@phren/cli 0.0.14 → 0.0.16

package/mcp/dist/memory-ui-data.js

@@ -6,6 +6,7 @@ import { errorMessage } from "./utils.js";
 import { readInstallPreferences } from "./init-preferences.js";
 import { readCustomHooks } from "./hooks.js";
 import { hookConfigPaths, hookConfigRoots } from "./provider-adapters.js";
+import { readProjectConfig, isProjectHookEnabled, PROJECT_HOOK_EVENTS } from "./project-config.js";
 import { getAllSkills } from "./skill-registry.js";
 import { resolveTaskFilePath, readTasks, TASKS_FILENAME } from "./data-tasks.js";
 import { buildIndex, queryDocBySourceKey, queryRows } from "./shared-index.js";
@@ -101,7 +102,7 @@ export function collectSkillsForUI(phrenPath, profile = "") {
         enabled: skill.enabled,
     }));
 }
-export function getHooksData(phrenPath) {
+export function getHooksData(phrenPath, profile) {
     const prefs = readInstallPreferences(phrenPath);
     const globalEnabled = prefs.hooksEnabled !== false;
     const toolPrefs = (prefs.hookTools && typeof prefs.hookTools === "object") ? prefs.hookTools : {};
@@ -112,7 +113,28 @@ export function getHooksData(phrenPath) {
         configPath: paths[tool],
         exists: fs.existsSync(paths[tool]),
     }));
-    return { globalEnabled, tools, customHooks: readCustomHooks(phrenPath) };
+    // Collect per-project hook overrides
+    const projectOverrides = [];
+    const projects = getProjectDirs(phrenPath, profile)
+        .map((dir) => path.basename(dir))
+        .filter((p) => p !== "global");
+    for (const project of projects) {
+        const config = readProjectConfig(phrenPath, project);
+        const hasOverrides = typeof config.hooks?.enabled === "boolean" ||
+            PROJECT_HOOK_EVENTS.some((ev) => typeof config.hooks?.[ev] === "boolean");
+        if (!hasOverrides)
+            continue;
+        projectOverrides.push({
+            project,
+            baseEnabled: typeof config.hooks?.enabled === "boolean" ? config.hooks.enabled : null,
+            events: PROJECT_HOOK_EVENTS.map((event) => ({
+                event,
+                configured: typeof config.hooks?.[event] === "boolean" ? config.hooks[event] : null,
+                enabled: isProjectHookEnabled(phrenPath, project, event, config),
+            })),
+        });
+    }
+    return { globalEnabled, tools, customHooks: readCustomHooks(phrenPath), projectOverrides };
 }
 export async function buildGraph(phrenPath, profile, focusProject) {
     const projects = getProjectDirs(phrenPath, profile).map((projectDir) => path.basename(projectDir)).filter((project) => project !== "global");

package/mcp/dist/memory-ui-graph.js

@@ -164,27 +164,30 @@ export function renderGraphScript() {
     return path;
   }
 
-  /* pin a node so the force simulation skips it (prevents jitter while phren walks) */
-  var phrenPinnedNode = null;
+  /* pin nodes so the force simulation skips them (prevents jitter while phren walks) */
+  var phrenPinnedNodes = [];
 
   function phrenPinNode(node) {
-    if (phrenPinnedNode && phrenPinnedNode !== node) {
-      /* unpin previous target — let physics resume on it */
-      phrenPinnedNode._phrenPinned = false;
-      phrenPinnedNode.vx = 0;
-      phrenPinnedNode.vy = 0;
-    }
-    if (node) {
+    if (node && !node._phrenPinned) {
       node._phrenPinned = true;
       node.vx = 0;
       node.vy = 0;
+      phrenPinnedNodes.push(node);
     }
-    phrenPinnedNode = node;
+  }
+
+  function phrenUnpinAll() {
+    for (var i = 0; i < phrenPinnedNodes.length; i++) {
+      phrenPinnedNodes[i]._phrenPinned = false;
+      phrenPinnedNodes[i].vx = 0;
+      phrenPinnedNodes[i].vy = 0;
+    }
+    phrenPinnedNodes = [];
   }
 
   function phrenMoveTo(x, y, targetNode) {
-    /* pin the target node so physics doesn't move it while phren walks there */
-    phrenPinNode(targetNode);
+    /* unpin all previously pinned nodes before starting a new move */
+    phrenUnpinAll();
     phren.targetX = x;
     phren.targetY = y;
     phren.moving = true;
@@ -199,6 +202,12 @@ export function renderGraphScript() {
     phren.waypointIdx = 0;
     phren.targetNodeId = targetNode ? targetNode.id : null;
     phren.targetNodeRef = targetNode || null; /* live reference for position tracking */
+    /* pin target node and all waypoint nodes so physics doesn't move them during walk */
+    phrenPinNode(targetNode);
+    for (var i = 0; i < phren.waypoints.length; i++) {
+      var wpn = phrenNodeById(phren.waypoints[i]);
+      if (wpn) phrenPinNode(wpn);
+    }
     /* ensure animation loop is running so phren movement renders */
     if (!animFrame) animFrame = requestAnimationFrame(tick);
   }
@@ -238,16 +247,45 @@ export function renderGraphScript() {
       var dx = wx - phren.x;
       var dy = wy - phren.y;
       var dist = Math.sqrt(dx * dx + dy * dy);
-      if (dist < 2) {
+      /* snap-to-target helper — used both by arrival check and overshoot clamp */
+      var snapped = false;
+      if (dist < 4) {
         phren.x = wx;
         phren.y = wy;
-        /* advance to next waypoint or finish */
+        snapped = true;
+      } else {
+        /* ease-in-out via sine curve over the full trip distance */
+        var t = phren.tripDist > 0 ? Math.min(1, phren.tripProgress / phren.tripDist) : 1;
+        var easeInOut = 0.5 - 0.5 * Math.cos(Math.PI * t);
+        var baseSpeed = Math.max(3, phren.tripDist * 0.12);
+        var speed = Math.max(1.5, baseSpeed * (0.15 + 0.85 * easeInOut));
+        /* clamp speed to remaining distance — prevents overshoot oscillation */
+        if (speed >= dist) {
+          phren.x = wx;
+          phren.y = wy;
+          speed = dist;
+          snapped = true;
+        } else {
+          phren.x += (dx / dist) * speed;
+          phren.y += (dy / dist) * speed;
+        }
+        phren.tripProgress += speed;
+        /* record trail — longer buffer for gradual fade */
+        phren.trailPoints.push({ x: phren.x, y: phren.y, age: 0 });
+        if (phren.trailPoints.length > 50) phren.trailPoints.shift();
+      }
+      /* advance waypoint or finish when snapped to current target */
+      if (snapped) {
         if (phren.waypoints.length > 0 && phren.waypointIdx < phren.waypoints.length) {
           phren.waypointIdx++;
         } else {
           phren.moving = false;
           phren.arriving = true;
           phren.arriveTimer = 0;
+          /* clear trail on arrival so purple line doesn't linger */
+          phren.trailPoints = [];
+          /* unpin all nodes now that phren has arrived */
+          phrenUnpinAll();
           /* update keyboard-nav current node */
           if (phren.targetNodeId) {
             phrenCurrentNodeId = phren.targetNodeId;
@@ -255,18 +293,6 @@ export function renderGraphScript() {
             phrenRefreshAdjacentLinks();
           }
         }
-      } else {
-        /* ease-in-out via sine curve over the full trip distance */
-        var t = phren.tripDist > 0 ? Math.min(1, phren.tripProgress / phren.tripDist) : 1;
-        var easeInOut = 0.5 - 0.5 * Math.cos(Math.PI * t);
-        var baseSpeed = Math.max(3, phren.tripDist * 0.12);
-        var speed = Math.max(1.5, baseSpeed * (0.15 + 0.85 * easeInOut));
-        phren.x += (dx / dist) * speed;
-        phren.y += (dy / dist) * speed;
-        phren.tripProgress += speed;
-        /* record trail — longer buffer for gradual fade */
-        phren.trailPoints.push({ x: phren.x, y: phren.y, age: 0 });
-        if (phren.trailPoints.length > 50) phren.trailPoints.shift();
       }
     }
     if (phren.arriving) {
@@ -312,10 +338,10 @@ export function renderGraphScript() {
     /* sprite rendering */
     if (phrenImgReady) {
       ctx.save();
-      /* fixed 128px size in screen pixels, scale up to 148px on arrival flash */
-      var spriteScreenSize = 128;
+      /* fixed 48px size in screen pixels, scale up to 56px on arrival flash */
+      var spriteScreenSize = 48;
       if (phren.arriving && phren.arriveTimer < 0.4) {
-        spriteScreenSize = 128 + 20 * (1 - phren.arriveTimer / 0.4);
+        spriteScreenSize = 48 + 8 * (1 - phren.arriveTimer / 0.4);
       }
       var spriteSize = spriteScreenSize * s; /* convert to graph coords */
       /* bob up/down when walking — sine wave synced to walk progress */
@@ -1428,8 +1454,8 @@ export function renderGraphScript() {
       if (healthText) html += '<div style="margin-top:4px">' + healthText + '</div>';
       if (node.project) {
         html += '<div style="display:flex;gap:8px;margin-top:12px">';
-        html += '<button class="btn btn-sm" onclick="window.graphNodeEdit(' + JSON.stringify(node.project) + ',' + JSON.stringify(findingText) + ')" style="padding:5px 14px;font-size:12px">Edit</button>';
-        html += '<button class="btn btn-sm" onclick="window.graphNodeDelete(' + JSON.stringify(node.project) + ',' + JSON.stringify(findingText) + ')" style="padding:5px 14px;font-size:12px;color:#ef4444;border-color:#ef4444">Delete</button>';
+        html += '<button class="btn btn-sm" data-action="graphNodeEdit" data-project="' + esc(node.project) + '" data-finding="' + esc(findingText) + '" style="padding:5px 14px;font-size:12px">Edit</button>';
+        html += '<button class="btn btn-sm" data-action="graphNodeDelete" data-project="' + esc(node.project) + '" data-finding="' + esc(findingText) + '" style="padding:5px 14px;font-size:12px;color:#ef4444;border-color:#ef4444">Delete</button>';
         html += '</div>';
       }
 
