local",
+        cloudId: null,
+        authorName: null,
+        pulledAt: null,
         payload: null,
         signature: null,
         tags: null
@@ -122667,6 +122841,10 @@ function recalledToJSON(r) {
     effectiveStatus: r.freshness.status,
     confidence: r.item.confidence,
     visibility: r.item.visibility,
+    // HOR-464: provenance + teammate attribution. `origin='cloud'` marks a pulled team item; the
+    // `authorName` is DISPLAY-ONLY (it is never read into rank/order — the honesty invariant).
+    origin: r.item.origin,
+    authorName: r.item.authorName ?? null,
     evidence: r.item.evidence,
     freshness: {
       label: r.freshness.label,
@@ -122693,6 +122871,10 @@ function renderStoredItems(items) {
     lines.push(
       `  - ${r.item.kind} \xB7 scope: ${r.item.scope} \xB7 ${r.freshness.label}${drift} \xB7 confidence: ${conf}`
     );
+    if (r.item.origin === "cloud") {
+      const who = r.item.authorName ? `teammate ${r.item.authorName}` : "a teammate";
+      lines.push(`  - ${import_picocolors36.default.dim(`shared by ${who} (team)`)}`);
+    }
   }
   return lines.join("\n");
 }
@@ -123171,6 +123353,7 @@ async function runMemorySync(opts) {
     const store = createLocalMemoryStore(db);
     items = await store.query({
       repo: project,
+      origin: "local",
       status: SYNCABLE_STATUSES,
       limit: opts.limit ?? 5e3
     });
@@ -123305,6 +123488,215 @@ async function runMemorySync(opts) {
   }
   return failed > 0 ? 1 : 0;
 }
+function toPromoteInput(item) {
+  return {
+    originClientId: item.id,
+    kind: item.kind,
+    claim: item.claim,
+    scope: item.scope,
+    source: item.source,
+    status: item.status,
+    confidence: item.confidence,
+    contentHash: item.lastVerifiedHash ?? null,
+    provenance: {}
+  };
+}
+async function runMemoryPromote(id, opts) {
+  const json2 = opts.json === true;
+  const fail = (msg) => {
+    if (json2) console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+    else console.error(import_picocolors36.default.red(msg));
+    return 1;
+  };
+  const memId = (id ?? "").trim();
+  if (memId === "") return fail("A memory item id is required.");
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  if (!isCloudActive(cfg) || !cfg.project) {
+    return fail("This repo isn't linked to a cloud project. Run `horus cloud link` first.");
+  }
+  const session = authedClient();
+  if (!session) return fail("Not logged in. Run `horus login` first.");
+  let config2;
+  try {
+    config2 = await loadConfig(opts.config);
+  } catch (err2) {
+    return fail(err2.message);
+  }
+  const project = resolveProject(config2, opts.repo);
+  if (!project) return 1;
+  const { db, sql: sql2 } = await openDb(config2.database.url);
+  try {
+    const store = createLocalMemoryStore(db);
+    const row = await store.get(memId);
+    if (row === null) return fail(`Memory item not found: ${memId}`);
+    if (row.kind === "confirmed-outcome" || row.source === "confirmed-outcome") {
+      return fail("Refusing to promote a confirmed-outcome item \u2014 it stays private (spec \xA75.2).");
+    }
+    if (row.origin === "cloud") {
+      if (json2) console.log(JSON.stringify({ ok: true, id: memId, alreadyTeam: true }, null, 2));
+      else console.log(import_picocolors36.default.dim(`${memId} is already a team item \u2014 nothing to promote.`));
+      return 0;
+    }
+    const res = await session.client.promoteTeamMemory(cfg.project.id, {
+      items: [toPromoteInput(row)]
+    });
+    const promoted = res.items.find((it2) => it2.originClientId === memId);
+    if (!promoted) {
+      return fail(
+        `The server did not promote ${memId} (skipped ${res.skipped}/${res.total}). Local state unchanged.`
+      );
+    }
+    const updated = await store.markPromoted(
+      memId,
+      { cloudId: promoted.id, authorName: promoted.authorName ?? null },
+      { actor: { kind: "user" }, note: `promoted to team ${cfg.project.slug}` }
+    );
+    if (json2) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: true,
+            id: memId,
+            cloudId: promoted.id,
+            visibility: updated.visibility,
+            origin: updated.origin
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      console.log(
+        import_picocolors36.default.green(`Promoted ${memId} to team memory (${cfg.project.slug}) \u2014 now visible to teammates.`)
+      );
+    }
+    return 0;
+  } catch (err2) {
+    return fail(err2.message);
+  } finally {
+    await sql2.end();
+  }
+}
+var TEAM_PULL_PAGE_LIMIT = 200;
+var TEAM_PULL_MAX_PAGES = 1e4;
+function formatAge3(ms) {
+  const mins = Math.floor(ms / 6e4);
+  if (mins < 1) return "just now";
+  if (mins < 60) return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs}h ago`;
+  return `${Math.floor(hrs / 24)}d ago`;
+}
+async function runMemoryPull(opts) {
+  const json2 = opts.json === true;
+  const fail = (msg) => {
+    if (json2) console.log(JSON.stringify({ ok: false, error: msg }, null, 2));
+    else console.error(import_picocolors36.default.red(msg));
+    return 1;
+  };
+  const root = repoRootOrCwd(opts.cwd);
+  const cfg = readCloudConfig(root);
+  if (!isCloudActive(cfg) || !cfg.project) {
+    return fail("This repo isn't linked to a cloud project. Run `horus cloud link` first.");
+  }
+  const session = authedClient();
+  if (!session) return fail("Not logged in. Run `horus login` first.");
+  let config2;
+  try {
+    config2 = await loadConfig(opts.config);
