@phren/cli 0.0.10 → 0.0.12

package/mcp/dist/memory-ui-scripts.js

@@ -1,22 +1,41 @@
-export function renderSkillUiEnhancementScript(authToken) {
+/**
+ * Returns a <script> block with shared browser helpers used across all UI IIFEs:
+ *   window._phrenEsc(s)          — HTML-escape a value
+ *   window._phrenAuthToken       — the current auth token
+ *   window._phrenAuthUrl(base)   — append _auth param to a URL
+ *   window._phrenAuthBody(body)  — append _auth param to a form body
+ *   window._phrenFetchCsrfToken(cb) — fetch the CSRF token and call cb(token)
+ */
+export function renderSharedWebUiHelpers(authToken) {
+    return `(function() {
+  window._phrenAuthToken = '${authToken}';
+  window._phrenEsc = function(s) {
+    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+  };
+  window._phrenAuthUrl = function(base) {
+    var tok = window._phrenAuthToken;
+    return base + (base.indexOf('?') === -1 ? '?' : '&') + '_auth=' + encodeURIComponent(tok);
+  };
+  window._phrenAuthBody = function(body) {
+    var tok = window._phrenAuthToken;
+    return body + (tok ? '&_auth=' + encodeURIComponent(tok) : '');
+  };
+  window._phrenFetchCsrfToken = function(cb) {
+    var tok = window._phrenAuthToken;
+    var url = '/api/csrf-token' + (tok ? '?_auth=' + encodeURIComponent(tok) : '');
+    fetch(url).then(function(r) { return r.json(); }).then(function(d) { cb(d.token || null); }).catch(function() { cb(null); });
+  };
+})();`;
+}
+export function renderSkillUiEnhancementScript(_authToken) {
     return `(function() {
-    var _skillAuthToken = '${authToken}';
     var _skillCurrent = null;
     var _skillEditing = false;
+    var esc = window._phrenEsc;
+    var authUrl = window._phrenAuthUrl;
+    var authBody = window._phrenAuthBody;
+    var fetchCsrfToken = window._phrenFetchCsrfToken;
 
-    function esc(s) {
-      return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
-    }
-    function authUrl(base) {
-      return base + (base.indexOf('?') === -1 ? '?' : '&') + '_auth=' + encodeURIComponent(_skillAuthToken);
-    }
-    function authBody(body) {
-      return body + (_skillAuthToken ? '&_auth=' + encodeURIComponent(_skillAuthToken) : '');
-    }
-    function fetchCsrfToken(cb) {
-      var url = '/api/csrf-token' + (_skillAuthToken ? '?_auth=' + encodeURIComponent(_skillAuthToken) : '');
-      fetch(url).then(function(r) { return r.json(); }).then(function(d) { cb(d.token || null); }).catch(function() { cb(null); });
-    }
     function renderSkillReader(content) {
       var reader = document.getElementById('skills-reader');
       if (!_skillCurrent || !reader) return;
@@ -166,9 +185,8 @@ export function renderSkillUiEnhancementScript(authToken) {
     });
   })();`;
 }
-export function renderProjectReferenceEnhancementScript(authToken) {
+export function renderProjectReferenceEnhancementScript(_authToken) {
     return `(function() {
-    var _referenceAuthToken = '${authToken}';
     var _referenceState = {
       project: '',
       topicsData: null,
@@ -177,20 +195,11 @@ export function renderProjectReferenceEnhancementScript(authToken) {
       selectedKey: '',
       editor: null
     };
+    var esc = window._phrenEsc;
+    var authUrl = window._phrenAuthUrl;
+    var authBody = window._phrenAuthBody;
+    var fetchCsrfToken = window._phrenFetchCsrfToken;
 
