@tenderprompt/cli 0.1.20 → 0.1.22

package/dist/artifact-memory.d.ts

@@ -0,0 +1,103 @@
+export declare const ARTIFACT_MEMORY_SCHEMA = "tender.artifact-memory.v1";
+export declare const ARTIFACT_MEMORY_NOTES_REF = "refs/notes/tender/memory";
+export declare const ARTIFACT_MEMORY_NOTES_SHORT_REF = "tender/memory";
+export type ArtifactMemoryKind = 'intent' | 'observation' | 'decision' | 'change' | 'validation' | 'failure' | 'hypothesis' | 'open_question' | 'procedure' | 'support_handoff' | 'reflection' | 'summary' | 'note';
+export type ArtifactMemoryEntry = {
+    schema: typeof ARTIFACT_MEMORY_SCHEMA;
+    entryId: string;
+    sessionId: string;
+    artifactId: string;
+    tenantId?: string;
+    commitSha: string;
+    kind: ArtifactMemoryKind;
+    originalKind?: string;
+    visibility: 'support';
+    summary: string;
+    body?: string;
+    tags: string[];
+    status?: 'open' | 'resolved' | 'superseded';
+    severity?: 'info' | 'warning' | 'error';
+    source: {
+        actor: 'agent' | 'user' | 'cli';
+        command?: string;
+    };
+    related?: {
+        files?: string[];
+        commands?: string[];
+        previewUrl?: string;
+        publishedUrl?: string;
+        releaseId?: string;
+        issueUrl?: string;
+    };
+    safety: {
+        redacted: boolean;
+        warnings: string[];
+    };
+    createdAt: string;
+};
+export type ArtifactMemoryCommandRunner = (command: string, args: string[], options: {
+    cwd: string;
+}) => Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+export type ArtifactMemoryAppendInput = {
+    repoPath: string;
+    artifactId?: string | null;
+    tenantId?: string | null;
+    commitSha?: string | null;
+    kind: string;
+    summary: string;
+    body?: string | null;
+    tags?: string[];
+    status?: ArtifactMemoryEntry['status'];
+    severity?: ArtifactMemoryEntry['severity'];
+    source?: ArtifactMemoryEntry['source'];
+    related?: ArtifactMemoryEntry['related'];
+    now?: () => number;
+    runner: ArtifactMemoryCommandRunner;
+};
+export type ArtifactMemoryAppendResult = {
+    entry: ArtifactMemoryEntry;
+    warnings: string[];
+    noteBytes: number;
+};
+export type ArtifactMemorySyncResult = {
+    status: 'fetched' | 'pushed' | 'not_configured' | 'failed';
+    ref: typeof ARTIFACT_MEMORY_NOTES_REF;
+    commitSha: string | null;
+    error?: string;
+};
+export declare function normalizeArtifactMemoryKind(kind: string): {
+    kind: ArtifactMemoryKind;
+    originalKind?: string;
+    warnings: string[];
+    tags: string[];
+};
+export declare function redactArtifactMemoryText(value: string): {
+    text: string;
+    redacted: boolean;
+    warnings: string[];
+};
+export declare function readArtifactMemoryHead(input: {
+    repoPath: string;
+    runner: ArtifactMemoryCommandRunner;
+}): Promise<string>;
+export declare function appendArtifactMemoryNote(input: ArtifactMemoryAppendInput): Promise<ArtifactMemoryAppendResult>;
+export declare function readArtifactMemoryEntries(input: {
+    repoPath: string;
+    runner: ArtifactMemoryCommandRunner;
+    commitSha?: string | null;
+}): Promise<ArtifactMemoryEntry[]>;
+export declare function fetchArtifactMemoryNotes(input: {
+    repoPath: string;
+    remoteName: string;
+    runner: ArtifactMemoryCommandRunner;
+}): Promise<ArtifactMemorySyncResult>;
+export declare function pushArtifactMemoryNotes(input: {
+    repoPath: string;
+    remoteName: string;
+    runner: ArtifactMemoryCommandRunner;
+}): Promise<ArtifactMemorySyncResult>;
+export declare function formatArtifactMemoryEntry(entry: ArtifactMemoryEntry): string;

package/dist/artifact-memory.js

@@ -0,0 +1,283 @@
+import { randomUUID } from 'node:crypto';
+export const ARTIFACT_MEMORY_SCHEMA = 'tender.artifact-memory.v1';
+export const ARTIFACT_MEMORY_NOTES_REF = 'refs/notes/tender/memory';
+export const ARTIFACT_MEMORY_NOTES_SHORT_REF = 'tender/memory';
+const ARTIFACT_MEMORY_ENTRY_MAX_BYTES = 8 * 1024;
+const ARTIFACT_MEMORY_NOTE_MAX_BYTES = 256 * 1024;
+const ARTIFACT_MEMORY_SESSION_CONFIG_KEY = 'tender.memory.sessionId';
+const ARTIFACT_MEMORY_KINDS = new Set([
+    'intent',
+    'observation',
+    'decision',
+    'change',
+    'validation',
+    'failure',
+    'hypothesis',
+    'open_question',
+    'procedure',
+    'support_handoff',
+    'reflection',
+    'summary',
+    'note',
+]);
+const KIND_ALIASES = new Map([
+    ['thought', 'reflection'],
+    ['debug_thought', 'reflection'],
+    ['debug-thought', 'reflection'],
+    ['error', 'failure'],
+    ['issue', 'failure'],
+    ['problem', 'failure'],
+    ['question', 'open_question'],
+    ['todo', 'open_question'],
+    ['final', 'summary'],
+]);
+function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function normalizeTags(tags, fallback) {
+    const normalized = (tags ?? [])
+        .map((tag) => tag.trim().toLowerCase().replace(/[^a-z0-9_.:-]+/g, '-'))
+        .filter(Boolean)
+        .slice(0, 12);
+    return normalized.length > 0 ? [...new Set(normalized)] : fallback;
+}
+export function normalizeArtifactMemoryKind(kind) {
+    const normalized = kind.trim().toLowerCase().replaceAll('-', '_');
+    if (ARTIFACT_MEMORY_KINDS.has(normalized)) {
+        return {
+            kind: normalized,
+            warnings: [],
+            tags: [],
+        };
+    }
+    const alias = KIND_ALIASES.get(normalized);
+    if (alias && ARTIFACT_MEMORY_KINDS.has(alias)) {
+        return {
+            kind: alias,
+            originalKind: kind,
+            warnings: ['unknown_kind_normalized'],
+            tags: [],
+        };
+    }
+    return {
+        kind: 'note',
+        originalKind: kind,
+        warnings: ['unknown_kind_normalized'],
+        tags: ['uncategorized'],
+    };
+}
+const SECRET_PATTERNS = [
+    [/\b(authorization|proxy-authorization)\s*[:=]\s*(bearer\s+)?[^\s,;'"`]+/gi, '$1: [REDACTED]'],
+    [/\b(cookie|set-cookie)\s*[:=]\s*[^\n\r]+/gi, '$1: [REDACTED]'],