@@ -1481,8 +1507,8 @@ export function renderGraphScript() {
           html += '<div style="margin-top:8px;padding:8px 10px;border-radius:6px;border:1px solid var(--border);background:var(--surface-alt,var(--surface))">';
           html += '<div style="font-size:12px;line-height:1.5;color:var(--ink)">' + esc(lfText) + '</div>';
           html += '<div style="display:flex;gap:6px;margin-top:6px">';
-          html += '<button class="btn btn-sm" onclick="window.graphNodeEdit(' + JSON.stringify(lf.project) + ',' + JSON.stringify(lfText) + ')" style="padding:3px 10px;font-size:11px">Edit</button>';
-          html += '<button class="btn btn-sm" onclick="window.graphNodeDelete(' + JSON.stringify(lf.project) + ',' + JSON.stringify(lfText) + ')" style="padding:3px 10px;font-size:11px;color:#ef4444;border-color:#ef4444">Delete</button>';
+          html += '<button class="btn btn-sm" data-action="graphNodeEdit" data-project="' + esc(lf.project) + '" data-finding="' + esc(lfText) + '" style="padding:3px 10px;font-size:11px">Edit</button>';
+          html += '<button class="btn btn-sm" data-action="graphNodeDelete" data-project="' + esc(lf.project) + '" data-finding="' + esc(lfText) + '" style="padding:3px 10px;font-size:11px;color:#ef4444;border-color:#ef4444">Delete</button>';
           html += '</div></div>';
         }
       }
@@ -2030,11 +2056,25 @@ export function renderGraphScript() {
     renderGraphDetails(null);
   };
 
+  /* ── delegated click handler for graph detail panel buttons ─────────── */
+  document.addEventListener('click', function(e) {
+    var target = e.target;
+    if (!target || typeof target.closest !== 'function') return;
+    var actionEl = target.closest('[data-action]');
+    if (!actionEl) return;
+    var action = actionEl.getAttribute('data-action');
+    var project = actionEl.getAttribute('data-project');
+    var finding = actionEl.getAttribute('data-finding');
+    if (action === 'graphNodeEdit' && project && finding) { window.graphNodeEdit(project, finding); }
+    else if (action === 'graphNodeDelete' && project && finding) { window.graphNodeDelete(project, finding); }
+  });
+
   /* ── node edit/delete actions ────────────────────────────────────────── */
 
-  function fetchCsrfToken(cb) {
-    fetch('/api/csrf-token').then(function(r) { return r.json(); }).then(function(d) { cb(d.token || ''); }).catch(function() { cb(''); });
-  }
+  var authUrl = window._phrenAuthUrl || function(u) { return u; };
+  var fetchCsrfToken = window._phrenFetchCsrfToken || function(cb) {
+    fetch(authUrl('/api/csrf-token')).then(function(r) { return r.json(); }).then(function(d) { cb(d.token || ''); }).catch(function() { cb(''); });
+  };
 
   window.graphNodeEdit = function(project, findingText) {
     var panel = document.getElementById('graph-detail-panel');
@@ -2070,7 +2110,7 @@ export function renderGraphScript() {
         body.set('old_text', findingText);
         body.set('new_text', newText);
         if (csrf) body.set('_csrf', csrf);
-        fetch('/api/findings/' + encodeURIComponent(project), { method: 'PUT', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() })
+        fetch(authUrl('/api/findings/' + encodeURIComponent(project)), { method: 'PUT', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() })
           .then(function(r) { return r.json(); })
           .then(function(d) {
             if (d.ok) {
@@ -2096,7 +2136,7 @@ export function renderGraphScript() {
       var body = new URLSearchParams();
       body.set('text', findingText);
       if (csrf) body.set('_csrf', csrf);
-      fetch('/api/findings/' + encodeURIComponent(project), { method: 'DELETE', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() })
+      fetch(authUrl('/api/findings/' + encodeURIComponent(project)), { method: 'DELETE', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() })
         .then(function(r) { return r.json(); })
         .then(function(d) {
           if (d.ok) {

package/mcp/dist/memory-ui-page.js

@@ -321,7 +321,7 @@ ${TASK_UI_STYLES}
 </div>
 
 <script${nonceAttr}>
-${renderWebUiScript(h(authToken || ""))}
+${renderWebUiScript(authToken || "")}
 </script>
 <script${nonceAttr}>
 ${renderGraphScript()}
@@ -330,7 +330,7 @@ ${renderGraphScript()}
 ${renderReviewQueueEditSyncScript()}
 </script>
 <script${nonceAttr}>
-${renderSharedWebUiHelpers(h(authToken || ""))}
+${renderSharedWebUiHelpers(authToken || "")}
 </script>
 <script${nonceAttr}>
 ${renderSkillUiEnhancementScript(h(authToken || ""))}

package/mcp/dist/memory-ui-scripts.js

@@ -7,8 +7,9 @@
  *   window._phrenFetchCsrfToken(cb) — fetch the CSRF token and call cb(token)
  */
 export function renderSharedWebUiHelpers(authToken) {
+    const safeToken = JSON.stringify(authToken).slice(1, -1); // escape for JS string literal
     return `(function() {
-  window._phrenAuthToken = '${authToken}';
+  window._phrenAuthToken = '${safeToken}';
   window._phrenEsc = function(s) {
     return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
   };
@@ -600,6 +601,10 @@ export function renderTasksAndSettingsScript(authToken) {
       return base + (base.indexOf('?') === -1 ? '?' : '&') + '_auth=' + encodeURIComponent(_tsAuthToken);
     }
 
+    function loadJson(url) {
+      return fetch(url).then(function(r) { return r.json(); });
+    }
+
     function priorityBadge(p) {
       if (!p) return '';
       var colors = { high: '#ef4444', medium: '#f59e0b', low: '#6b7280' };
@@ -679,6 +684,7 @@ export function renderTasksAndSettingsScript(authToken) {
     };
 
     window.toggleDoneSection = function(btn) {
+      if (!btn) return;
       var list = btn.nextElementSibling;
       var arrow = btn.querySelector('.task-toggle-arrow');
       if (!list) return;
@@ -708,10 +714,10 @@ export function renderTasksAndSettingsScript(authToken) {
       });
       var doneTasks = showDone ? [] : _allTasks.filter(function(t) {
         if (projectFilter && t.project !== projectFilter) return false;
-        return t.section === 'Done';
+        return t.section === 'Done' || t.checked;
       });
 
-      var activeCount = tasks.filter(function(t) { return t.section !== 'Done'; }).length;
+      var activeCount = tasks.filter(function(t) { return t.section !== 'Done' && !t.checked; }).length;
       var countEl = document.getElementById('tasks-count');
       if (countEl) countEl.textContent = activeCount + ' active' + (doneTasks.length ? ', ' + doneTasks.length + ' done' : '');
 
@@ -732,12 +738,13 @@ export function renderTasksAndSettingsScript(authToken) {
         return pa - pb;
       }
 
-      // Separate into priority groups
-      var high = tasks.filter(function(t) { return t.priority === 'high' && t.section !== 'Done'; }).sort(sortByPriority);
-      var medium = tasks.filter(function(t) { return t.priority === 'medium' && t.section !== 'Done'; }).sort(sortByPriority);
-      var low = tasks.filter(function(t) { return t.priority === 'low' && t.section !== 'Done'; }).sort(sortByPriority);
-      var noPriority = tasks.filter(function(t) { return !t.priority && t.section !== 'Done'; }).sort(sortByPriority);
-      var doneVisible = tasks.filter(function(t) { return t.section === 'Done'; });
+      // Separate into priority groups (exclude checked tasks even if not in Done section)
+      function isActive(t) { return t.section !== 'Done' && !t.checked; }
+      var high = tasks.filter(function(t) { return t.priority === 'high' && isActive(t); }).sort(sortByPriority);
+      var medium = tasks.filter(function(t) { return t.priority === 'medium' && isActive(t); }).sort(sortByPriority);
+      var low = tasks.filter(function(t) { return t.priority === 'low' && isActive(t); }).sort(sortByPriority);
+      var noPriority = tasks.filter(function(t) { return !t.priority && isActive(t); }).sort(sortByPriority);
+      var doneVisible = tasks.filter(function(t) { return t.section === 'Done' || t.checked; });
 
       function renderTaskCard(t) {
         var borderClass = t.priority === 'high' ? ' task-card-high' : t.priority === 'medium' ? ' task-card-medium' : t.priority === 'low' ? ' task-card-low' : '';
@@ -755,10 +762,10 @@ export function renderTasksAndSettingsScript(authToken) {
         if (t.context) html += '<span class="task-card-context">' + esc(t.context) + '</span>';
         html += '</div>';
         html += '<div class="task-card-actions">';
-        if (t.section !== 'Done') {
-          html += '<button class="task-done-btn" onclick="completeTaskFromUi(\'' + esc(t.project).replace(/'/g, "\\'") + '\', \'' + esc(t.line).replace(/'/g, "\\'") + '\')" title="Mark done"><svg width="14" height="14" viewBox="0 0 16 16" fill="none"><path d="M3 8.5l3.5 3.5 6.5-7" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg> Done</button>';
+        if (t.section !== 'Done' && !t.checked) {
+          html += '<button class="task-done-btn" data-ts-action="completeTask" data-project="' + esc(t.project) + '" data-item="' + esc(t.line) + '" title="Mark done"><svg width="14" height="14" viewBox="0 0 16 16" fill="none"><path d="M3 8.5l3.5 3.5 6.5-7" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg> Done</button>';
         }
-        html += '<button class="task-remove-btn" onclick="removeTaskFromUi(\'' + esc(t.project).replace(/'/g, "\\'") + '\', \'' + esc(t.line).replace(/'/g, "\\'") + '\')" title="Delete task" style="background:none;border:1px solid var(--border);border-radius:var(--radius-sm);padding:2px 8px;cursor:pointer;color:var(--muted);font-size:var(--text-xs)"><svg width="12" height="12" viewBox="0 0 16 16" fill="none"><path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg></button>';
+        html += '<button class="task-remove-btn" data-ts-action="removeTask" data-project="' + esc(t.project) + '" data-item="' + esc(t.line) + '" title="Delete task" style="background:none;border:1px solid var(--border);border-radius:var(--radius-sm);padding:2px 8px;cursor:pointer;color:var(--muted);font-size:var(--text-xs)"><svg width="12" height="12" viewBox="0 0 16 16" fill="none"><path d="M4 4l8 8M12 4l-8 8" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg></button>';
         html += '</div>';
         html += '</div>';
         return html;
@@ -766,12 +773,12 @@ export function renderTasksAndSettingsScript(authToken) {
 
       var html = '';
 
-      // Add task input at top
-      var projects = projectFilter ? [projectFilter] : Array.from(new Set(_allTasks.map(function(t) { return t.project; }))).sort();
+      // Add task input at top (only when a specific project is selected)
+      var projects = projectFilter ? [projectFilter] : [];
       projects.forEach(function(proj) {
         html += '<div class="task-add-bar">';
-        html += '<input id="task-add-input-' + esc(proj) + '" type="text" class="task-add-input" placeholder="Add a task to ' + esc(proj) + '\u2026" onkeydown="if(event.key===\'Enter\')addTaskFromUi(\'' + esc(proj).replace(/'/g, "\\'") + '\')">';
-        html += '<button class="task-add-btn" onclick="addTaskFromUi(\'' + esc(proj).replace(/'/g, "\\'") + '\')"><svg width="14" height="14" viewBox="0 0 16 16" fill="none"><path d="M8 3v10M3 8h10" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg> Add</button>';
+        html += '<input id="task-add-input-' + esc(proj) + '" type="text" class="task-add-input" placeholder="Add a task to ' + esc(proj) + '\u2026" data-ts-action="addTaskKeydown" data-project="' + esc(proj) + '">';
+        html += '<button class="task-add-btn" data-ts-action="addTask" data-project="' + esc(proj) + '"><svg width="14" height="14" viewBox="0 0 16 16" fill="none"><path d="M8 3v10M3 8h10" stroke="currentColor" stroke-width="2" stroke-linecap="round"/></svg> Add</button>';
         html += '</div>';
       });
 
@@ -797,7 +804,7 @@ export function renderTasksAndSettingsScript(authToken) {
       var allDone = showDone ? doneVisible : doneTasks;
       if (allDone.length) {
         html += '<div class="task-done-section">';
-        html += '<button class="task-done-toggle" onclick="toggleDoneSection(this)">';
+        html += '<button class="task-done-toggle" data-ts-action="toggleDoneSection">';
         html += '<span class="task-toggle-arrow">\u25B6</span> Completed <span class="task-section-count">' + allDone.length + '</span></button>';
         html += '<div class="task-done-list" style="display:none">';
         html += '<div class="task-card-grid">';
@@ -897,7 +904,7 @@ export function renderTasksAndSettingsScript(authToken) {
       var scopeNote = document.getElementById('settings-scope-note');
       if (scopeNote) {
         scopeNote.textContent = selectedProject
-          ? 'Showing effective config for "' + selectedProject + '". Overrides are saved to that project\'s phren.project.yaml.'
+          ? 'Showing effective config for "' + selectedProject + '". Overrides are saved to that project\\\'s phren.project.yaml.'
           : 'Showing global settings. Select a project to view and edit per-project overrides.';
       }
 