-    function esc(s) {
-      return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
-    }
-    function authUrl(base) {
-      return base + (base.indexOf('?') === -1 ? '?' : '&') + '_auth=' + encodeURIComponent(_referenceAuthToken);
-    }
-    function authBody(body) {
-      return body + (_referenceAuthToken ? '&_auth=' + encodeURIComponent(_referenceAuthToken) : '');
-    }
-    function fetchCsrfToken(cb) {
-      var url = '/api/csrf-token' + (_referenceAuthToken ? '?_auth=' + encodeURIComponent(_referenceAuthToken) : '');
-      fetch(url).then(function(r) { return r.json(); }).then(function(d) { cb(d.token || null); }).catch(function() { cb(null); });
-    }
     function currentProject() {
       var selected = document.querySelector('.project-card.selected');
       return selected ? (selected.getAttribute('data-project') || '') : '';
@@ -585,15 +594,12 @@ export function renderTasksAndSettingsScript(authToken) {
     return `(function() {
     var _tsAuthToken = '${authToken}';
     var _allTasks = [];
+    var esc = window._phrenEsc;
 
     function tsAuthUrl(base) {
       return base + (base.indexOf('?') === -1 ? '?' : '&') + '_auth=' + encodeURIComponent(_tsAuthToken);
     }
 
-    function esc(s) {
-      return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
-    }
-
     function priorityBadge(p) {
       if (!p) return '';
       var colors = { high: '#ef4444', medium: '#f59e0b', low: '#6b7280' };
@@ -839,14 +845,95 @@ export function renderTasksAndSettingsScript(authToken) {
       });
     }
 
+    function getSettingsProject() {
+      var sel = document.getElementById('settings-project-select');
+      return sel ? sel.value : '';
+    }
+
+    function postProjectOverride(project, field, value, clearField) {
+      var csrfUrl = _tsAuthToken ? tsAuthUrl('/api/csrf-token') : '/api/csrf-token';
+      fetch(csrfUrl).then(function(r) { return r.json(); }).then(function(csrfData) {
+        var payload = { project: project, field: field, value: value || '', clear: clearField ? 'true' : 'false' };
+        var body = new URLSearchParams(payload);
+        if (csrfData.token) body.set('_csrf', csrfData.token);
+        var url = _tsAuthToken ? tsAuthUrl('/api/settings/project-overrides') : '/api/settings/project-overrides';
+        return fetch(url, { method: 'POST', body: body, headers: { 'content-type': 'application/x-www-form-urlencoded' } });
+      }).then(function(r) { return r.json(); }).then(function(data) {
+        if (!data.ok) {
+          setSettingsStatus(data.error || 'Failed to update project override', 'err');
+          return;
+        }
+        _settingsLoaded = false;
+        loadSettings();
+        setSettingsStatus('Project override updated', 'ok');
+      }).catch(function(err) {
+        setSettingsStatus('Failed: ' + String(err), 'err');
+      });
+    }
+
     function loadSettings() {
-      var url = _tsAuthToken ? tsAuthUrl('/api/settings') : '/api/settings';
+      var selectedProject = getSettingsProject();
+      var baseUrl = '/api/settings';
+      if (selectedProject) baseUrl += '?project=' + encodeURIComponent(selectedProject);
+      var url = _tsAuthToken ? tsAuthUrl(baseUrl) : baseUrl;
+
+      // Populate project selector on first load
+      var sel = document.getElementById('settings-project-select');
+      if (sel && sel.querySelectorAll('option[data-proj]').length === 0) {
+        var configUrl = _tsAuthToken ? tsAuthUrl('/api/config') : '/api/config';
+        fetch(configUrl).then(function(r) { return r.json(); }).then(function(d) {
+          if (d.ok && d.projects && d.projects.length && sel) {
+            d.projects.forEach(function(p) {
+              var opt = document.createElement('option');
+              opt.value = p; opt.textContent = p;
+              opt.setAttribute('data-proj', '1');
+              sel.appendChild(opt);
+            });
+            if (selectedProject) sel.value = selectedProject;
+          }
+        }).catch(function() {});
+      }
+
+      var scopeNote = document.getElementById('settings-scope-note');
+      if (scopeNote) {
+        scopeNote.textContent = selectedProject
+          ? 'Showing effective config for "' + selectedProject + '". Overrides are saved to that project\'s phren.project.yaml.'
+          : 'Showing global settings. Select a project to view and edit per-project overrides.';
+      }
+
+      // Wire onChange once
+      if (sel && !sel.getAttribute('data-onchange-wired')) {
+        sel.setAttribute('data-onchange-wired', '1');
+        sel.addEventListener('change', function() {
+          _settingsLoaded = false;
+          loadSettings();
+        });
+      }
+
       fetch(url).then(function(r) { return r.json(); }).then(function(data) {
         if (!data.ok) {
           setSettingsStatus(data.error || 'Failed to load settings', 'err');
           return;
         }
 
