@mysten-incubation/memwal-mcp 0.0.14-dev.1 → 0.0.14-dev.11

package/README.md

@@ -23,6 +23,86 @@ Add Walrus Memory MCP to your MCP client config:
 }
 ```
 
+## How the plugin launches the server
+
+The [MemWal plugin](https://memory.walrus.xyz/mcp/claude-code) does **not** use the
+`npx` form above. `npx` resolves a package *name* against the directory the MCP
+client was started in — your project — so a project that contains an installed
+`@mysten-incubation/memwal-mcp` claiming the pinned version would be run instead of
+the published one. Pinning the version in the `npx` command does not prevent that:
+the planted package simply claims the pinned version.
+
+Instead, every plugin launch config runs the plugin's launcher:
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "command": "node",
+      "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/launch_mcp.mjs"]
+    }
+  }
+}
+```
+
+The launcher installs the pinned version once into a directory it owns and then
+runs that absolute entry point with the current `node` binary:
+
+```
+~/.memwal/runtime/memwal-mcp@<version>/node_modules/@mysten-incubation/memwal-mcp/dist/bin/memwal-mcp.js
+```
+
+It never consults your project's `node_modules` or a `PATH`-relative bin shim, and
+it fails rather than falling back to the package name if the pinned version cannot
+be installed. Everything after the script path is forwarded to the server
+unchanged, so flags such as `--namespace work` or `--relayer <url>` work exactly as
+they do above.
+
+The runtime directory is trusted because of what it is, not how it is spelled:
+
+- It must be outside the project the client started in. An absolute path is not
+  enough on its own — a client expands `${workspaceFolder}` to an absolute path
+  inside the repository, and a repository can commit a whole fake install there.
+- It must be a real directory (not a symlink), owned by you, and not group- or
+  world-writable. The launcher creates it with mode `0700` and refuses to run code
+  out of it otherwise. If you see a refusal, `chmod 700 ~/.memwal ~/.memwal/runtime`.
+- `MEMWAL_MCP_RUNTIME_DIR` moves it, subject to exactly the same rules.
+
+The one-off install is run with `--ignore-scripts` (so no `preinstall` or
+`postinstall` from the package or its dependencies executes), against an explicitly
+pinned public registry, with the `npm_config_*` and `NODE_OPTIONS` environment
+scrubbed for that spawn — npm ranks environment variables above every `.npmrc`, so
+a client `env` block would otherwise choose the registry. npm itself is run as
+`node <npm-cli.js>` resolved from the running node binary where that layout exists.
+
+What that does **not** give you is an integrity check of the package contents: it
+establishes where the code came from and that nobody else can write it, not that
+the registry served the bytes a reviewer read. If you install from a private
+registry, pre-populate the directory yourself (below) — the launcher then finds the
+install and never runs npm at all.
+
+If you configure MemWal without the plugin and want the same property, install the
+version you intend to run into a directory outside any project and point your
+client at its absolute path:
+
+```sh
+mkdir -p ~/.memwal/runtime/memwal-mcp@0.0.14
+chmod 700 ~/.memwal ~/.memwal/runtime
+npm install --ignore-scripts --prefix ~/.memwal/runtime/memwal-mcp@0.0.14 \
+  @mysten-incubation/memwal-mcp@0.0.14
+```
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "command": "node",
+      "args": ["/absolute/path/to/home/.memwal/runtime/memwal-mcp@0.0.14/node_modules/@mysten-incubation/memwal-mcp/dist/bin/memwal-mcp.js"]
+    }
+  }
+}
+```
+
 ## Login
 
 Run the login flow manually:
@@ -38,6 +118,7 @@ The command opens your browser, asks you to connect your Sui wallet, and saves c
 ```sh
 memwal-mcp
 memwal-mcp login
+memwal-mcp auto-save on|off
 memwal-mcp --logout
 memwal-mcp --help
 ```
@@ -52,9 +133,111 @@ Use CLI flags or environment variables to override the default Walrus Memory end
 | `--web-url <url>` | `MEMWAL_WEB_URL` | Override the web app URL used during login. |
 | `--label <text>` | `MEMWAL_CLIENT_LABEL` | Friendly delegate-key label shown in Walrus Memory. |
 | `--namespace <name>` (alias `--ns`) | `MEMWAL_NAMESPACE` | Default memory namespace applied when the agent omits one. |
+| `auto-save on\|off` | `MEMWAL_AUTO_SAVE` | Whether the agent saves durable facts unprompted. On once you agree at login; see [Automatic Memory](#automatic-memory). |
 
 Enable verbose stderr logging with `MEMWAL_MCP_DEBUG=1`.
 
+Set `MEMWAL_MCP_TRANSPORT=http` to dial the relayer's Streamable HTTP endpoint instead of the default SSE pair. Opt-in: reconnect replay is not transport-aware yet, so a write interrupted mid-send may be retried and duplicated.
+
+## Automatic Memory
+
+MemWal saves durable facts — preferences, decisions, constraints, recurring
+workflows — as you state them, without asking each time. That is what it is for,
+so it is on. It asks you once first.
+
+The question comes up in your terminal the first time you run `login`:
+
+```
+MemWal can save things about you automatically.
+
+What that means: when you state a preference, a decision, or a setting in
+chat — "I prefer pnpm", "we deploy from dev", "the relayer is at X" —
+MemWal writes it to your memory without asking each time, so it is there
+in your next session and in every other client you use.
+
+Before you choose:
+
+  - Saved memories are permanent. They go to Walrus, which is immutable
+    storage. You can stop saving new ones at any time, but you cannot
+    delete one that is already saved.
+  - They are encrypted to your account. Only your delegate key reads them.
+  - MemWal strips obvious credentials — API keys, tokens, passwords,
+    private keys — before saving. Treat that as a safety net, not a
+    guarantee: do not paste secrets into a session with this on.
+
+  [1] Save automatically      recommended, this is what MemWal is for
+  [2] Only save when I ask    nothing is saved unless you say "remember this"
+
+Your choice [1/2]:
+```
+
+**Saved memories are permanent.** Walrus is immutable storage: you can stop
+saving new ones at any time, but you cannot delete one already saved — which is
+why you are asked before it starts rather than after.
+
+Until you answer, nothing is saved unprompted on a new install; "remember this"
+and recall work throughout. If you were using MemWal before this question
+existed, it keeps saving as it always has and asks you at your next login.
+
+The question is only ever asked in a terminal. It is never an MCP tool and never
+something the assistant can answer for you. Change it any time:
+
+```sh
+npx -y @mysten-incubation/memwal-mcp auto-save on
+npx -y @mysten-incubation/memwal-mcp auto-save off
+npx -y @mysten-incubation/memwal-mcp auto-save        # report the current setting
+```
+
+The answer is stored as `{"autoSave": true}` in `settings.json` next to your
+credentials file, so it follows the same project-local-beats-global resolution.
+To pin one MCP client instead, set the environment variable — it overrides the
+file and skips the question:
+
+```json
+{
+  "mcpServers": {
+    "memwal": {
+      "command": "npx",
+      "args": ["-y", "@mysten-incubation/memwal-mcp"],
+      "env": { "MEMWAL_AUTO_SAVE": "1" }
+    }
+  }
+}
+```
+
+Recall is never gated, and neither is an explicit "remember this" — the setting
+only decides whether the agent saves things you did not ask it to save. Saying
+no costs nothing and is not asked about again.
+
+### What is never saved
+
+Walrus storage is append-only and encrypted: a memory that lands **cannot be
+edited or deleted**. So credentials are excluded whichever way you answer, by the same
+rules stated in the server instructions, the tool descriptions and the plugin
+hooks — and enforced by a check that runs before any text is sent:
+
+- passwords, API keys, access and refresh tokens, private keys, seed and
+  recovery phrases, authorization headers, session cookies, and connection
+  strings or URLs with an embedded `user:password`;
+- anything you say not to save ("don't save this", "off the record");
+- pasted third-party content — a fenced block, a quoted passage — which is not
+  a fact about you.
+
+When a message mixes a preference with a credential, the **preference is kept**
+and only the credential is removed: "I prefer dark mode, db is
+`postgres://admin:hunter2@db.internal/app`" is stored with the password gone and
+the host intact. The agent is told which kinds were removed; the secret itself
+is never stored, logged, or echoed back.
+
+Detection targets specific credential shapes rather than "looks random", so
+identifiers you *do* want remembered — blob ids, Sui object ids, commit SHAs,
+digests — pass through untouched. Where a secret is indistinguishable from an
+identifier, the **label** decides: pasting your `credentials.json` has its
+`delegatePrivateKey` removed, while the same 64 hex characters with nothing
+calling them a key are stored as the digest they look like. The trade-off is
+that a secret in no recognisable shape, and with no label near it, can still
+slip past the check — which is why the model-facing rules exist alongside it.
+
 ## Default Namespace
 
 By default the MCP tool schemas expose an optional `namespace` argument and the
@@ -146,12 +329,66 @@ You can also pass explicit URLs:
 
 ## Credential Storage
 
-Credentials are stored locally in `~/.memwal/credentials.json`. To remove them:
+Credentials are stored locally in `~/.memwal/credentials.json`, and the
+automatic-memory setting in `settings.json` beside it. To remove the
+credentials:
 
 ```sh
 npx -y @mysten-incubation/memwal-mcp --logout
 ```
 
+A sign-in that is still in flight also writes a `login-pending.json`
+write-ahead record, beside `credentials.json` in `~/.memwal`. It holds the
+delegate keypair minted for that sign-in, written before the browser can
+register the public half on-chain so an interrupted login can be reclaimed
+instead of paid for a second time. Same owner-only mode `0600` as
+`credentials.json`.
+
+It is removed once the sign-in completes, on `--logout`, and on a successful
+recovery at the next start. A record older than 24 hours is discarded rather
+than reused.
+
+### Per-project credentials
+
+A project can keep its own `.memwal/credentials.json` so memory written from it
+goes to a separate account. That file lives inside the repository, where anyone
+who can commit to it — or who can get you to open a clone — could otherwise
+choose the account and relayer your memories go to. So it is **ignored until you
+approve it**, once per machine:
+
+```sh
+cd path/to/project
+npx -y @mysten-incubation/memwal-mcp approve-project
+```
+
+Until then the global credentials are used, and a line on stderr names the file
+that was skipped and the destination it wanted. An approval covers one exact
+project path, account, delegate key and relayer: if any of those change, it has
+to be approved again. The record is kept in `~/.memwal/project-approvals.json`,
+outside the repository, so a repository cannot carry its own approval.
+`revoke-project` withdraws it.
+
+Approving also picks the file that is **written**: a later sign-in from that
+project saves a delegate private key into `.memwal/credentials.json` in plain
+text, inside the repository. `approve-project` says so, and so does the sign-in
+warning. Add `.memwal/` to your `.gitignore`. The write-ahead record is the one
+thing that stays out: a project sign-in keeps it in `~/.memwal/login-pending/`,
+one file per approved project, so no key material lands in the checkout and a
+sign-in is still reclaimable only by the project that started it.
+
+`MEMWAL_CREDS_DIR` points the credentials, the approval record and the
+write-ahead record at a directory of your choosing and overrides project
+resolution entirely, with no approval. Because it skips the gate, it must be an
+**absolute path outside the current project**: a relative value would resolve
+against the working directory and put the approval record inside the
+repository, and an MCP client passes on the `env` block it reads from
+`.cursor/mcp.json` / `.vscode/mcp.json` / `.claude/settings.json` in the
+checkout — where `${workspaceFolder}` is expanded, so an in-project absolute
+path is not proof you chose it. Anything else is refused with an error naming
+the value, rather than quietly ignored. An empty value means unset.
+
+`memwal_health` reports the destination in use as `account=… relayer=…`.
+
 ## License
 
 Apache-2.0

package/dist/auth-required.d.ts

@@ -67,6 +67,7 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -102,6 +103,7 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -142,6 +144,7 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;
@@ -181,6 +184,7 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             job_id?: undefined;
             job_ids?: undefined;
             waitMs?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -213,6 +217,7 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             waitMs?: undefined;
             query?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -237,6 +242,36 @@ export declare const ALL_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
+        };
+        additionalProperties: boolean;
+        required?: undefined;
+    };
+} | {
+    name: string;
+    title: string;
+    annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            freshKey: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            text?: undefined;
+            namespace?: undefined;
+            facts?: undefined;
+            job_id?: undefined;
+            job_ids?: undefined;
+            waitMs?: undefined;
+            query?: undefined;
+            limit?: undefined;
+            maxDistance?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;
@@ -271,6 +306,7 @@ export declare const TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -306,6 +342,7 @@ export declare const TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -346,6 +383,7 @@ export declare const TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;
@@ -385,6 +423,7 @@ export declare const TOOL_DEFINITIONS: ({
             job_id?: undefined;
             job_ids?: undefined;
             waitMs?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -417,6 +456,7 @@ export declare const TOOL_DEFINITIONS: ({
             waitMs?: undefined;
             query?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -441,6 +481,36 @@ export declare const TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
+        };
+        additionalProperties: boolean;
+        required?: undefined;
+    };
+} | {
+    name: string;
+    title: string;
+    annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            freshKey: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            text?: undefined;
+            namespace?: undefined;
+            facts?: undefined;
+            job_id?: undefined;
+            job_ids?: undefined;
+            waitMs?: undefined;
+            query?: undefined;
+            limit?: undefined;
+            maxDistance?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;
@@ -475,6 +545,7 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -510,6 +581,7 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -550,6 +622,7 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;
@@ -589,6 +662,7 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             job_id?: undefined;
             job_ids?: undefined;
             waitMs?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -621,6 +695,7 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             waitMs?: undefined;
             query?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
         };
         required: string[];
         additionalProperties: boolean;
@@ -645,6 +720,36 @@ export declare const SIGNED_OUT_TOOL_DEFINITIONS: ({
             query?: undefined;
             limit?: undefined;
             maxDistance?: undefined;
+            freshKey?: undefined;
+        };
+        additionalProperties: boolean;
+        required?: undefined;
+    };
+} | {
+    name: string;
+    title: string;
+    annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            freshKey: {
+                type: string;
+                default: boolean;
+                description: string;
+            };
+            text?: undefined;
+            namespace?: undefined;
+            facts?: undefined;
+            job_id?: undefined;