@@ -1217,7 +1224,11 @@ export function renderTasksAndSettingsScript(authToken) {
       var actionEl = target.closest('[data-ts-action]');
       if (!actionEl) return;
       var action = actionEl.getAttribute('data-ts-action');
-      if (action === 'setFindingSensitivity') { setFindingSensitivity(actionEl.getAttribute('data-level')); }
+      if (action === 'toggleDoneSection') { toggleDoneSection(actionEl); }
+      else if (action === 'completeTask') { completeTaskFromUi(actionEl.getAttribute('data-project'), actionEl.getAttribute('data-item')); }
+      else if (action === 'removeTask') { removeTaskFromUi(actionEl.getAttribute('data-project'), actionEl.getAttribute('data-item')); }
+      else if (action === 'addTask') { addTaskFromUi(actionEl.getAttribute('data-project')); }
+      else if (action === 'setFindingSensitivity') { setFindingSensitivity(actionEl.getAttribute('data-level')); }
       else if (action === 'toggleAutoCapture') { setAutoCapture(actionEl.getAttribute('data-enabled') !== 'true'); }
       else if (action === 'setTaskMode') { setTaskMode(actionEl.getAttribute('data-mode')); }
       else if (action === 'setProactivity') { setProactivity(actionEl.getAttribute('data-level')); }
@@ -1254,6 +1265,15 @@ export function renderTasksAndSettingsScript(authToken) {
       }
     });
 
+    // Keydown delegation for add-task inputs (Enter key)
+    document.addEventListener('keydown', function(e) {
+      var target = e.target;
+      if (!target || !target.getAttribute) return;
+      if (target.getAttribute('data-ts-action') === 'addTaskKeydown' && e.key === 'Enter') {
+        addTaskFromUi(target.getAttribute('data-project'));
+      }
+    });
+
     window.setFindingSensitivity = function(level) {
       var descriptions = {
         high: 'Capture findings proactively, including minor observations.',