+  } catch (err2) {
+    return fail(err2.message);
+  }
+  const project = resolveProject(config2, opts.repo);
+  if (!project) return 1;
+  const { db, sql: sql2 } = await openDb(config2.database.url);
+  try {
+    const store = createLocalMemoryStore(db);
+    const vectorIndex = buildVectorIndex(config2, project);
+    const items = [];
+    let since = "0";
+    try {
+      for (let page = 0; page < TEAM_PULL_MAX_PAGES; page++) {
+        const res = await session.client.listTeamMemorySince(cfg.project.id, {
+          since,
+          limit: TEAM_PULL_PAGE_LIMIT,
+          includeDeleted: true
+        });
+        items.push(...res.items);
+        if (!res.hasMore || !res.nextCursor) break;
+        since = res.nextCursor;
+      }
+    } catch (err2) {
+      if (err2 instanceof CloudOfflineError) {
+        const cached2 = await store.query({ repo: project, origin: "cloud" });
+        const newest = cached2.map((c4) => c4.pulledAt ? new Date(c4.pulledAt).getTime() : 0).reduce((a2, b5) => Math.max(a2, b5), 0);
+        const note = newest > 0 ? `stale \u2014 last pulled ${formatAge3(Date.now() - newest)}` : "stale \u2014 never pulled";
+        if (json2) {
+          console.log(
+            JSON.stringify({ ok: true, offline: true, stale: true, cached: cached2.length, note }, null, 2)
+          );
+        } else {
+          console.log(import_picocolors36.default.yellow(`Offline \u2014 serving ${cached2.length} cached team item(s) (${note}).`));
+        }
+        return 0;
+      }
+      throw err2;
+    }
+    const keepIds = [];
+    let upserted = 0;
+    let removed = 0;
+    for (const it2 of items) {
+      if (it2.deletedAt) {
+        await bestEffortRemove(vectorIndex, it2.originClientId);
+        continue;
+      }
+      const cacheRow = {
+        id: it2.originClientId,
+        // stable cross-device id (the promoting device's local id)
+        kind: it2.kind,
+        claim: it2.claim,
+        scope: it2.scope,
+        source: it2.source,
+        status: it2.status ?? "fresh",
+        // A null server confidence stores as 0 — honest (unknown confidence ranks low, never inflated).
+        confidence: it2.confidence ?? 0,
+        evidence: [],
+        repo: project,
+        visibility: "team",
+        cloudId: it2.id,
+        authorName: it2.authorName
+      };
+      await store.upsertCached(cacheRow, { actor: { kind: "system" }, note: "memory pull" });
+      await bestEffortUpsert(vectorIndex, {
+        memoryId: it2.originClientId,
+        claim: it2.claim,
+        repo: project,
+        scope: it2.scope
+      });
+      keepIds.push(it2.originClientId);
+      upserted += 1;
+    }
+    removed = await store.reconcileCache(project, keepIds);
+    if (json2) {
+      console.log(
+        JSON.stringify({ ok: true, project, pulled: upserted, removed, total: items.length }, null, 2)
+      );
+    } else {
+      console.log(
+        import_picocolors36.default.green(
+          `Pulled ${upserted} team memory item(s)` + (removed ? `, dropped ${removed} stale` : "") + "."
+        )
+      );
+      console.log(import_picocolors36.default.dim("Team items are read-only locally \u2014 re-promote to change one. Vectors stay local."));
+    }
+    return 0;
+  } catch (err2) {
+    return fail(err2.message);
+  } finally {
+    await sql2.end();
+  }
+}
 function outcomeLabelToJSON(l2) {
   return {
     id: l2.id,
@@ -129302,6 +129694,12 @@ Examples:
       process.exitCode = await runMemorySync(opts);
     }
   );
+  memory.command("promote <id>").description("Promote a local memory item into the shared team memory (one-way; refuses confirmed-outcome)").option("-c, --config <path>", "path to horus.config.ts").option("--repo <name>", "repository/project WITHIN the loaded config (default: inferred from cwd) \u2014 cross-repo targeting is --config or cd").option("--json", "output JSON").action(async (id, opts) => {
+    process.exitCode = await runMemoryPromote(id, opts);
+  });
+  memory.command("pull").description("Refresh the local cache of shared team memory (full pull; offline serves stale cache)").option("-c, --config <path>", "path to horus.config.ts").option("--repo <name>", "repository/project WITHIN the loaded config (default: inferred from cwd) \u2014 cross-repo targeting is --config or cd").option("--force", "force a full refresh even if the cache looks current").option("--json", "output JSON").action(async (opts) => {
+    process.exitCode = await runMemoryPull(opts);
+  });
   const evalCmd = program2.command("eval").description("Read-only accuracy harness over Horus's outcome-label eval set (never writes labels)");
   evalCmd.command("build").description("Emit a byte-stable corpus-<version>.jsonl + manifest from the eval set (read-only)").option("-c, --config <path>", "path to horus.config.ts").option("--repo <name>", "repository/project WITHIN the loaded config (default: inferred from cwd) \u2014 cross-repo targeting is --config or cd").option("--source <source>", "filter to one signal source: feedback | confirm").option("--days <n>", "only include labels from the last N days", (v4) => Number(v4)).option("--limit <n>", "max labels to scan", (v4) => Number(v4)).option("--out <dir>", "output directory for the corpus + manifest (default: ./.horus/eval)").option("--version <v>", "corpus schema version tag (default: v1)").option("--json", "output JSON").action(
     async (opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {