@prmichaelsen/remember-mcp 4.0.2 → 4.1.0

package/dist/server.js

@@ -1329,6 +1329,27 @@ async function handleSearchMemory(args, userId, authContext) {
   }
 }
 
+// src/utils/elicitation.ts
+async function elicitConfirmation(params) {
+  const { server, message } = params;
+  if (!server)
+    return { type: "unsupported" };
+  const caps = server.getClientCapabilities();
+  if (!caps?.elicitation)
+    return { type: "unsupported" };
+  try {
+    const result = await server.elicitInput({
+      message,
+      requestedSchema: { type: "object", properties: {} }
+    });
+    if (result.action === "accept")
+      return { type: "confirmed" };
+    return { type: "declined", reason: result.action };
+  } catch {
+    return { type: "unsupported" };
+  }
+}
+
 // src/tools/delete-memory.ts
 var deleteMemoryTool = {
   name: "remember_delete_memory",
@@ -1359,7 +1380,7 @@ Examples:
     required: ["memory_id"]
   }
 };
-async function handleDeleteMemory(args, userId, authContext) {
+async function handleDeleteMemory(args, userId, authContext, server) {
   const debug = createDebugLogger({ tool: "remember_delete_memory", userId, operation: "delete memory" });
   try {
     debug.info("Tool invoked");
@@ -1373,6 +1394,44 @@ async function handleDeleteMemory(args, userId, authContext) {
         reason: args.reason || null
       }
     );
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Delete memory "${args.memory_id}"${args.reason ? ` (reason: ${args.reason})` : ""}?`
+    });
+    if (confirmation.type === "confirmed") {
+      const confirmed = await tokenService2.confirmRequest(userId, token);
+      if (!confirmed) {
+        return JSON.stringify(
+          { success: false, error: "Token already consumed", message: "The confirmation token has already been used." },
+          null,
+          2
+        );
+      }
+      const { memory_id, reason } = confirmed.payload;
+      const client2 = getWeaviateClient();
+      const collectionName = getMemoryCollectionName(userId);
+      const collection = client2.collections.get(collectionName);
+      await collection.data.update({
+        id: memory_id,
+        properties: {
+          deleted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          deleted_by: userId,
+          deletion_reason: reason || null
+        }
+      });
+      return JSON.stringify(
+        { success: true, memory_id, message: "Memory deleted successfully" },
+        null,
+        2
+      );
+    }
+    if (confirmation.type === "declined") {
+      return JSON.stringify(
+        { success: false, message: "Deletion cancelled by user." },
+        null,
+        2
+      );
+    }
     const expiresAt = new Date(Date.now() + 5 * 60 * 1e3);
     return JSON.stringify(
       {
@@ -2521,7 +2580,7 @@ Publication Destinations:
     required: ["memory_id"]
   }
 };
-async function handlePublish(args, userId, authContext) {
+async function handlePublish(args, userId, authContext, server) {
   const debug = createDebugLogger({
     tool: "remember_publish",
     userId,
@@ -2537,6 +2596,34 @@ async function handlePublish(args, userId, authContext) {
       groups: args.groups,
       additional_tags: args.additional_tags
     });
+    const destinations = [...args.spaces || [], ...args.groups || []].join(", ");
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Publish memory "${args.memory_id}" to ${destinations || "default space"}?`
+    });
+    if (confirmation.type === "confirmed") {
+      const confirmResult = await space.confirm({ token: result.token });
+      return JSON.stringify(
+        {
+          success: confirmResult.success,
+          composite_id: confirmResult.composite_id,
+          published_to: confirmResult.published_to,
+          failed: confirmResult.failed?.length ? confirmResult.failed : void 0,
+          space_ids: confirmResult.space_ids,
+          group_ids: confirmResult.group_ids
+        },
+        null,
+        2
+      );
+    }
+    if (confirmation.type === "declined") {
+      await space.deny({ token: result.token });
+      return JSON.stringify(
+        { success: false, message: "Publication cancelled by user." },
+        null,
+        2
+      );
+    }
     return JSON.stringify(
       {
         success: true,
@@ -2599,7 +2686,7 @@ Orphaned memories are preserved for historical reference but become unsearchable
     required: ["memory_id"]
   }
 };
-async function handleRetract(args, userId, authContext) {
+async function handleRetract(args, userId, authContext, server) {
   const debug = createDebugLogger({
     tool: "remember_retract",
     userId,
@@ -2614,6 +2701,35 @@ async function handleRetract(args, userId, authContext) {
       spaces: args.spaces,
       groups: args.groups
     });
+    const destinations = [...args.spaces || [], ...args.groups || []].join(", ");
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Retract memory "${args.memory_id}" from ${destinations || "all destinations"}?`
+    });
+    if (confirmation.type === "confirmed") {
+      const confirmResult = await space.confirm({ token: result.token });
+      return JSON.stringify(
+        {
+          success: confirmResult.success,
+          composite_id: confirmResult.composite_id,
+          retracted_from: confirmResult.retracted_from,
+          failed: confirmResult.failed?.length ? confirmResult.failed : void 0,
+          space_ids: confirmResult.space_ids,
+          group_ids: confirmResult.group_ids,
+          is_orphaned: confirmResult.space_ids?.length === 0 && confirmResult.group_ids?.length === 0
+        },
+        null,
+        2
+      );
+    }
+    if (confirmation.type === "declined") {
+      await space.deny({ token: result.token });
+      return JSON.stringify(
+        { success: false, message: "Retraction cancelled by user." },
+        null,
+        2
+      );
+    }
     return JSON.stringify(
       {
         success: true,
@@ -2672,7 +2788,7 @@ Requirements:
     required: ["memory_id"]
   }
 };
-async function handleRevise(args, userId, authContext) {
+async function handleRevise(args, userId, authContext, server) {
   const debug = createDebugLogger({
     tool: "remember_revise",
     userId,
@@ -2685,6 +2801,37 @@ async function handleRevise(args, userId, authContext) {
     const result = await space.revise({
       memory_id: args.memory_id
     });
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Revise all published copies of memory "${args.memory_id}"?`
+    });
+    if (confirmation.type === "confirmed") {
+      const confirmResult = await space.confirm({ token: result.token });
+      const results = confirmResult.results || [];
+      const successCount = results.filter((r) => r.status === "success").length;
+      const failedCount = results.filter((r) => r.status === "failed").length;
+      const skippedCount = results.filter((r) => r.status === "skipped").length;
+      return JSON.stringify(
+        {
+          success: confirmResult.success,
+          composite_id: confirmResult.composite_id,
+          revised_at: confirmResult.revised_at,
+          summary: { total: results.length, success: successCount, failed: failedCount, skipped: skippedCount },
+          results,
+          ...failedCount > 0 ? { warnings: [`Failed to revise ${failedCount} of ${results.length} location(s)`] } : {}
+        },
+        null,
+        2
+      );
+    }
+    if (confirmation.type === "declined") {
+      await space.deny({ token: result.token });
+      return JSON.stringify(
+        { success: false, message: "Revision cancelled by user." },
+        null,
+        2
+      );
+    }
     return JSON.stringify(
       {
         success: true,
@@ -3691,7 +3838,7 @@ This is the ONLY way to change a memory's trust level. Trust cannot be set durin
     required: ["memory_id", "trust_level"]
   }
 };
-async function handleRequestSetTrustLevel(args, userId, authContext) {
+async function handleRequestSetTrustLevel(args, userId, authContext, server) {
   const debug = createDebugLogger({
     tool: "remember_request_set_trust_level",
     userId,
@@ -3718,6 +3865,29 @@ async function handleRequestSetTrustLevel(args, userId, authContext) {
       4: "RESTRICTED",
       5: "SECRET"
     };
+    const currentName = TRUST_NAMES[result.current_trust_level] || "UNKNOWN";