+        // Use merged config when a project is selected, else global
+        var effective = (selectedProject && data.merged) ? data.merged : null;
+        var rawOverrides = (selectedProject && data.overrides) ? data.overrides : null;
+        var effectiveSensitivity = effective ? effective.findingSensitivity : (data.findingSensitivity || 'balanced');
+        var effectiveTaskMode = effective ? effective.taskMode : (data.taskMode || 'auto');
+        var effectiveProactivity = data.proactivity || 'high';
+        var effectiveRetention = (effective && effective.retentionPolicy) ? effective.retentionPolicy : (data.retentionPolicy || {});
+        var effectiveWorkflow = (effective && effective.workflowPolicy) ? effective.workflowPolicy : (data.workflowPolicy || {});
+
+        var isProject = Boolean(selectedProject);
+
+        function sourceBadge(isOverride) {
+          if (!isProject) return '';
+          return isOverride
+            ? '<span style="font-size:10px;font-weight:600;color:var(--warning);margin-left:6px;padding:1px 6px;border:1px solid color-mix(in srgb,var(--warning) 40%,transparent);border-radius:var(--radius-sm)">project override</span>'
+            : '<span style="font-size:10px;color:var(--text-muted);margin-left:6px;padding:1px 6px;border:1px solid var(--border);border-radius:var(--radius-sm)">global default</span>';
+        }
+
         var findingDescriptions = {
           high: 'Capture findings proactively, including minor observations.',
           medium: 'Capture findings that are likely useful.',
@@ -856,56 +943,129 @@ export function renderTasksAndSettingsScript(authToken) {
 
         var findingsEl = document.getElementById('settings-findings');
         if (findingsEl) {
-          var fsUi = findingStorageToUi(data.findingSensitivity || 'balanced');
+          var fsUi = findingStorageToUi(effectiveSensitivity);
           var findingsHtml = '';
+          var fsSensOverride = rawOverrides && rawOverrides.findingSensitivity != null;
           findingsHtml += '<div class="settings-control">';
-          findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Finding sensitivity</span></div>';
+          findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Finding sensitivity</span>' + sourceBadge(fsSensOverride);
+          if (isProject && fsSensOverride) {
+            findingsHtml += '<button data-ts-action="clearProjectOverride" data-field="findingSensitivity" class="settings-chip" style="font-size:11px;margin-left:auto">Clear override</button>';
+          }
+          findingsHtml += '</div>';
           findingsHtml += '<div class="settings-chip-row">';
           ['high', 'medium', 'low', 'minimal'].forEach(function(level) {
             var active = level === fsUi ? ' active' : '';
-            findingsHtml += '<button data-ts-action="setFindingSensitivity" data-level="' + esc(level) + '" class="settings-chip' + active + '">' + esc(level) + '</button>';
+            var action = isProject ? 'setProjectFindingSensitivity' : 'setFindingSensitivity';
+            findingsHtml += '<button data-ts-action="' + action + '" data-level="' + esc(level) + '" class="settings-chip' + active + '">' + esc(level) + '</button>';
           });
           findingsHtml += '</div>';
           findingsHtml += '<div class="settings-control-note" id="settings-fs-desc">' + esc(findingDescriptions[fsUi] || '') + '</div>';
           findingsHtml += '</div>';
-          findingsHtml += '<div class="settings-control">';
-          findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Auto-capture</span>';
-          findingsHtml += '<button data-ts-action="toggleAutoCapture" data-enabled="' + (data.autoCaptureEnabled ? 'true' : 'false') + '" class="settings-chip' + (data.autoCaptureEnabled ? ' active' : '') + '">' + (data.autoCaptureEnabled ? 'On' : 'Off') + '</button></div>';
-          findingsHtml += '<div class="settings-control-note">Turn automatic finding capture on or off.</div>';
-          findingsHtml += '</div>';
-          findingsHtml += '<div class="settings-control">';
-          findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Consolidation threshold</span><span class="badge">' + esc(String(data.consolidationEntryThreshold || 25)) + ' entries</span></div>';
-          findingsHtml += '<div class="settings-control-note">Consolidation is also recommended after 60+ days with at least 10 new entries.</div>';
-          findingsHtml += '</div>';
+          if (!isProject) {
+            findingsHtml += '<div class="settings-control">';
+            findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Auto-capture</span>';
+            findingsHtml += '<button data-ts-action="toggleAutoCapture" data-enabled="' + (data.autoCaptureEnabled ? 'true' : 'false') + '" class="settings-chip' + (data.autoCaptureEnabled ? ' active' : '') + '">' + (data.autoCaptureEnabled ? 'On' : 'Off') + '</button></div>';
+            findingsHtml += '<div class="settings-control-note">Turn automatic finding capture on or off.</div>';
+            findingsHtml += '</div>';
+            findingsHtml += '<div class="settings-control">';
+            findingsHtml += '<div class="settings-control-header"><span class="settings-control-label">Consolidation threshold</span><span class="badge">' + esc(String(data.consolidationEntryThreshold || 25)) + ' entries</span></div>';
+            findingsHtml += '<div class="settings-control-note">Consolidation is also recommended after 60+ days with at least 10 new entries.</div>';
+            findingsHtml += '</div>';
+          }
           findingsEl.innerHTML = findingsHtml;
         }
 