+    [/\b(x-api-key|api-key|private-token|x-shopify-access-token)\s*[:=]\s*[^\s,;'"`]+/gi, '$1: [REDACTED]'],
+    [/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|ACCESS_KEY|PRIVATE_KEY))=([^\s]+)/g, '$1=[REDACTED]'],
+    [/\b(tp_[A-Za-z0-9._-]{12,})\b/g, '[REDACTED_TOKEN]'],
+    [/\b(gh[pousr]_[A-Za-z0-9_]{20,})\b/g, '[REDACTED_TOKEN]'],
+    [/\b(sk-[A-Za-z0-9_-]{20,})\b/g, '[REDACTED_TOKEN]'],
+];
+export function redactArtifactMemoryText(value) {
+    let text = value;
+    const warnings = new Set();
+    for (const [pattern, replacement] of SECRET_PATTERNS) {
+        const next = text.replace(pattern, replacement);
+        if (next !== text) {
+            warnings.add('secret_like_value_redacted');
+            text = next;
+        }
+    }
+    return {
+        text,
+        redacted: warnings.size > 0,
+        warnings: [...warnings],
+    };
+}
+function assertUsefulMemoryText(input) {
+    if (!input.summary.trim() && !input.body?.trim()) {
+        throw new Error('Memory entries require --summary or --body.\nNext: tender memory add --summary "What future agents should know"');
+    }
+    const total = `${input.summary}\n${input.body ?? ''}`.trim();
+    const lineCount = total.split(/\r?\n/).length;
+    if (lineCount > 240 || byteLength(total) > ARTIFACT_MEMORY_ENTRY_MAX_BYTES) {
+        throw new Error(`Memory entries are limited to ${ARTIFACT_MEMORY_ENTRY_MAX_BYTES} bytes. Summarize the relevant context instead.\nNext: tender memory handoff --reason "Need Tender support" --summary "Current blocker and what was tried"`);
+    }
+    if (lineCount > 40 && !/^summary|support_handoff|reflection$/i.test(input.summary)) {
+        throw new Error('Memory entries should be bounded summaries, not raw transcript dumps.\nNext: tender memory add --kind summary --summary "Compact the useful context" --body "Goal, changes, failures, and next step"');
+    }
+}
+async function runGit(input) {
+    const result = await input.runner('git', input.args, { cwd: input.repoPath });
+    if (!input.allowFailure && result.exitCode !== 0) {
+        throw new Error([`git ${input.args.join(' ')} failed with exit code ${result.exitCode}.`, result.stderr.trim() || result.stdout.trim()]
+            .filter(Boolean)
+            .join('\n'));
+    }
+    return result;
+}
+export async function readArtifactMemoryHead(input) {
+    const result = await runGit({
+        ...input,
+        args: ['rev-parse', 'HEAD'],
+    });
+    const commitSha = result.stdout.trim();
+    if (!/^[0-9a-f]{40}$/i.test(commitSha)) {
+        throw new Error('Artifact memory requires a checkout with a valid HEAD commit.\nNext: commit your source or run tender app init <app-id> --dir .');
+    }
+    return commitSha;
+}
+async function readArtifactMemorySessionId(input) {
+    const existing = await runGit({
+        ...input,
+        args: ['config', '--local', '--get', ARTIFACT_MEMORY_SESSION_CONFIG_KEY],
+        allowFailure: true,
+    });
+    const existingSessionId = existing.exitCode === 0 ? existing.stdout.trim() : '';
+    if (existingSessionId) {
+        return existingSessionId;
+    }
+    const sessionId = `sess_${randomUUID()}`;
+    await runGit({
+        ...input,
+        args: ['config', '--local', ARTIFACT_MEMORY_SESSION_CONFIG_KEY, sessionId],
+    });
+    return sessionId;
+}
+async function inferArtifactIdFromRemote(input) {
+    const result = await runGit({
+        ...input,
+        args: ['remote', '-v'],
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0) {
+        return null;
+    }
+    const match = result.stdout.match(/\bartifact_[A-Za-z0-9_-]+(?=\.git|\b|\/)/);
+    return match?.[0] ?? null;
+}
+async function readExistingNote(input) {
+    const result = await runGit({
+        ...input,
+        args: ['notes', `--ref=${ARTIFACT_MEMORY_NOTES_SHORT_REF}`, 'show', input.commitSha],
+        allowFailure: true,
+    });
+    return result.exitCode === 0 ? result.stdout : '';
+}
+export async function appendArtifactMemoryNote(input) {
+    assertUsefulMemoryText(input);
+    const commitSha = input.commitSha ?? (await readArtifactMemoryHead(input));
+    const artifactId = input.artifactId ?? (await inferArtifactIdFromRemote(input));
+    if (!artifactId) {
+        throw new Error('Artifact memory requires an artifact id. Pass --artifact or run inside a checkout with a Tender artifact remote.\nNext: tender app git setup <app-id> --dir .');
+    }
+    const sessionId = await readArtifactMemorySessionId(input);
+    const normalizedKind = normalizeArtifactMemoryKind(input.kind);
+    const redactedSummary = redactArtifactMemoryText(input.summary.trim());
+    const redactedBody = input.body?.trim() ? redactArtifactMemoryText(input.body.trim()) : null;
+    const warnings = [
+        ...normalizedKind.warnings,
+        ...redactedSummary.warnings,
+        ...(redactedBody?.warnings ?? []),
+    ];
+    const entry = {
+        schema: ARTIFACT_MEMORY_SCHEMA,
+        entryId: `mem_${randomUUID()}`,
+        sessionId,
+        artifactId,
+        ...(input.tenantId ? { tenantId: input.tenantId } : {}),
+        commitSha,
+        kind: normalizedKind.kind,
+        ...(normalizedKind.originalKind ? { originalKind: normalizedKind.originalKind } : {}),
+        visibility: 'support',
+        summary: redactedSummary.text,
+        ...(redactedBody?.text ? { body: redactedBody.text } : {}),
+        tags: normalizeTags(input.tags, normalizedKind.tags),
+        ...(input.status ? { status: input.status } : {}),
+        ...(input.severity ? { severity: input.severity } : {}),
+        source: input.source ?? { actor: 'agent' },
+        ...(input.related && Object.keys(input.related).length > 0 ? { related: input.related } : {}),
+        safety: {
+            redacted: redactedSummary.redacted || Boolean(redactedBody?.redacted),
+            warnings: [...new Set(warnings)],
+        },
+        createdAt: new Date(input.now?.() ?? Date.now()).toISOString(),
+    };
+    const line = JSON.stringify(entry);
+    if (byteLength(line) > ARTIFACT_MEMORY_ENTRY_MAX_BYTES) {
+        throw new Error(`Memory entry is limited to ${ARTIFACT_MEMORY_ENTRY_MAX_BYTES} bytes after redaction.\nNext: tender memory add --kind summary --summary "Short context" --body "Bounded details only"`);
+    }
+    const existingNote = await readExistingNote({ ...input, commitSha });
+    const nextNote = `${existingNote.trimEnd()}${existingNote.trim() ? '\n' : ''}${line}\n`;
+    const noteBytes = byteLength(nextNote);
+    const noteWarnings = noteBytes > ARTIFACT_MEMORY_NOTE_MAX_BYTES ? ['commit_note_payload_large_compaction_recommended'] : [];
+    await runGit({
+        ...input,
+        args: ['notes', `--ref=${ARTIFACT_MEMORY_NOTES_SHORT_REF}`, 'add', '-f', '-m', nextNote, commitSha],
+    });
+    return {
+        entry: noteWarnings.length > 0 ? { ...entry, safety: { ...entry.safety, warnings: [...entry.safety.warnings, ...noteWarnings] } } : entry,
+        warnings: [...new Set([...warnings, ...noteWarnings])],
+        noteBytes,
+    };
+}
+export async function readArtifactMemoryEntries(input) {
+    const commitSha = input.commitSha ?? (await readArtifactMemoryHead(input));
+    const note = await readExistingNote({ ...input, commitSha });
+    return note
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .flatMap((line) => {
+        try {
+            const value = JSON.parse(line);
+            return value?.schema === ARTIFACT_MEMORY_SCHEMA ? [value] : [];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+export async function fetchArtifactMemoryNotes(input) {
+    const result = await runGit({
+        ...input,
+        args: ['fetch', input.remoteName, `${ARTIFACT_MEMORY_NOTES_REF}:${ARTIFACT_MEMORY_NOTES_REF}`],
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0) {
+        return {
+            status: 'failed',
+            ref: ARTIFACT_MEMORY_NOTES_REF,
+            commitSha: null,
+            error: result.stderr.trim() || result.stdout.trim() || 'git fetch notes failed',
+        };
+    }
+    return { status: 'fetched', ref: ARTIFACT_MEMORY_NOTES_REF, commitSha: null };
+}
+export async function pushArtifactMemoryNotes(input) {
+    const head = await readArtifactMemoryHead(input).catch(() => null);
+    const remote = await runGit({
+        ...input,
+        args: ['remote', 'get-url', input.remoteName],
+        allowFailure: true,
+    });
+    if (remote.exitCode !== 0) {
+        return { status: 'not_configured', ref: ARTIFACT_MEMORY_NOTES_REF, commitSha: head };
+    }
+    const result = await runGit({
+        ...input,
+        args: ['push', input.remoteName, `${ARTIFACT_MEMORY_NOTES_REF}:${ARTIFACT_MEMORY_NOTES_REF}`],
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0) {
+        return {
+            status: 'failed',
+            ref: ARTIFACT_MEMORY_NOTES_REF,
+            commitSha: head,
+            error: result.stderr.trim() || result.stdout.trim() || 'git push notes failed',
+        };
+    }
+    return { status: 'pushed', ref: ARTIFACT_MEMORY_NOTES_REF, commitSha: head };
+}
+export function formatArtifactMemoryEntry(entry) {
+    const tags = entry.tags.length > 0 ? ` [${entry.tags.join(', ')}]` : '';
+    const status = entry.status ? ` ${entry.status}` : '';
+    return `${entry.createdAt} ${entry.kind}${status}: ${entry.summary}${tags}`;
+}

package/dist/index.js

@@ -5,7 +5,8 @@ import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { generateTenderAppEnvTypes, validateTenderApp, } from '@tenderprompt/tender-app-validator';
+import { generateTenderAppEnvTypes, isForbiddenTenderAppRepoPath, isForbiddenTenderAppSecretPath, validateTenderApp, } from '@tenderprompt/tender-app-validator';
+import { ARTIFACT_MEMORY_NOTES_REF, appendArtifactMemoryNote, fetchArtifactMemoryNotes, formatArtifactMemoryEntry, pushArtifactMemoryNotes, readArtifactMemoryEntries, readArtifactMemoryHead, } from "./artifact-memory.js";
 import { collectTenderAppFiles } from "./local-files.js";
 const CLI_PACKAGE_NAME = '@tenderprompt/cli';
 const UNKNOWN_CLI_VERSION = '0.0.0';
@@ -79,6 +80,10 @@ Commands:
   tender auth login --device
                              Authorize this machine with a browser-approved device flow
   tender auth status         Show whether a Tender API token is available
+  tender memory add          Add artifact memory to Git notes for future agents and support
+  tender memory handoff      Capture a support handoff memory entry
+  tender memory brief        Print the latest useful artifact memory
+  tender memory flush        Push artifact memory notes to the Tender Git remote
   tender playbooks list      List remote Tender Prompt playbook metadata
   tender playbooks get <id>  Fetch one remote playbook body on demand
   tender playbooks file <id> --path <path>
@@ -143,6 +148,10 @@ Examples:
   tender capabilities --json
   tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
   tender auth status --json
+  tender memory add --kind decision --summary "Kept auth in the host gateway" --json
+  tender memory handoff --reason "Preview publish is blocked" --summary "Need Tender support" --json
+  tender memory brief --json
+  tender memory flush --json
   tender playbooks list --json
   tender playbooks get recharge-bundle-builder --json
   tender playbooks file recharge-bundle-builder --path references/recharge-payloads.md --json
@@ -219,6 +228,52 @@ Examples:
   tender auth status
   tender auth status --profile publish --json`;
 }
+function memoryHelp() {
+    return `Usage: tender memory <command> [options]
+
+Commands:
+  tender memory start --summary <text>
+                             Start an artifact memory session. Optional; sessions are created lazily.
+  tender memory add --kind <kind> --summary <text>
+                             Add one bounded artifact memory entry to Git notes.
+  tender memory handoff      Capture a support-focused handoff entry.
+  tender memory show         Show memory entries attached to the current commit.
+  tender memory brief        Show the latest useful memory summary.
+  tender memory flush        Push refs/notes/tender/memory to the configured remote.
+  tender memory export       Export artifact memory entries as JSONL.
+
+Options:
+  --dir <path>        Artifact checkout directory. Defaults to current directory.
+  --artifact <id>     Artifact id when it cannot be inferred from the remote.
+  --remote <name>     Git remote to fetch or push notes. Defaults to tender.
+  --json              Emit stable JSON for coding agents.
+
+Examples:
+  tender memory add --kind intent --summary "Fix checkout submit flow" --json
+  tender memory add --kind decision --summary "Kept credential injection in the host gateway" --body "Generated code should not set Authorization headers." --json
+  tender memory handoff --reason "Need Tender support debugging publish failure" --summary "Preview works but publish fails" --json
+  tender memory brief --json
+  tender memory export --format jsonl
+  tender memory flush --json`;
+}
+function memoryAddHelp() {
+    return `Usage: tender memory add --kind <kind> --summary <text> [--body <text>] [--tag <tag>] [--dir <path>] [--artifact <id>] [--remote <name>] [--json]
+
+Known kinds: intent, observation, decision, change, validation, failure, hypothesis, open_question, procedure, support_handoff, reflection, summary, note.
+Unknown kinds are stored as kind "note" with originalKind preserved.
+
+Examples:
+  tender memory add --kind observation --summary "The app reads product.metadata.heroVideoUrl" --json
+  tender memory add --kind summary --summary "Session summary" --body "Changed src/server.ts, validated, and previewed." --json`;
+}
+function memoryHandoffHelp() {
+    return `Usage: tender memory handoff [--reason <text>] [--summary <text>] [--body <text>] [--dir <path>] [--artifact <id>] [--remote <name>] [--json]
+
+Use this when the user wants to ask Tender for help. If --reason is omitted, the CLI tries to infer context from recent failure or open_question entries.
+
+Examples:
+  tender memory handoff --reason "Need Tender support debugging preview failure" --summary "Preview route /api/vote returns 500" --json`;
+}
 function playbooksHelp() {
     return `Usage: tender playbooks <command> [options]
 
@@ -1087,6 +1142,7 @@ function tenderCliCapabilities() {
                 'tender --version',
                 'tender --help',
                 'tender auth --help',
+                'tender memory --help',
                 'tender playbooks --help',
                 'tender app --help',
                 'tender app agent heartbeat --help',
@@ -1163,6 +1219,7 @@ function tenderCliCapabilities() {
                 when: 'When editing app source from a local checkout.',
                 commands: [
                     'tender app agent heartbeat <artifact-id> --source codex --status connected --summary "Loaded Tender Prompt context" --json',
+                    'tender memory add --artifact <artifact-id> --kind intent --summary "User goal and current plan" --json',
                     'tender app doctor --dir <dir> --json',
                     'tender app agent heartbeat <artifact-id> --source codex --status working --phase editing --summary "Editing app files" --json',
                     'tender app git setup <artifact-id> --dir <dir> --dry-run --json',
@@ -1172,9 +1229,13 @@ function tenderCliCapabilities() {
                     'tender app outbound-auth list <artifact-id> --json',
                     'tender app publish <artifact-id> --dry-run --json',
                     'tender app publish <artifact-id> --commit $(git rev-parse HEAD) --confirm publish --stream --json',
+                    'tender memory add --kind summary --summary "What changed, what passed, and what remains" --json',
+                    'tender memory flush --json',
                 ],
                 notes: [
                     'Send heartbeat updates only at meaningful milestones or when waiting for user input; do not send rapid polling updates.',
+                    'Use tender memory add for durable artifact context that future agents or Tender support should know.',
+                    'Use tender memory handoff when blocked or when the user asks to contact Tender support.',
                     'If preview or publish reports outbound auth grant approval required, run tender app outbound-auth approve <artifact-id> --all --confirm approve --json, then retry.',
                     'Publishing is production-facing and requires explicit user intent.',
                 ],
@@ -3151,6 +3212,201 @@ function parseContextRefreshArgs(args) {
         json,
     };
 }
+function parseMemoryCommonArgs(args) {
+    let dir = '.';
+    let artifactId = null;
+    let remoteName = 'tender';
+    let json = false;
+    const remaining = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        if (arg === '--dir') {
+            dir = parseRequiredFlagValue(args[index + 1], '--dir');
+            index += 1;
+            continue;
+        }
+        if (arg === '--artifact') {
+            artifactId = parseRequiredFlagValue(args[index + 1], '--artifact');
+            index += 1;
+            continue;
+        }
+        if (arg === '--remote') {
+            remoteName = parseRemoteName(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        remaining.push(arg);
+    }
+    return { dir, artifactId, remoteName, json, remaining };
+}
+function parseMemoryStartArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory start' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let summary = '';
+    let body = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--summary') {
+            summary = parseRequiredFlagValue(parsed.remaining[index + 1], '--summary');
+            index += 1;
+            continue;
+        }
+        if (arg === '--body') {
+            body = parseRequiredFlagValue(parsed.remaining[index + 1], '--body');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory start option: ${arg}`);
+    }
+    if (!summary.trim()) {
+        throw new TenderCliUsageError('memory start requires --summary.\nNext: tender memory start --summary "Current user goal"');
+    }
+    return { command: 'memory start', summary, body, ...parsed };
+}
+function parseMemoryAddArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory add' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let kind = 'note';
+    let summary = '';
+    let body = null;
+    const tags = [];
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--kind') {
+            kind = parseRequiredFlagValue(parsed.remaining[index + 1], '--kind');
+            index += 1;
+            continue;
+        }
+        if (arg === '--summary') {
+            summary = parseRequiredFlagValue(parsed.remaining[index + 1], '--summary');
+            index += 1;
+            continue;
+        }
+        if (arg === '--body') {
+            body = parseRequiredFlagValue(parsed.remaining[index + 1], '--body');
+            index += 1;
+            continue;
+        }
+        if (arg === '--tag') {
+            tags.push(parseRequiredFlagValue(parsed.remaining[index + 1], '--tag'));
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory add option: ${arg}`);
+    }
+    return { command: 'memory add', kind, summary, body, tags, ...parsed };
+}
+function parseMemoryHandoffArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory handoff' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let reason = null;
+    let summary = null;
+    let body = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--reason') {
+            reason = parseRequiredFlagValue(parsed.remaining[index + 1], '--reason');
+            index += 1;
+            continue;
+        }
+        if (arg === '--summary') {
+            summary = parseRequiredFlagValue(parsed.remaining[index + 1], '--summary');
+            index += 1;
+            continue;
+        }
+        if (arg === '--body') {
+            body = parseRequiredFlagValue(parsed.remaining[index + 1], '--body');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory handoff option: ${arg}`);
+    }
+    return { command: 'memory handoff', reason, summary, body, ...parsed };
+}
+function parseMemoryShowArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory show' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let commitSha = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--commit') {
+            commitSha = parseRequiredFlagValue(parsed.remaining[index + 1], '--commit');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory show option: ${arg}`);
+    }
+    return { command: 'memory show', commitSha, ...parsed };
+}
+function parseMemoryBriefArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory brief' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let limit = 12;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--limit') {
+            limit = parsePositiveIntegerFlag(parsed.remaining[index + 1], '--limit');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory brief option: ${arg}`);
+    }
+    return { command: 'memory brief', limit, ...parsed };
+}
+function parseMemoryFlushArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory flush' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    if (parsed.remaining.length > 0) {
+        throw new TenderCliUsageError(`Unknown memory flush option: ${parsed.remaining[0]}`);
+    }
+    return { command: 'memory flush', ...parsed };
+}
+function parseMemoryExportArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'memory export' };
+    }
+    const parsed = parseMemoryCommonArgs(args);
+    let format = null;
+    let commitSha = null;
+    for (let index = 0; index < parsed.remaining.length; index += 1) {
+        const arg = parsed.remaining[index];
+        if (arg === '--format') {
+            const value = parseRequiredFlagValue(parsed.remaining[index + 1], '--format');
+            if (value !== 'jsonl') {
+                throw new TenderCliUsageError(`Unsupported memory export format: ${value}.\nNext: tender memory export --format jsonl --dir ${parsed.dir}`);
+            }
+            format = value;
+            index += 1;
+            continue;
+        }
+        if (arg === '--commit') {
+            commitSha = parseRequiredFlagValue(parsed.remaining[index + 1], '--commit');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown memory export option: ${arg}`);
+    }
+    if (format === null) {
+        throw new TenderCliUsageError(`memory export requires --format jsonl.\nNext: tender memory export --format jsonl --dir ${parsed.dir}`);
+    }
+    return { command: 'memory export', format, commitSha, ...parsed };
+}
 function parseTokenProfile(value) {
     if (value === 'edit-preview' || value === 'publish' || value === 'create' || value === 'db-read') {
         return value;
@@ -4848,6 +5104,33 @@ function parseTenderArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown auth command: ${args[1]}`);
     }
+    if (args[0] === 'memory') {
+        if (args[1] === undefined || args[1] === '--help' || args[1] === '-h') {
+            return { command: 'help', topic: 'memory' };
+        }
+        if (args[1] === 'start') {
+            return parseMemoryStartArgs(args.slice(2));
+        }
+        if (args[1] === 'add') {
+            return parseMemoryAddArgs(args.slice(2));
+        }
+        if (args[1] === 'handoff') {
+            return parseMemoryHandoffArgs(args.slice(2));
+        }
+        if (args[1] === 'show') {
+            return parseMemoryShowArgs(args.slice(2));
+        }
+        if (args[1] === 'brief') {
+            return parseMemoryBriefArgs(args.slice(2));
+        }
+        if (args[1] === 'flush') {
+            return parseMemoryFlushArgs(args.slice(2));
+        }