+    const requestedName = TRUST_NAMES[result.requested_trust_level] || "UNKNOWN";
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Change trust level for memory "${args.memory_id}" from ${currentName} (${result.current_trust_level}) to ${requestedName} (${result.requested_trust_level})?`
+    });
+    if (confirmation.type === "confirmed") {
+      const confirmResult = await memory.confirmSetTrustLevel(result.token);
+      return JSON.stringify({
+        success: true,
+        memory_id: confirmResult.memory_id,
+        previous_trust_level: confirmResult.previous_trust_level,
+        new_trust_level: confirmResult.new_trust_level,
+        updated_at: confirmResult.updated_at,
+        message: `Trust level changed from ${TRUST_NAMES[confirmResult.previous_trust_level] || confirmResult.previous_trust_level} to ${TRUST_NAMES[confirmResult.new_trust_level] || confirmResult.new_trust_level}`
+      }, null, 2);
+    }
+    if (confirmation.type === "declined") {
+      return JSON.stringify({
+        success: false,
+        message: "Trust level change cancelled by user."
+      }, null, 2);
+    }
     return JSON.stringify({
       token: result.token,
       request_id: result.request_id,
@@ -3725,10 +3895,10 @@ async function handleRequestSetTrustLevel(args, userId, authContext) {
       memory_id: result.memory_id,
       current_trust_level: result.current_trust_level,
       requested_trust_level: result.requested_trust_level,
-      current_trust_name: TRUST_NAMES[result.current_trust_level] || "UNKNOWN",
-      requested_trust_name: TRUST_NAMES[result.requested_trust_level] || "UNKNOWN",
+      current_trust_name: currentName,
+      requested_trust_name: requestedName,
       expires_at: result.expires_at,
-      message: `Trust level change requested: ${TRUST_NAMES[result.current_trust_level] || result.current_trust_level} (${result.current_trust_level}) \u2192 ${TRUST_NAMES[result.requested_trust_level] || result.requested_trust_level} (${result.requested_trust_level}). Confirm with token to apply.`
+      message: `Trust level change requested: ${currentName} (${result.current_trust_level}) \u2192 ${requestedName} (${result.requested_trust_level}). Confirm with token to apply.`
     }, null, 2);
   } catch (error) {
     debug.error("Tool failed", { error: error instanceof Error ? error.message : String(error) });
@@ -3819,7 +3989,7 @@ function registerHandlers(server) {
           result = await handleSearchMemory(args, userId, authContext);
           break;
         case "remember_delete_memory":
-          result = await handleDeleteMemory(args, userId, authContext);
+          result = await handleDeleteMemory(args, userId, authContext, server);
           break;
         case "remember_update_memory":
           result = await handleUpdateMemory(args, userId, authContext);
@@ -3849,13 +4019,13 @@ function registerHandlers(server) {
           result = await handleGetPreferences(args, userId, authContext);
           break;
         case "remember_publish":
-          result = await handlePublish(args, userId, authContext);
+          result = await handlePublish(args, userId, authContext, server);
           break;
         case "remember_retract":
-          result = await handleRetract(args, userId, authContext);
+          result = await handleRetract(args, userId, authContext, server);
           break;
         case "remember_revise":
-          result = await handleRevise(args, userId, authContext);
+          result = await handleRevise(args, userId, authContext, server);
           break;
         case "remember_confirm":
           result = await handleConfirm(args, userId, authContext);
@@ -3876,7 +4046,7 @@ function registerHandlers(server) {
           result = await handleGhostConfig(args, userId, authContext);
           break;
         case "remember_request_set_trust_level":
-          result = await handleRequestSetTrustLevel(args, userId, authContext);
+          result = await handleRequestSetTrustLevel(args, userId, authContext, server);
           break;
         default:
           throw new McpError(