         var behaviorEl = document.getElementById('settings-behavior');
         if (behaviorEl) {
-          var taskMode = data.taskMode === 'suggest' ? 'manual' : (data.taskMode || 'auto');
-          var proactivity = data.proactivity || 'high';
+          var taskMode = effectiveTaskMode || 'auto';
+          var proactivity = effectiveProactivity;
           var behaviorHtml = '';
+          var taskModeOverride = rawOverrides && rawOverrides.taskMode != null;
           behaviorHtml += '<div class="settings-control">';
-          behaviorHtml += '<div class="settings-control-header"><span class="settings-control-label">Task mode</span></div>';
+          behaviorHtml += '<div class="settings-control-header"><span class="settings-control-label">Task mode</span>' + sourceBadge(taskModeOverride);
+          if (isProject && taskModeOverride) {
+            behaviorHtml += '<button data-ts-action="clearProjectOverride" data-field="taskMode" class="settings-chip" style="font-size:11px;margin-left:auto">Clear override</button>';
+          }
+          behaviorHtml += '</div>';
           behaviorHtml += '<div class="settings-chip-row">';
-          ['auto', 'manual', 'off'].forEach(function(mode) {
+          ['auto', 'suggest', 'manual', 'off'].forEach(function(mode) {
             var active = mode === taskMode ? ' active' : '';
-            behaviorHtml += '<button data-ts-action="setTaskMode" data-mode="' + esc(mode) + '" class="settings-chip' + active + '">' + esc(mode) + '</button>';
-          });
-          behaviorHtml += '</div></div>';
-          behaviorHtml += '<div class="settings-control">';
-          behaviorHtml += '<div class="settings-control-header"><span class="settings-control-label">Proactivity level</span></div>';
-          behaviorHtml += '<div class="settings-chip-row">';
-          ['high', 'medium', 'low'].forEach(function(level) {
-            var active = level === proactivity ? ' active' : '';
-            behaviorHtml += '<button data-ts-action="setProactivity" data-level="' + esc(level) + '" class="settings-chip' + active + '">' + esc(level) + '</button>';
+            var action = isProject ? 'setProjectTaskMode' : 'setTaskMode';
+            behaviorHtml += '<button data-ts-action="' + action + '" data-mode="' + esc(mode) + '" class="settings-chip' + active + '">' + esc(mode) + '</button>';
           });
           behaviorHtml += '</div></div>';
+          if (!isProject) {
+            behaviorHtml += '<div class="settings-control">';
+            behaviorHtml += '<div class="settings-control-header"><span class="settings-control-label">Proactivity level</span></div>';
+            behaviorHtml += '<div class="settings-chip-row">';
+            ['high', 'medium', 'low'].forEach(function(level) {
+              var active = level === proactivity ? ' active' : '';
+              behaviorHtml += '<button data-ts-action="setProactivity" data-level="' + esc(level) + '" class="settings-chip' + active + '">' + esc(level) + '</button>';
+            });
+            behaviorHtml += '</div></div>';
+          }
           behaviorEl.innerHTML = behaviorHtml;
         }
 