+        if (args[1] === 'export') {
+            return parseMemoryExportArgs(args.slice(2));
+        }
+        throw new TenderCliUsageError(`Unknown memory command: ${args[1]}`);
+    }
     if (args[0] === 'playbooks') {
         if (args[1] === undefined || args[1] === '--help' || args[1] === '-h') {
             return { command: 'help', topic: 'playbooks' };
@@ -5865,6 +6148,30 @@ function readPreviewUrlFromJob(job) {
 function readPublishedUrlFromJob(job) {
     return readObjectString(job?.result, 'publishedUrl');
 }
+function readReleaseGitRefFromResult(result) {
+    const releaseGitRef = readObject(readObject(result)?.releaseGitRef);
+    if (releaseGitRef?.type !== 'tag') {
+        return null;
+    }
+    const tagName = readObjectString(releaseGitRef, 'name');
+    const commitSha = readObjectString(releaseGitRef, 'commitSha');
+    if (!tagName && !commitSha) {
+        return null;
+    }
+    return {
+        tagName,
+        commitSha,
+    };
+}
+function formatPublishResultLines(result) {
+    const record = readObject(result);
+    const releaseGitRef = readReleaseGitRefFromResult(result);
+    return [
+        ...(readObjectString(record, 'publishedUrl') ? [`published_url: ${readObjectString(record, 'publishedUrl')}`] : []),
+        ...(releaseGitRef?.tagName ? [`release_tag: ${releaseGitRef.tagName}`] : []),
+        ...(releaseGitRef?.commitSha ? [`source_commit: ${releaseGitRef.commitSha}`] : []),
+    ];
+}
 function normalizeContextFilePath(filePath) {
     const normalized = path.posix.normalize(filePath.replaceAll('\\', '/')).replace(/^\/+/, '');
     if (!normalized || normalized === '.' || normalized.startsWith('../') || normalized.includes('/../')) {
@@ -5872,6 +6179,9 @@ function normalizeContextFilePath(filePath) {
     }
     return normalized;
 }
+function isForbiddenSourceExportPath(filePath) {
+    return isForbiddenTenderAppRepoPath(filePath) || isForbiddenTenderAppSecretPath(filePath);
+}
 function resolveContextOutputPath(root, relativePath) {
     const absolutePath = path.resolve(root, relativePath);
     const relativeFromRoot = path.relative(root, absolutePath);
@@ -5971,6 +6281,9 @@ async function collectArtifactWorkspaceSourceFiles(input) {
             if (!normalizedPath) {
                 continue;
             }
+            if (isForbiddenSourceExportPath(normalizedPath)) {
+                continue;
+            }
             if (entry.type === 'directory') {
                 queue.push(entry.path);
                 continue;
@@ -5996,7 +6309,11 @@ async function collectArtifactWorkspaceSourceFiles(input) {
 async function planSourceFiles(input) {
     const planned = [];
     for (const file of input.files) {
-        const absolutePath = resolveContextOutputPath(input.root, file.path);
+        const relativePath = normalizeContextFilePath(file.path);
+        if (!relativePath || isForbiddenSourceExportPath(relativePath)) {
+            continue;
+        }
+        const absolutePath = resolveContextOutputPath(input.root, relativePath);
         if (!absolutePath) {
             throw new Error(`Source file path escapes the target directory: ${file.path}`);
         }
@@ -6012,7 +6329,7 @@ async function planSourceFiles(input) {
             action = input.force ? 'overwrite' : 'conflict';
         }
         planned.push({
-            path: file.path,
+            path: relativePath,
             absolutePath,
             action,
             content: file.content,
@@ -7178,6 +7495,13 @@ async function runGitSetup(command, io, runtime) {
             credentialHelper: helper,
         });
     }
+    const memoryFetch = command.dryRun
+        ? { status: 'not_configured', ref: ARTIFACT_MEMORY_NOTES_REF, commitSha: null }
+        : await fetchArtifactMemoryNotes({
+            repoPath: root,
+            remoteName: command.remoteName,
+            runner: commandRunnerForMemory(runtime),
+        });
     const result = {
         ok: true,
         command: command.command,
@@ -7192,6 +7516,7 @@ async function runGitSetup(command, io, runtime) {
         authSource: credentials.source,
         profile: credentials.profileName,
         credentialHelper: helper,
+        memoryFetch,
         commands: plannedCommands.map((parts) => parts.join(' ')),
         next: `git push ${command.remoteName} ${git.defaultBranch}`,
     };
@@ -7203,6 +7528,7 @@ async function runGitSetup(command, io, runtime) {
             `remote: ${command.remoteName}`,
             `remote_url: ${git.remoteUrl}`,
             `default_branch: ${git.defaultBranch}`,
+            `memory_fetch: ${memoryFetch.status}`,
             `next: ${result.next}`,
         ].join('\n'));
     }
@@ -7334,6 +7660,14 @@ async function runArtifactsInit(command, io, runtime) {
         job: null,
         result: null,
     };
+    let memoryFetch = {
+        status: command.dryRun ? 'not_configured' : 'failed',
+        ref: ARTIFACT_MEMORY_NOTES_REF,
+        commitSha: null,
+        ...(command.dryRun ? {} : { error: 'not_attempted' }),
+    };
+    let memory = null;
+    let memorySync = null;
     let seedPaths = [];
     let plannedFiles = await planContextFiles({
         root,
@@ -7362,6 +7696,11 @@ async function runArtifactsInit(command, io, runtime) {
             remoteUrl: git.remoteUrl,
             credentialHelper: helper,
         });
+        memoryFetch = await fetchArtifactMemoryNotes({
+            repoPath: root,
+            remoteName: command.remoteName,
+            runner: commandRunnerForMemory(runtime),
+        });
         sourceCheckout = await maybeCheckoutInitialArtifactSource({
             runtime,
             root,
@@ -7603,6 +7942,22 @@ async function runArtifactsInit(command, io, runtime) {
                 };
             }
         }
+        memory = await appendAutomaticMemory({
+            repoPath: root,
+            artifactId: command.artifactId,
+            kind: 'change',