package/dist/tools/delete-memory.d.ts

@@ -3,6 +3,7 @@
  * Request to delete a memory (requires confirmation)
  */
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { AuthContext } from '../types/auth.js';
 /**
  * Tool definition for remember_delete_memory
@@ -19,5 +20,5 @@ export interface DeleteMemoryArgs {
  * Handle remember_delete_memory tool
  * Creates confirmation token and returns preview
  */
-export declare function handleDeleteMemory(args: DeleteMemoryArgs, userId: string, authContext?: AuthContext): Promise<string>;
+export declare function handleDeleteMemory(args: DeleteMemoryArgs, userId: string, authContext?: AuthContext, server?: Server): Promise<string>;
 //# sourceMappingURL=delete-memory.d.ts.map

package/dist/tools/publish.d.ts

@@ -11,6 +11,7 @@
  * - Maintains tracking arrays (space_ids, group_ids) on source memory
  */
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { AuthContext } from '../types/auth.js';
 /**
  * Tool definition for remember_publish
@@ -25,6 +26,6 @@ interface PublishArgs {
 /**
  * Handle remember_publish tool execution
  */
-export declare function handlePublish(args: PublishArgs, userId: string, authContext?: AuthContext): Promise<string>;
+export declare function handlePublish(args: PublishArgs, userId: string, authContext?: AuthContext, server?: Server): Promise<string>;
 export {};
 //# sourceMappingURL=publish.d.ts.map

package/dist/tools/request-set-trust-level.d.ts

@@ -2,6 +2,7 @@
  * remember_request_set_trust_level tool
  * Requests a trust level change for a memory via confirmation flow.
  */
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { AuthContext } from '../types/auth.js';
 export declare const requestSetTrustLevelTool: {
     name: string;
@@ -27,6 +28,6 @@ interface RequestSetTrustLevelArgs {
     memory_id: string;
     trust_level: number;
 }
-export declare function handleRequestSetTrustLevel(args: RequestSetTrustLevelArgs, userId: string, authContext?: AuthContext): Promise<string>;
+export declare function handleRequestSetTrustLevel(args: RequestSetTrustLevelArgs, userId: string, authContext?: AuthContext, server?: Server): Promise<string>;
 export {};
 //# sourceMappingURL=request-set-trust-level.d.ts.map

package/dist/tools/retract.d.ts

@@ -11,6 +11,7 @@
  * - Tracking arrays updated on source memory
  */
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { AuthContext } from '../types/auth.js';
 /**
  * Tool definition for remember_retract
@@ -24,6 +25,6 @@ interface RetractArgs {
 /**
  * Handle remember_retract tool execution
  */
-export declare function handleRetract(args: RetractArgs, userId: string, authContext?: AuthContext): Promise<string>;
+export declare function handleRetract(args: RetractArgs, userId: string, authContext?: AuthContext, server?: Server): Promise<string>;
 export {};
 //# sourceMappingURL=retract.d.ts.map

package/dist/tools/revise.d.ts

@@ -8,6 +8,7 @@
  * before revision is executed. The old content is preserved in revision_history.
  */
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { AuthContext } from '../types/auth.js';
 /**
  * Tool definition for remember_revise
@@ -40,6 +41,6 @@ export declare function buildRevisionHistory(existing: RevisionEntry[], oldConte
  * Phase 1: Validates the request and generates a confirmation token.
  * The actual revision is executed in confirm.ts when the token is confirmed.
  */
-export declare function handleRevise(args: ReviseArgs, userId: string, authContext?: AuthContext): Promise<string>;
+export declare function handleRevise(args: ReviseArgs, userId: string, authContext?: AuthContext, server?: Server): Promise<string>;
 export {};
 //# sourceMappingURL=revise.d.ts.map