+            job_ids?: undefined;
+            waitMs?: undefined;
+            query?: undefined;
+            limit?: undefined;
+            maxDistance?: undefined;
         };
         additionalProperties: boolean;
         required?: undefined;

package/dist/auth-required.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-required.d.ts","sourceRoot":"","sources":["../src/auth-required.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAiLzE;;;;;;;;;;;;;;0EAc0E;AAC1E,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAOrD,CAAC;AAMH;;0EAE0E;AAC1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA6B,CAAC;AAS/D;;4CAE4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAuB,CAAC;AAErD;;8BAE8B;AAC9B,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAwB,CAAC;AA2CjE;;;mCAGmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;4DAIwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAmID;;yCAEyC;AACzC,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,iBAAiB,CAAC;IACzB;;sCAEkC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B;AAwID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgE7B"}
+{"version":3,"file":"auth-required.d.ts","sourceRoot":"","sources":["../src/auth-required.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AA2MzE;;;;;;;;;;;;;;0EAc0E;AAC1E,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAOrD,CAAC;AAMH;;0EAE0E;AAC1E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA6B,CAAC;AAS/D;;4CAE4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAuB,CAAC;AAErD;;8BAE8B;AAC9B,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAwB,CAAC;AA+CjE;;;mCAGmC;AACnC,MAAM,WAAW,kBAAkB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;4DAIwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AA6ID;;yCAEyC;AACzC,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,iBAAiB,CAAC;IACzB;;sCAEkC;IAClC,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B;AA4ID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACvC,MAAM,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAgE7B"}

package/dist/auth-required.js

@@ -25,11 +25,24 @@ import { credsPath, loadCreds } from "./auth.js";
 import { rememberInitializeClientInfo } from "./client-info.js";
 import { loginFailureNotice, loginPrompt, loginSuccessNotification } from "./messages.js";
 import { log } from "./logger.js";
-import { startOrReuseLoginFlow, resolveLoginTimeoutMs } from "./login.js";
+import { startOrReuseLoginFlow, resolveLoginTimeoutMs, isLoginSuperseded } from "./login.js";
 import { AUTH_REQUIRED_INSTRUCTIONS } from "./instructions.js";
+import { SECRET_EXCLUSION_RULES, SECRET_EXCLUSION_SUMMARY, AUTO_SAVE_OPT_IN_RULE, } from "./memory-policy.js";
 import { MEMWAL_MCP_VERSION } from "./version.js";
-const SIGNED_OUT_REMEMBER = "Save a fact to the user's Walrus Memory personal memory. Call ONLY when the user explicitly asks to remember/save something. Pass the full, detailed text — never summarize.";
-const SIGNED_IN_REMEMBER = "Save a durable fact about the user or project to their Walrus Memory. Call this PROACTIVELY whenever the user states a preference, decision, constraint, correction, identity detail, or recurring workflow — even if they did not say 'remember this'. Skip one-off tasks, the current file or bug, and small talk. Pass the full statement; do not summarize. To save several facts at once, use memwal_remember_bulk instead. By default this returns in ~1s once the relayer has accepted the job (job_id) — the Walrus write is still in flight and the fact is NOT stored yet. Do not claim it is saved. Settle it with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means it already stored (optional wait budget).";
+/**
+ * WALM-642: every write-tool description below ends with the shared policy
+ * block, the same text the `instructions` field and the plugin hooks carry, so
+ * an agent that only ever sees one of the three still gets the same rules.
+ * The signed-out variants get the one-line summary — they exist to keep a
+ * credential-less model from spamming writes, and the full block would be the
+ * longest thing in a list of tools that cannot run yet.