+            summary: 'Initialized local Tender app checkout',
+            body: `Source checkout: ${sourceCheckout.skippedReason ?? (sourceCheckout.checkedOut ? 'checked_out' : 'not_checked_out')}\nSource export: ${sourceExport.skippedReason ?? sourceExport.source ?? 'none'}\nPreview: ${preview.skippedReason ?? (preview.attempted ? 'requested' : 'not_requested')}`,
+            tags: ['init'],
+            status: 'resolved',
+            related: {
+                files: seedPaths,
+                commands: [command.command],
+                ...(preview.job?.jobId ? { releaseId: preview.job.jobId } : {}),
+            },
+            runtime,
+        });
+        memorySync = await flushAutomaticMemory({ repoPath: root, remoteName: command.remoteName, runtime });
     }
     const result = {
         ok: true,
@@ -7623,6 +7978,9 @@ async function runArtifactsInit(command, io, runtime) {
         sourceExport,
         seedCommit,
         preview,
+        memoryFetch,
+        memory,
+        memorySync,
         summary: {
             create: plannedFiles.filter((file) => file.action === 'create').length,
             overwrite: plannedFiles.filter((file) => file.action === 'overwrite').length,
@@ -7653,6 +8011,8 @@ async function runArtifactsInit(command, io, runtime) {
             `dir: ${root}`,
             `remote: ${command.remoteName}`,
             preview.attempted && preview.job?.jobId ? `preview_job: ${preview.job.jobId}` : null,
+            memorySync ? `memory_sync: ${memorySync.status}` : null,
+            memorySync?.status === 'failed' ? `next: tender memory flush --dir ${command.dir}` : null,
             `next: ${result.next}`,
         ]
             .filter((line) => Boolean(line))
@@ -7695,6 +8055,26 @@ async function postLifecycle(input) {
             io: input.io,
             json: input.command.json,
         });
+        await appendAutomaticMemory({
+            repoPath: process.cwd(),
+            artifactId: input.command.artifactId,
+            kind: input.operation === 'publish' ? 'change' : 'validation',
+            summary: `${input.command.command} streamed`,
+            body: `Operation: ${input.operation}\nStatus: streamed`,
+            tags: [input.operation, 'stream'],
+            status: 'resolved',
+            related: {
+                commands: [input.command.command],
+                ...('commitSha' in input.command && input.command.commitSha ? { releaseId: input.command.commitSha } : {}),
+            },
+            runtime: input.runtime,
+        });
+        if (input.operation === 'publish') {
+            const memorySync = await flushAutomaticMemory({ repoPath: process.cwd(), remoteName: 'tender', runtime: input.runtime });
+            if (memorySync.status === 'failed') {
+                input.io.stderr(`Memory notes sync ${memorySync.status}. Next: tender memory flush --dir .`);
+            }
+        }
         return 0;
     }
     const payload = await parseJsonResponse(response);
@@ -7713,11 +8093,46 @@ async function postLifecycle(input) {
         job: payload.job ?? null,
         result: payload.result ?? null,
     };
+    const repoPath = process.cwd();
+    const changedFiles = await readLocalChangedFiles({ runtime: input.runtime, repoPath });
+    const releaseGitRef = input.operation === 'publish' ? readReleaseGitRefFromResult(result.result) : null;
+    const memory = await appendAutomaticMemory({
+        repoPath,
+        artifactId: input.command.artifactId,
+        kind: input.operation === 'validate' ? 'validation' : input.operation === 'publish' ? 'change' : 'validation',
+        summary: `${input.command.command} completed`,
+        body: `Operation: ${result.operation}\nStatus: completed`,
+        tags: [input.operation],
+        status: 'resolved',
+        related: {
+            files: changedFiles,
+            commands: [input.command.command],
+            ...(input.operation === 'preview' ? { previewUrl: readPreviewUrlFromJob(result.job) ?? undefined } : {}),
+            ...(input.operation === 'publish' ? { publishedUrl: readObjectString(readObject(result.result), 'publishedUrl') ?? undefined } : {}),
+            ...(releaseGitRef?.tagName ? { releaseId: releaseGitRef.tagName } : {}),
+        },
+        runtime: input.runtime,
+    });
+    const memorySync = input.operation === 'publish'
+        ? await flushAutomaticMemory({ repoPath, remoteName: 'tender', runtime: input.runtime })
+        : null;
+    const resultWithMemory = {
+        ...result,
+        memory,
+        ...(memorySync ? { memorySync } : {}),
+    };
     if (input.command.json) {
-        input.io.stdout(JSON.stringify(result, null, 2));
+        input.io.stdout(JSON.stringify(resultWithMemory, null, 2));
     }
     else {
-        input.io.stdout([`app_id: ${input.command.artifactId}`, `operation: ${result.operation}`, 'status: completed'].join('\n'));
+        input.io.stdout([
+            `app_id: ${input.command.artifactId}`,
+            `operation: ${result.operation}`,
+            'status: completed',
+            ...(input.operation === 'publish' ? formatPublishResultLines(result.result) : []),
+            memorySync ? `memory_sync: ${memorySync.status}` : null,
+            memorySync?.status === 'failed' ? `next: tender memory flush --dir .` : null,
+        ].join('\n'));
     }
     return 0;
 }
@@ -8298,6 +8713,283 @@ async function runGitRemote(command, io, runtime) {
     }
     return 0;
 }
+function commandRunnerForMemory(runtime) {
+    return runtime.commandRunner ?? defaultCommandRunner;
+}
+function memoryRecoveryForArtifact(artifactId, dir) {
+    return artifactId ? `tender app git setup ${artifactId} --dir ${dir}` : 'tender app git setup <app-id> --dir .';
+}
+function formatMemoryAppendResult(result) {
+    return {
+        entry: result.entry,
+        warnings: result.warnings,
+        noteBytes: result.noteBytes,
+        ref: ARTIFACT_MEMORY_NOTES_REF,
+    };
+}