+        var retentionEl = document.getElementById('settings-retention');
+        if (retentionEl) {
+          var ret = effectiveRetention;
+          var retHtml = '';
+          function retRow(label, field, value, note) {
+            var isOverride = isProject && rawOverrides && rawOverrides.retentionPolicy && rawOverrides.retentionPolicy[field] !== undefined;
+            retHtml += '<div class="settings-control">';
+            retHtml += '<div class="settings-control-header"><span class="settings-control-label">' + esc(label) + '</span>' + sourceBadge(isOverride);
+            retHtml += '<span class="settings-control-value" style="margin-left:auto">' + esc(String(value != null ? value : '—')) + '</span>';
+            if (isProject && isOverride) {
+              retHtml += '<button data-ts-action="clearProjectOverride" data-field="' + esc(field) + '" class="settings-chip" style="font-size:11px">Clear</button>';
+            }
+            retHtml += '</div>';
+            if (note) retHtml += '<div class="settings-control-note">' + esc(note) + '</div>';
+            if (isProject) {
+              retHtml += '<div style="display:flex;gap:8px;align-items:center;margin-top:8px">' +
+                '<input type="number" id="ret-input-' + esc(field) + '" value="' + esc(String(value != null ? value : '')) + '" style="width:100px;border:1px solid var(--border);border-radius:var(--radius-sm);padding:4px 8px;font-size:var(--text-sm);background:var(--surface);color:var(--ink)">' +
+                '<button data-ts-action="setProjectRetention" data-field="' + esc(field) + '" class="settings-chip active" style="font-size:11px">Set</button>' +
+                '</div>';
+            }
+            retHtml += '</div>';
+          }
+          retRow('TTL days', 'ttlDays', ret.ttlDays, 'Memories older than this are eligible for pruning.');
+          retRow('Retention days', 'retentionDays', ret.retentionDays, 'Hard cutoff — memories past this age are removed.');
+          retRow('Auto-accept threshold', 'autoAcceptThreshold', ret.autoAcceptThreshold, 'Confidence score (0–1) above which memories are auto-accepted.');
+          retRow('Min inject confidence', 'minInjectConfidence', ret.minInjectConfidence, 'Minimum confidence score to inject a memory into context.');
+          retentionEl.innerHTML = retHtml;
+        }
+
+        var workflowEl = document.getElementById('settings-workflow');
+        if (workflowEl) {
+          var wf = effectiveWorkflow;
+          var wfHtml = '';
+          var lctOverride = isProject && rawOverrides && rawOverrides.workflowPolicy && rawOverrides.workflowPolicy.lowConfidenceThreshold !== undefined;
+          var riskySectionsOverride = isProject && rawOverrides && rawOverrides.workflowPolicy && Array.isArray(rawOverrides.workflowPolicy.riskySections) && rawOverrides.workflowPolicy.riskySections.length > 0;
+          wfHtml += '<div class="settings-control">';
+          wfHtml += '<div class="settings-control-header"><span class="settings-control-label">Low confidence threshold</span>' + sourceBadge(lctOverride);
+          wfHtml += '<span class="settings-control-value" style="margin-left:auto">' + esc(String(wf.lowConfidenceThreshold != null ? wf.lowConfidenceThreshold : '—')) + '</span>';
+          if (isProject && lctOverride) {
+            wfHtml += '<button data-ts-action="clearProjectOverride" data-field="lowConfidenceThreshold" class="settings-chip" style="font-size:11px">Clear</button>';
+          }
+          if (isProject) {
+            wfHtml += '</div><div style="display:flex;gap:8px;align-items:center;margin-top:8px">' +