+ */
+const SIGNED_OUT_REMEMBER = "Save a fact to the user's Walrus Memory personal memory. Call ONLY when the user explicitly asks to remember/save something. Pass the full, detailed text — never summarize. " +
+    SECRET_EXCLUSION_SUMMARY;
+const SIGNED_IN_REMEMBER = "Save a durable fact about the user or project to their Walrus Memory. Call this PROACTIVELY whenever the user states a preference, decision, constraint, correction, identity detail, or recurring workflow — even if they did not say 'remember this' — provided they have turned automatic memory on. Skip one-off tasks, the current file or bug, and small talk. Pass the full statement; do not summarize. To save several facts at once, use memwal_remember_bulk instead. By default this returns in ~1s once the relayer has accepted the job (job_id) — the Walrus write is still in flight and the fact is NOT stored yet. Do not claim it is saved. Settle it with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means it already stored (optional wait budget). " +
+    AUTO_SAVE_OPT_IN_RULE +
+    " " +
+    SECRET_EXCLUSION_RULES;
 const SIGNED_OUT_RECALL = "Search the user's Walrus Memory for facts relevant to a query. Returns matching memories ranked by relevance.";
 const SIGNED_IN_RECALL = "Search the user's Walrus Memory for relevant facts before responding. Call this PROACTIVELY at the start of a task, or whenever the user references past work, prior decisions, their preferences, or anything you may have stored earlier — don't wait to be asked. A single focused query is usually enough — recall is a real retrieval over encrypted storage, so do NOT fire multiple redundant searches for the same question. Returns matching memories ranked by relevance.";
 /** Build the static memory-tool list. `proactive` is true for the signed-in
@@ -56,7 +69,8 @@ function buildToolDefinitions(proactive) {
             name: "memwal_remember_bulk",
             title: "Remember Multiple Facts",
             annotations: { readOnlyHint: false, destructiveHint: false },
-            description: "Save multiple durable facts in one call. Use when you learned several distinct facts at once (onboarding details, a list of preferences, decisions from a discussion). Pass an array of complete fact statements (max 20) — do not summarize. Prefer this over repeated memwal_remember calls. By default this returns in ~1s once the relayer has accepted the batch (job_ids) — the Walrus writes are still in flight and the facts are NOT stored yet. Do not claim they are saved. Settle them with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means that fact already stored (optional wait budget).",
+            description: "Save multiple durable facts in one call. Use when you learned several distinct facts at once (onboarding details, a list of preferences, decisions from a discussion). Pass an array of complete fact statements (max 20) — do not summarize. Prefer this over repeated memwal_remember calls. By default this returns in ~1s once the relayer has accepted the batch (job_ids) — the Walrus writes are still in flight and the facts are NOT stored yet. Do not claim they are saved. Settle them with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means that fact already stored (optional wait budget). " +
+                (proactive ? AUTO_SAVE_OPT_IN_RULE + " " + SECRET_EXCLUSION_RULES : SECRET_EXCLUSION_SUMMARY),
             inputSchema: {
                 type: "object",
                 properties: {
@@ -125,7 +139,8 @@ function buildToolDefinitions(proactive) {
             name: "memwal_analyze",
             title: "Analyze and Remember",
             annotations: { readOnlyHint: false, destructiveHint: true },
-            description: "Extract memorable facts from a longer passage of text (preferences, habits, biographical info, constraints) and save each as a separate Walrus Memory memory. Use this when you want MemWal's LLM to split the facts out of a transcript or notes for you; if you already know the exact facts, use memwal_remember or memwal_remember_bulk instead.",
+            description: "Extract memorable facts from a longer passage of text (preferences, habits, biographical info, constraints) and save each as a separate Walrus Memory memory. Use this when you want MemWal's LLM to split the facts out of a transcript or notes for you; if you already know the exact facts, use memwal_remember or memwal_remember_bulk instead. " +
+                (proactive ? AUTO_SAVE_OPT_IN_RULE + " " + SECRET_EXCLUSION_RULES : SECRET_EXCLUSION_SUMMARY),
             inputSchema: {
                 type: "object",
                 properties: {
@@ -169,7 +184,13 @@ function buildToolDefinitions(proactive) {
             description: "Sign this MCP client into your Walrus Memory account by opening a browser. Run once when the agent reports Walrus Memory is not signed in. Opens the dashboard in the default browser, waits for wallet approval, then writes credentials to ~/.memwal/credentials.json. Other memwal_* tools become usable on the next call after a successful login.",