package/dist/utils/elicitation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * MCP Elicitation helper for confirmation flows.
+ *
+ * Checks if the connected client supports elicitation, issues a
+ * confirmation-only prompt via server.elicitInput(), and returns a
+ * discriminated result.  Falls back gracefully when the client (or
+ * server reference) doesn't support elicitation.
+ */
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+export interface ElicitConfirmParams {
+    server?: Server;
+    message: string;
+}
+export type ElicitConfirmResult = {
+    type: 'confirmed';
+} | {
+    type: 'declined';
+    reason: string;
+} | {
+    type: 'unsupported';
+};
+/**
+ * Ask the user for confirmation via MCP elicitation.
+ *
+ * - Returns `{ type: 'confirmed' }` when the user accepts.
+ * - Returns `{ type: 'declined', reason }` when the user declines or cancels.
+ * - Returns `{ type: 'unsupported' }` when elicitation is unavailable
+ *   (no server, client lacks capability, or elicitation throws).
+ */
+export declare function elicitConfirmation(params: ElicitConfirmParams): Promise<ElicitConfirmResult>;
+//# sourceMappingURL=elicitation.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prmichaelsen/remember-mcp",
-  "version": "4.0.2",
+  "version": "4.1.0",
   "description": "Multi-tenant memory system MCP server with vector search and relationships",
   "main": "dist/server.js",
   "type": "module",

package/src/server-factory.ts

@@ -388,7 +388,7 @@ function registerHandlers(
           break;
 
         case 'remember_delete_memory':
-          result = await handleDeleteMemory(args as any, userId, authContext);
+          result = await handleDeleteMemory(args as any, userId, authContext, server);
           break;
 
         case 'remember_update_memory':
@@ -428,15 +428,15 @@ function registerHandlers(
           break;
 
         case 'remember_publish':
-          result = await handlePublish(args as any, userId, authContext);
+          result = await handlePublish(args as any, userId, authContext, server);
           break;
 
         case 'remember_retract':
-          result = await handleRetract(args as any, userId, authContext);
+          result = await handleRetract(args as any, userId, authContext, server);
           break;
 
         case 'remember_revise':
-          result = await handleRevise(args as any, userId, authContext);
+          result = await handleRevise(args as any, userId, authContext, server);
           break;
 
         case 'remember_confirm':
@@ -464,7 +464,7 @@ function registerHandlers(
           break;
 
         case 'remember_request_set_trust_level':
-          result = await handleRequestSetTrustLevel(args as any, userId, authContext);
+          result = await handleRequestSetTrustLevel(args as any, userId, authContext, server);
           break;
 
         case 'remember_search_by':

package/src/server.ts

@@ -152,7 +152,7 @@ function registerHandlers(server: Server): void {
           break;
 
         case 'remember_delete_memory':
-          result = await handleDeleteMemory(args as any, userId, authContext);
+          result = await handleDeleteMemory(args as any, userId, authContext, server);
           break;
 
         case 'remember_update_memory':
@@ -192,15 +192,15 @@ function registerHandlers(server: Server): void {
           break;
 
         case 'remember_publish':
-          result = await handlePublish(args as any, userId, authContext);
+          result = await handlePublish(args as any, userId, authContext, server);
           break;
 
         case 'remember_retract':
-          result = await handleRetract(args as any, userId, authContext);
+          result = await handleRetract(args as any, userId, authContext, server);
           break;
 
         case 'remember_revise':
-          result = await handleRevise(args as any, userId, authContext);
+          result = await handleRevise(args as any, userId, authContext, server);
           break;
 
         case 'remember_confirm':
@@ -228,7 +228,7 @@ function registerHandlers(server: Server): void {
           break;
 
         case 'remember_request_set_trust_level':
-          result = await handleRequestSetTrustLevel(args as any, userId, authContext);
+          result = await handleRequestSetTrustLevel(args as any, userId, authContext, server);
           break;
 
         default:

package/src/tools/delete-memory.ts

@@ -4,10 +4,13 @@
  */
 
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { handleToolError } from '../utils/error-handler.js';
 import { createDebugLogger } from '../utils/debug.js';
 import type { AuthContext } from '../types/auth.js';
 import { createCoreServices } from '../core-services.js';
+import { getWeaviateClient, getMemoryCollectionName } from '../weaviate/client.js';
+import { elicitConfirmation } from '../utils/elicitation.js';
 