+              '<input type="number" id="wf-input-lowConfidenceThreshold" min="0" max="1" step="0.05" value="' + esc(String(wf.lowConfidenceThreshold != null ? wf.lowConfidenceThreshold : '')) + '" style="width:100px;border:1px solid var(--border);border-radius:var(--radius-sm);padding:4px 8px;font-size:var(--text-sm);background:var(--surface);color:var(--ink)">' +
+              '<button data-ts-action="setProjectWorkflow" data-field="lowConfidenceThreshold" class="settings-chip active" style="font-size:11px">Set</button>' +
+              '</div>';
+          } else {
+            wfHtml += '</div>';
+          }
+          wfHtml += '<div class="settings-control-note">Memories below this confidence score are flagged for review.</div></div>';
+          wfHtml += '<div class="settings-control">';
+          wfHtml += '<div class="settings-control-header"><span class="settings-control-label">Risky sections</span>' + sourceBadge(riskySectionsOverride);
+          wfHtml += '<span class="settings-control-value" style="margin-left:auto">' + esc(Array.isArray(wf.riskySections) ? wf.riskySections.join(', ') : '—') + '</span></div>';
+          wfHtml += '<div class="settings-control-note">Sections that trigger approval gates when memories are written.</div></div>';
+          workflowEl.innerHTML = wfHtml;
+        }
+
         var integrationsEl = document.getElementById('settings-integrations');
-        if (integrationsEl) {
+        if (integrationsEl && !isProject) {
           var tools = Array.isArray(data.hookTools) ? data.hookTools : [];
           var html = '';
           html += '<div class="settings-control-header" style="margin-bottom:10px"><span class="settings-control-label">Global MCP</span>';
@@ -923,6 +1083,8 @@ export function renderTasksAndSettingsScript(authToken) {
           });
           html += '</tbody></table>';
           integrationsEl.innerHTML = html;
+        } else if (integrationsEl && isProject) {
+          integrationsEl.innerHTML = '<div style="color:var(--muted);font-size:var(--text-sm)">Integration settings are global — switch to Global scope to edit them.</div>';
         }
       }).catch(function(err) {
         setSettingsStatus('Failed to load settings: ' + String(err), 'err');
@@ -1063,6 +1225,33 @@ export function renderTasksAndSettingsScript(authToken) {
       else if (action === 'toggleIntegrationTool') { toggleIntegrationTool(actionEl.getAttribute('data-tool')); }
       else if (action === 'showSessionDetail') { showSessionDetail(actionEl.getAttribute('data-session-id')); }
       else if (action === 'backToSessionsList') { backToSessionsList(); }
+      else if (action === 'setProjectFindingSensitivity') {
+        var proj = getSettingsProject();
+        var level = actionEl.getAttribute('data-level');
+        postProjectOverride(proj, 'findingSensitivity', findingUiToStorage(level || 'medium'), false);
+      }
+      else if (action === 'setProjectTaskMode') {
+        var proj = getSettingsProject();
+        postProjectOverride(proj, 'taskMode', actionEl.getAttribute('data-mode') || 'auto', false);
+      }
+      else if (action === 'clearProjectOverride') {
+        var proj = getSettingsProject();
+        postProjectOverride(proj, actionEl.getAttribute('data-field') || '', '', true);
+      }
+      else if (action === 'setProjectRetention') {
+        var proj = getSettingsProject();
+        var field = actionEl.getAttribute('data-field') || '';
+        var inputEl = document.getElementById('ret-input-' + field);
+        var val = inputEl ? inputEl.value : '';
+        postProjectOverride(proj, field, val, false);
+      }
+      else if (action === 'setProjectWorkflow') {
+        var proj = getSettingsProject();
+        var field = actionEl.getAttribute('data-field') || '';
+        var inputEl = document.getElementById('wf-input-' + field);
+        var val = inputEl ? inputEl.value : '';
+        postProjectOverride(proj, field, val, false);
+      }
     });
 