             inputSchema: {
                 type: "object",
-                properties: {},
+                properties: {
+                    freshKey: {
+                        type: "boolean",
+                        default: false,
+                        description: "Mint a new delegate key instead of reusing the one a previous unfinished sign-in left pending. Leave false for an ordinary login. Set it only after a normal sign-in has already failed on the pending key — it abandons that key, which must then be removed from the dashboard if it was approved on-chain, and the new one needs its own add_delegate_key transaction.",
+                    },
+                },
                 additionalProperties: false,
             },
         },
@@ -239,13 +260,17 @@ const LOGIN_INSTRUCTION = [
 /** Replaces {@link LOGIN_INSTRUCTION} after a failed attempt, which
  * {@link loginFailureNotice} has just described. The generic copy promises "no
  * client restart" and leads with `memwal_login`; for a key the user already
- * approved, a restart is the only thing that recovers it and signing in again
- * cannot register it twice. So the retry is offered only for the case it
- * actually fixes. */
+ * approved, a restart is the only thing that recovers it and a plain retry
+ * reuses it rather than registering a second one. So the retry names
+ * `freshKey` for the case the plain one cannot fix. */
 const LOGIN_RETRY_INSTRUCTION = [
-    "If you did not approve the wallet step, start a new sign-in: call the `memwal_login`",
-    "tool from this client, or run `npx -y @mysten-incubation/memwal-mcp login`. Open the",
-    "new link straight away and leave this client running through the wallet prompt.",
+    "Start a new sign-in: call the `memwal_login` tool from this client, or run",
+    "`npx -y @mysten-incubation/memwal-mcp login`. Open the new link straight away and",
+    "leave this client running through the wallet prompt.",
+    "",
+    "If that keeps failing on the same key, call `memwal_login` with `freshKey: true` to",
+    "mint a new one. That abandons the pending key: if you already approved it on-chain,",
+    "remove it from the dashboard afterwards.",
 ].join("\n");
 /** Set when a background `memwal_login` ends without credentials. The tool call
  * already returned the URL by then, so this is the only place left to say so. */
@@ -286,7 +311,7 @@ function sendLogMessage(level, text) {
  * issues any other memwal_* tool to verify — which now succeeds because
  * the bridge picks up the saved creds on its next call.
  */
-async function handleLoginToolCall(config, _progressToken) {
+async function handleLoginToolCall(config, _progressToken, freshKey) {
     // Fire login but DO NOT await the wallet callback — it runs in the
     // background. openBrowser: false because (a) child-process spawning a
     // browser is unreliable across MCP clients, and (b) macOS `open <url>`
@@ -297,12 +322,17 @@ async function handleLoginToolCall(config, _progressToken) {
     // Concurrent memwal_login calls join this in-flight flow instead of
     // opening a second listener (that race hung later recall/remember).
     lastLoginFailure = null;
+    let discardedKey;
     const session = startOrReuseLoginFlow({
         relayerUrl: config.relayerUrl,
         webUrl: config.webUrl,
         label: config.label,
         timeoutMs: resolveLoginTimeoutMs(),
         openBrowser: false,
+        freshKey,
+        onDiscarded: (key) => {
+            discardedKey = key;
+        },
         onUrl: (url) => {
             sendLogMessage("info", `Walrus Memory MCP login URL: ${url}`);
         },
@@ -336,6 +366,9 @@ async function handleLoginToolCall(config, _progressToken) {
         url = await Promise.race([session.url, timeoutPromise]);
     }
     catch (err) {
+        if (isLoginSuperseded(err)) {
+            return { isError: true, text: "This sign-in was replaced by a newer memwal_login. Open that result instead of starting another login." };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         log.error("memwal_login.tool.url_not_ready", { msg });
         return {
@@ -360,6 +393,7 @@ async function handleLoginToolCall(config, _progressToken) {
             url,
             credentialsPath: credsPath(),
             signedIn: loadCreds() !== null,
+            discardedKey,
         }),
     };
 }
@@ -433,7 +467,7 @@ function handleAuthLine(line, config) {
             // Returns near-instantly with the click-able URL. The listener
             // stays alive in the background — see handleLoginToolCall for the
             // rationale on not blocking.
-            void handleLoginToolCall(config, progressToken).then((result) => {
+            void handleLoginToolCall(config, progressToken, params.arguments?.freshKey === true).then((result) => {
                 writeStdoutMessage({
                     jsonrpc: "2.0",
                     id,