package/mcp/dist/memory-ui-server.js

@@ -7,12 +7,12 @@ import * as querystring from "querystring";
 import { spawn, execFileSync } from "child_process";
 import { computePhrenLiveStateToken, getProjectDirs, } from "./shared.js";
 import { editFinding, readReviewQueue, removeFinding, readFindings, addFinding as addFindingStore, readTasksAcrossProjects, addTask as addTaskStore, completeTask as completeTaskStore, removeTask as removeTaskStore, TASKS_FILENAME, } from "./data-access.js";
-import { isValidProjectName, errorMessage } from "./utils.js";
+import { isValidProjectName, errorMessage, queueFilePath, safeProjectPath } from "./utils.js";
 import { readInstallPreferences, writeInstallPreferences, writeGovernanceInstallPreferences } from "./init-preferences.js";
 import { buildGraph, collectProjectsForUI, collectSkillsForUI, getHooksData, isAllowedFilePath, readSyncSnapshot, recentAccepted, recentUsage, } from "./memory-ui-data.js";
 import { CONSOLIDATION_ENTRY_THRESHOLD } from "./content-validate.js";
 import { ensureTopicReferenceDoc, getProjectTopicsResponse, listProjectReferenceDocs, pinProjectTopicSuggestion, readReferenceContent, reclassifyLegacyTopicDocs, unpinProjectTopicSuggestion, writeProjectTopics, } from "./project-topics.js";
-import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides } from "./governance-policy.js";
+import { getWorkflowPolicy, updateWorkflowPolicy, mergeConfig, getRetentionPolicy, getProjectConfigOverrides, VALID_TASK_MODES } from "./governance-policy.js";
 import { updateProjectConfigOverrides } from "./project-config.js";
 import { findSkill } from "./skill-registry.js";
 import { setSkillEnabledAndSync } from "./skill-files.js";
@@ -193,6 +193,8 @@ function readFormBody(req, res) {
         req.on("data", (chunk) => {
             received += chunk.length;
             if (received > MAX_FORM_BODY_BYTES) {
+                res.writeHead(413, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Request body too large" }));
                 req.destroy();
                 resolve(null);
                 return;
@@ -388,6 +390,111 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
             }));
             return;
         }
+        // POST /api/approve — remove item from review queue (keep finding)
+        if (req.method === "POST" && pathname === "/api/approve") {
+            void readFormBody(req, res).then((parsed) => {
+                if (!parsed)
+                    return;
+                if (!requirePostAuth(req, res, url, parsed, authToken, true))
+                    return;
+                if (!requireCsrf(res, parsed, csrfTokens, true))
+                    return;
+                const project = String(parsed.project || "");
+                const line = String(parsed.line || "");
+                if (!project || !isValidProjectName(project) || !line) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Missing project or line" }));
+                    return;
+                }
+                try {
+                    const qPath = queueFilePath(phrenPath, project);
+                    if (fs.existsSync(qPath)) {
+                        const content = fs.readFileSync(qPath, "utf8");
+                        const lines = content.split("\n");
+                        const filtered = lines.filter((l) => l.trim() !== line.trim());
+                        fs.writeFileSync(qPath, filtered.join("\n"));
+                    }
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: true }));
+                }
+                catch (err) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
+                }
+            });
+            return;
+        }
+        // POST /api/reject — remove item from review queue AND remove finding
+        if (req.method === "POST" && pathname === "/api/reject") {
+            void readFormBody(req, res).then((parsed) => {
+                if (!parsed)
+                    return;
+                if (!requirePostAuth(req, res, url, parsed, authToken, true))
+                    return;
+                if (!requireCsrf(res, parsed, csrfTokens, true))
+                    return;
+                const project = String(parsed.project || "");
+                const line = String(parsed.line || "");
+                if (!project || !isValidProjectName(project) || !line) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Missing project or line" }));
+                    return;
+                }
+                try {
+                    // Remove from review queue
+                    const qPath = queueFilePath(phrenPath, project);
+                    if (fs.existsSync(qPath)) {
+                        const content = fs.readFileSync(qPath, "utf8");
+                        const lines = content.split("\n");
+                        const filtered = lines.filter((l) => l.trim() !== line.trim());
+                        fs.writeFileSync(qPath, filtered.join("\n"));
+                    }
+                    // Also remove the finding from FINDINGS.md
+                    // Extract text from the line (strip "- " prefix and inline metadata)
+                    const findingText = line.replace(/^-\s*/, "").replace(/<!--.*?-->/g, "").trim();
+                    if (findingText) {
+                        removeFinding(phrenPath, project, findingText);
+                    }
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: true }));
+                }
+                catch (err) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
+                }
+            });
+            return;
+        }
+        // POST /api/edit — edit a finding's text
+        if (req.method === "POST" && pathname === "/api/edit") {
+            void readFormBody(req, res).then((parsed) => {
+                if (!parsed)
+                    return;
+                if (!requirePostAuth(req, res, url, parsed, authToken, true))
+                    return;
+                if (!requireCsrf(res, parsed, csrfTokens, true))
+                    return;
+                const project = String(parsed.project || "");
+                const line = String(parsed.line || "");
+                const newText = String(parsed.new_text || "");
+                if (!project || !isValidProjectName(project) || !line || !newText) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: "Missing project, line, or new_text" }));
+                    return;
+                }
+                try {
+                    const oldText = line.replace(/^-\s*/, "").replace(/<!--.*?-->/g, "").trim();
+                    const result = editFinding(phrenPath, project, oldText, newText);
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: result.ok, error: result.ok ? undefined : result.error }));
+                }
+                catch (err) {
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify({ ok: false, error: errorMessage(err) }));
+                }
+            });
+            return;
+        }
         if (req.method === "GET" && pathname.startsWith("/api/project-content")) {
             const qs = url.includes("?") ? querystring.parse(url.slice(url.indexOf("?") + 1)) : {};
             const project = String(qs.project || "");
@@ -403,7 +510,12 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
                 res.end(JSON.stringify({ ok: false, error: `File not allowed: ${file}` }));
                 return;
             }
-            const filePath = path.join(phrenPath, project, file);
+            const filePath = safeProjectPath(phrenPath, project, file);
+            if (!filePath) {
+                res.writeHead(400, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: "Invalid project or file path" }));
+                return;
+            }
             if (!fs.existsSync(filePath)) {
                 res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
                 res.end(JSON.stringify({ ok: false, error: `File not found: ${file}` }));
@@ -919,7 +1031,7 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
                 if (!requireCsrf(res, parsed, csrfTokens, true))
                     return;
                 const value = String(parsed.value || "").trim().toLowerCase();
-                const valid = ["off", "manual", "auto"];
+                const valid = VALID_TASK_MODES;
                 if (!valid.includes(value)) {
                     res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
                     res.end(JSON.stringify({ ok: false, error: `Invalid task mode: "${value}". Must be one of: ${valid.join(", ")}` }));
@@ -1056,7 +1168,7 @@ export function createWebUiHttpServer(phrenPath, renderPage, profile, opts) {
                     });
                     const merged = mergeConfig(phrenPath, project);
                     res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
-                    res.end(JSON.stringify({ ok: true, config: merged }));
+                    res.end(JSON.stringify({ ok: true, config: merged, ...(registrationWarning ? { warning: registrationWarning } : {}) }));
                 }
                 catch (err) {
                     res.writeHead(200, { "content-type": "application/json; charset=utf-8" });