     window.setFindingSensitivity = function(level) {
@@ -1104,10 +1293,10 @@ export function renderSearchScript(authToken) {
   var _searchProjectsLoaded = false;
 
   function searchAuthUrl(path) {
-    return _searchAuthToken ? path + (path.includes('?') ? '&' : '?') + 'token=' + encodeURIComponent(_searchAuthToken) : path;
+    return window._phrenAuthUrl ? window._phrenAuthUrl(path) : (_searchAuthToken ? path + (path.includes('?') ? '&' : '?') + '_auth=' + encodeURIComponent(_searchAuthToken) : path);
   }
 
-  function esc(s) { var d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+  var esc = window._phrenEsc;
 
   function doSearch() {
     var q = document.getElementById('search-query').value.trim();

package/mcp/dist/memory-ui-server.js

@@ -12,7 +12,8 @@ import { readInstallPreferences, writeInstallPreferences, writeGovernanceInstall
 import { buildGraph, collectProjectsForUI, collectSkillsForUI, getHooksData, isAllowedFilePath, readSyncSnapshot, recentAccepted, recentUsage, } from "./memory-ui-data.js";
 import { CONSOLIDATION_ENTRY_THRESHOLD } from "./content-validate.js";
 import { ensureTopicReferenceDoc, getProjectTopicsResponse, listProjectReferenceDocs, pinProjectTopicSuggestion, readReferenceContent, reclassifyLegacyTopicDocs, unpinProjectTopicSuggestion, writeProjectTopics, } from "./project-topics.js";
-import { getWorkflowPolicy, updateWorkflowPolicy } from "./governance-policy.js";
+import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides } from "./governance-policy.js";
+import { updateProjectConfigOverrides } from "./project-config.js";
 import { findSkill } from "./skill-registry.js";
 import { setSkillEnabledAndSync } from "./skill-files.js";
 import { listAllSessions, getSessionArtifacts } from "./mcp-session.js";
@@ -290,7 +291,7 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
         repairPreexistingInstall(phrenPath);
     }
     catch (err) {
-        if ((process.env.PHREN_DEBUG || process.env.PHREN_DEBUG))
+        if ((process.env.PHREN_DEBUG))
             process.stderr.write(`[phren] web-ui repair: ${errorMessage(err)}\n`);
     }
     const authToken = opts?.authToken;
@@ -365,7 +366,7 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
                 }
                 catch (err) {
                     res.writeHead(200, { "content-type": "application/json" });
-                    res.end(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }));
+                    res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
                 }
             });
             return;
@@ -856,8 +857,13 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
             try {
                 const prefs = readInstallPreferences(phrenPath);
                 const workflowPolicy = getWorkflowPolicy(phrenPath);
+                const retentionPolicy = getRetentionPolicy(phrenPath);
                 const hooksData = getHooksData(phrenPath);
                 const proactivityFindings = prefs.proactivityFindings || prefs.proactivity || "high";
+                const qs = url.includes("?") ? querystring.parse(url.slice(url.indexOf("?") + 1)) : {};
+                const settingsProject = String(qs.project || "");
+                const merged = settingsProject && isValidProjectName(settingsProject) ? mergeConfig(phrenPath, settingsProject) : null;
+                const overrides = settingsProject && isValidProjectName(settingsProject) ? getProjectConfigOverrides(phrenPath, settingsProject) : null;
                 res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
                 res.end(JSON.stringify({
                     ok: true,
@@ -871,6 +877,10 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
                     hooksEnabled: hooksData.globalEnabled,
                     mcpEnabled: prefs.mcpEnabled !== false,
                     hookTools: hooksData.tools,
+                    retentionPolicy,
+                    workflowPolicy,
+                    merged,
+                    overrides,
                 }));
             }
             catch (err) {
@@ -975,6 +985,108 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
             });
             return;
         }
+        // POST /api/settings/project-overrides — write per-project config overrides
+        if (req.method === "POST" && pathname === "/api/settings/project-overrides") {
+            void readFormBody(req, res).then((parsed) => {
+                if (!parsed)
+                    return;
+                if (!requirePostAuth(req, res, url, parsed, authToken, true))
+                    return;
+                if (!requireCsrf(res, parsed, csrfTokens, true))
+                    return;
+                const project = String(parsed.project || "");
+                const field = String(parsed.field || "");
+                const value = String(parsed.value || "");
+                const clearField = String(parsed.clear || "") === "true";
+                if (!project || !isValidProjectName(project)) {
+                    res.writeHead(400, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Invalid project name" }));
+                    return;
+                }
+                const registeredProjects = getProjectDirs(phrenPath, profile).map((d) => path.basename(d)).filter((p) => p !== "global");
+                const isRegistered = registeredProjects.includes(project);