 /**
  * Tool definition for remember_delete_memory
@@ -57,7 +60,8 @@ export interface DeleteMemoryArgs {
 export async function handleDeleteMemory(
   args: DeleteMemoryArgs,
   userId: string,
-  authContext?: AuthContext
+  authContext?: AuthContext,
+  server?: Server
 ): Promise<string> {
   const debug = createDebugLogger({ tool: 'remember_delete_memory', userId, operation: 'delete memory' });
   try {
@@ -76,9 +80,53 @@ export async function handleDeleteMemory(
       }
     );
 
-    // Calculate expiry time (5 minutes from now)
-    const expiresAt = new Date(Date.now() + 5 * 60 * 1000);
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Delete memory "${args.memory_id}"${args.reason ? ` (reason: ${args.reason})` : ''}?`,
+    });
+
+    if (confirmation.type === 'confirmed') {
+      // Consume the token and execute deletion
+      const confirmed = await tokenService.confirmRequest(userId, token);
+      if (!confirmed) {
+        return JSON.stringify(
+          { success: false, error: 'Token already consumed', message: 'The confirmation token has already been used.' },
+          null,
+          2
+        );
+      }
+
+      const { memory_id, reason } = confirmed.payload;
+      const client = getWeaviateClient();
+      const collectionName = getMemoryCollectionName(userId);
+      const collection = client.collections.get(collectionName);
 
+      await collection.data.update({
+        id: memory_id,
+        properties: {
+          deleted_at: new Date().toISOString(),
+          deleted_by: userId,
+          deletion_reason: reason || null,
+        },
+      });
+
+      return JSON.stringify(
+        { success: true, memory_id, message: 'Memory deleted successfully' },
+        null,
+        2
+      );
+    }
+
+    if (confirmation.type === 'declined') {
+      return JSON.stringify(
+        { success: false, message: 'Deletion cancelled by user.' },
+        null,
+        2
+      );
+    }
+
+    // Fallback: return token for legacy confirm/deny flow
+    const expiresAt = new Date(Date.now() + 5 * 60 * 1000);
     return JSON.stringify(
       {
         success: true,

package/src/tools/publish.ts

@@ -12,11 +12,13 @@
  */
 
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { handleToolError } from '../utils/error-handler.js';
 import { SUPPORTED_SPACES } from '../types/space-memory.js';
 import { createDebugLogger } from '../utils/debug.js';
 import type { AuthContext } from '../types/auth.js';
 import { createCoreServices } from '../core-services.js';
+import { elicitConfirmation } from '../utils/elicitation.js';
 
 /**
  * Tool definition for remember_publish
@@ -78,7 +80,8 @@ interface PublishArgs {
 export async function handlePublish(
   args: PublishArgs,
   userId: string,
-  authContext?: AuthContext
+  authContext?: AuthContext,
+  server?: Server
 ): Promise<string> {
   const debug = createDebugLogger({
     tool: 'remember_publish',
@@ -98,6 +101,39 @@ export async function handlePublish(
       additional_tags: args.additional_tags,
     });
 
+    // Try elicitation for direct user confirmation
+    const destinations = [...(args.spaces || []), ...(args.groups || [])].join(', ');
+    const confirmation = await elicitConfirmation({
+      server,
+      message: `Publish memory "${args.memory_id}" to ${destinations || 'default space'}?`,
+    });
+
+    if (confirmation.type === 'confirmed') {
+      const confirmResult = await space.confirm({ token: result.token });
+      return JSON.stringify(
+        {
+          success: confirmResult.success,
+          composite_id: confirmResult.composite_id,
+          published_to: confirmResult.published_to,
+          failed: confirmResult.failed?.length ? confirmResult.failed : undefined,
+          space_ids: confirmResult.space_ids,
+          group_ids: confirmResult.group_ids,
+        },
+        null,
+        2
+      );
+    }
+
+    if (confirmation.type === 'declined') {
+      await space.deny({ token: result.token });
+      return JSON.stringify(
+        { success: false, message: 'Publication cancelled by user.' },
+        null,
+        2
+      );
+    }
+
+    // Fallback: return token for legacy confirm/deny flow
     return JSON.stringify(
       {
         success: true,