package/mcp/dist/phren-paths.js

@@ -305,6 +305,23 @@ export function findProjectNameCaseInsensitive(phrenPath, name) {
     }
     return null;
 }
+export function findArchivedProjectNameCaseInsensitive(phrenPath, name) {
+    const needle = name.toLowerCase();
+    try {
+        for (const entry of fs.readdirSync(phrenPath, { withFileTypes: true })) {
+            if (!entry.isDirectory() || !entry.name.endsWith(".archived"))
+                continue;
+            const archivedName = entry.name.slice(0, -".archived".length);
+            if (archivedName.toLowerCase() === needle)
+                return archivedName;
+        }
+    }
+    catch (err) {
+        if ((process.env.PHREN_DEBUG))
+            process.stderr.write(`[phren] findArchivedProjectNameCaseInsensitive: ${errorMessage(err)}\n`);
+    }
+    return null;
+}
 function getLocalProjectDirs(phrenPath, manifest) {
     const primaryProject = manifest.primaryProject;
     if (!primaryProject || !isValidProjectName(primaryProject))

package/mcp/dist/shared.js

@@ -4,7 +4,7 @@ import { debugLog, runtimeFile } from "./phren-paths.js";
 import { errorMessage } from "./utils.js";
 export { HOOK_TOOL_NAMES, hookConfigPath } from "./provider-adapters.js";
 export { EXEC_TIMEOUT_MS, EXEC_TIMEOUT_QUICK_MS, PhrenError, phrenOk, phrenErr, forwardErr, parsePhrenErrorCode, isRecord, withDefaults, FINDING_TYPES, FINDING_TAGS, KNOWN_OBSERVATION_TAGS, DOC_TYPES, capCache, RESERVED_PROJECT_DIR_NAMES, } from "./phren-core.js";
-export { ROOT_MANIFEST_FILENAME, homeDir, homePath, expandHomePath, defaultPhrenPath, rootManifestPath, readRootManifest, writeRootManifest, resolveInstallContext, findNearestPhrenPath, isProjectLocalMode, runtimeDir, tryUnlink, sessionsDir, runtimeFile, installPreferencesFile, runtimeHealthFile, shellStateFile, sessionMetricsFile, memoryScoresFile, memoryUsageLogFile, sessionMarker, debugLog, appendIndexEvent, resolveFindingsPath, findPhrenPath, ensurePhrenPath, findPhrenPathWithArg, normalizeProjectNameForCreate, findProjectNameCaseInsensitive, getProjectDirs, collectNativeMemoryFiles, computePhrenLiveStateToken, getPhrenPath, qualityMarkers, atomicWriteText, } from "./phren-paths.js";
+export { ROOT_MANIFEST_FILENAME, homeDir, homePath, expandHomePath, defaultPhrenPath, rootManifestPath, readRootManifest, writeRootManifest, resolveInstallContext, findNearestPhrenPath, isProjectLocalMode, runtimeDir, tryUnlink, sessionsDir, runtimeFile, installPreferencesFile, runtimeHealthFile, shellStateFile, sessionMetricsFile, memoryScoresFile, memoryUsageLogFile, sessionMarker, debugLog, appendIndexEvent, resolveFindingsPath, findPhrenPath, ensurePhrenPath, findPhrenPathWithArg, normalizeProjectNameForCreate, findProjectNameCaseInsensitive, findArchivedProjectNameCaseInsensitive, getProjectDirs, collectNativeMemoryFiles, computePhrenLiveStateToken, getPhrenPath, qualityMarkers, atomicWriteText, } from "./phren-paths.js";
 export { PROACTIVITY_LEVELS, getProactivityLevel, getProactivityLevelForFindings, getProactivityLevelForTask, hasExplicitFindingSignal, hasExplicitTaskSignal, hasExecutionIntent, hasDiscoveryIntent, shouldAutoCaptureFindingsForLevel, shouldAutoCaptureTaskForLevel, } from "./proactivity.js";
 const MEMORY_SCOPE_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 export function normalizeMemoryScope(scope) {