+                const registrationWarning = isRegistered ? undefined : `Project '${project}' is not registered in the active profile. Config was saved but it will have no effect until the project is added with 'phren add'.`;
+                const VALID_FIELDS = {
+                    findingSensitivity: ["minimal", "conservative", "balanced", "aggressive"],
+                    proactivity: ["high", "medium", "low"],
+                    proactivityFindings: ["high", "medium", "low"],
+                    proactivityTask: ["high", "medium", "low"],
+                    taskMode: ["off", "manual", "suggest", "auto"],
+                };
+                const NUMERIC_RETENTION_FIELDS = ["ttlDays", "retentionDays", "autoAcceptThreshold", "minInjectConfidence"];
+                const NUMERIC_WORKFLOW_FIELDS = ["lowConfidenceThreshold"];
+                try {
+                    updateProjectConfigOverrides(phrenPath, project, (current) => {
+                        const next = { ...current };
+                        if (clearField) {
+                            if (field in VALID_FIELDS)
+                                delete next[field];
+                            else if (NUMERIC_RETENTION_FIELDS.includes(field)) {
+                                if (next.retentionPolicy)
+                                    delete next.retentionPolicy[field];
+                            }
+                            else if (NUMERIC_WORKFLOW_FIELDS.includes(field)) {
+                                if (next.workflowPolicy)
+                                    delete next.workflowPolicy[field];
+                            }
+                            return next;
+                        }
+                        if (field in VALID_FIELDS) {
+                            const allowed = VALID_FIELDS[field];
+                            if (!allowed.includes(value))
+                                throw new Error(`Invalid value "${value}" for ${field}`);
+                            next[field] = value;
+                        }
+                        else if (NUMERIC_RETENTION_FIELDS.includes(field)) {
+                            const num = parseFloat(value);
+                            if (!Number.isFinite(num) || num < 0)
+                                throw new Error(`Invalid numeric value for ${field}`);
+                            next.retentionPolicy = { ...next.retentionPolicy, [field]: num };
+                        }
+                        else if (NUMERIC_WORKFLOW_FIELDS.includes(field)) {
+                            const num = parseFloat(value);
+                            if (!Number.isFinite(num) || num < 0 || num > 1)
+                                throw new Error(`Invalid value for ${field} (must be 0–1)`);
+                            next.workflowPolicy = { ...next.workflowPolicy, [field]: num };
+                        }
+                        else {
+                            throw new Error(`Unknown config field: ${field}`);
+                        }
+                        return next;
+                    });
+                    const merged = mergeConfig(phrenPath, project);
+                    res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+                    res.end(JSON.stringify({ ok: true, config: merged }));
+                }
+                catch (err) {
+                    res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+                    res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
+                }
+            });
+            return;
+        }
+        if (req.method === "GET" && pathname === "/api/config") {
+            if (!requireGetAuth(req, res, url, authToken, true))
+                return;
+            const qs = url.includes("?") ? querystring.parse(url.slice(url.indexOf("?") + 1)) : {};
+            const project = String(qs.project || "");
+            if (project && !isValidProjectName(project)) {
+                res.writeHead(400, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Invalid project name" }));
+                return;
+            }
+            try {
+                const config = mergeConfig(phrenPath, project || undefined);
+                const projects = getProjectDirs(phrenPath, profile).map((d) => path.basename(d)).filter((p) => p !== "global");
+                res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+                res.end(JSON.stringify({ ok: true, config, projects }));
+            }
+            catch (err) {
+                res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
+                res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
+            }
+            return;
+        }
         if (req.method === "GET" && pathname === "/api/csrf-token") {
             if (!requireGetAuth(req, res, url, authToken, true))
                 return;

package/mcp/dist/phren-core.js

@@ -24,6 +24,8 @@ export const EXTRA_ENTITY_PATTERNS = [
     // ISO date references: 2025-03-11, 2025/03/11
     { re: /\b\d{4}[-/]\d{2}[-/]\d{2}\b/g, label: "date" },
 ];
+/** Union of all directory names reserved by phren infrastructure — not valid project names. */
+export const RESERVED_PROJECT_DIR_NAMES = new Set(["global", ".runtime", ".sessions", ".governance", "profiles", "templates"]);
 // Default timeout for execFileSync calls (30s for most operations, 10s for quick probes like `which`)
 export const EXEC_TIMEOUT_MS = 30_000;
 export const EXEC_TIMEOUT_QUICK_MS = 10_000;