+async function appendCliMemoryEntry(input) {
+    const repoPath = path.resolve(input.command.dir);
+    try {
+        return await appendArtifactMemoryNote({
+            repoPath,
+            artifactId: input.command.artifactId,
+            kind: input.kind,
+            summary: input.summary,
+            body: input.body,
+            tags: input.tags,
+            status: input.status,
+            severity: input.severity,
+            source: {
+                actor: 'agent',
+                command: input.command.command,
+            },
+            runner: commandRunnerForMemory(input.runtime),
+            now: input.runtime.now,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes('\nNext:')) {
+            throw error;
+        }
+        throw new Error(`${message}\nNext: ${memoryRecoveryForArtifact(input.command.artifactId, input.command.dir)}`);
+    }
+}
+async function runMemoryStart(command, io, runtime) {
+    const appended = await appendCliMemoryEntry({
+        command,
+        kind: 'intent',
+        summary: command.summary,
+        body: command.body,
+        tags: ['session'],
+        runtime,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        ...formatMemoryAppendResult(appended),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([`memory: ${appended.entry.kind}`, `summary: ${appended.entry.summary}`, `session: ${appended.entry.sessionId}`].join('\n'));
+    }
+    return 0;
+}
+async function runMemoryAdd(command, io, runtime) {
+    const appended = await appendCliMemoryEntry({
+        command,
+        kind: command.kind,
+        summary: command.summary,
+        body: command.body,
+        tags: command.tags,
+        runtime,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        ...formatMemoryAppendResult(appended),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([`memory: ${appended.entry.kind}`, `summary: ${appended.entry.summary}`].join('\n'));
+    }
+    return 0;
+}
+async function inferHandoffFromRecentEntries(input) {
+    const entries = await readArtifactMemoryEntries({
+        repoPath: input.repoPath,
+        commitSha: input.commitSha,
+        runner: commandRunnerForMemory(input.runtime),
+    }).catch(() => []);
+    const relevant = [...entries].reverse().find((entry) => entry.kind === 'failure' || entry.kind === 'open_question');
+    return relevant?.summary ?? null;
+}
+async function runMemoryHandoff(command, io, runtime) {
+    const repoPath = path.resolve(command.dir);
+    const head = await readArtifactMemoryHead({
+        repoPath,
+        runner: commandRunnerForMemory(runtime),
+    }).catch(() => null);
+    const inferredReason = command.reason ?? (await inferHandoffFromRecentEntries({ repoPath, runtime, commitSha: head }));
+    if (!inferredReason && !command.summary) {
+        throw new TenderCliUsageError('memory handoff needs --reason or a recent failure/open_question entry to infer from.\nNext: tender memory handoff --reason "Need Tender support because ..." --summary "Current blocker and what was tried"');
+    }
+    const summary = command.summary ?? inferredReason ?? 'Tender support handoff';
+    const body = [
+        inferredReason ? `Reason: ${inferredReason}` : null,
+        command.body,
+        'Include goal, current failure, commands tried, changed files, suspected causes, and what not to retry.',
+    ]
+        .filter((line) => Boolean(line && line.trim()))
+        .join('\n');
+    const appended = await appendCliMemoryEntry({
+        command,
+        kind: 'support_handoff',
+        summary,
+        body,
+        tags: ['support', 'handoff'],
+        status: 'open',
+        severity: 'warning',
+        runtime,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        reason: inferredReason,
+        ...formatMemoryAppendResult(appended),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([`memory: support_handoff`, `summary: ${appended.entry.summary}`, `next: tender memory flush --dir ${command.dir}`].join('\n'));
+    }
+    return 0;
+}
+async function runMemoryShow(command, io, runtime) {
+    const repoPath = path.resolve(command.dir);
+    const entries = await readArtifactMemoryEntries({
+        repoPath,
+        commitSha: command.commitSha,
+        runner: commandRunnerForMemory(runtime),
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        ref: ARTIFACT_MEMORY_NOTES_REF,
+        commitSha: command.commitSha ?? (await readArtifactMemoryHead({ repoPath, runner: commandRunnerForMemory(runtime) })),
+        entries,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout(entries.length > 0 ? entries.map(formatArtifactMemoryEntry).join('\n') : 'No artifact memory entries found for this commit.');
+    }
+    return 0;
+}
+async function runMemoryBrief(command, io, runtime) {
+    const repoPath = path.resolve(command.dir);
+    const entries = await readArtifactMemoryEntries({
+        repoPath,
+        runner: commandRunnerForMemory(runtime),
+    });
+    const latestSummary = [...entries].reverse().find((entry) => entry.kind === 'summary') ?? null;
+    const unresolved = entries
+        .filter((entry) => entry.status === 'open' || entry.kind === 'failure' || entry.kind === 'open_question' || entry.kind === 'support_handoff')
+        .slice(-command.limit);
+    const briefEntries = latestSummary ? [latestSummary, ...unresolved.filter((entry) => entry.entryId !== latestSummary.entryId)] : unresolved;
+    const result = {
+        ok: true,
+        command: command.command,
+        ref: ARTIFACT_MEMORY_NOTES_REF,
+        entries: briefEntries,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout(briefEntries.length > 0 ? briefEntries.map(formatArtifactMemoryEntry).join('\n') : 'No artifact memory brief is available yet.');
+    }
+    return 0;
+}
+async function runMemoryFlush(command, io, runtime) {
+    const sync = await pushArtifactMemoryNotes({
+        repoPath: path.resolve(command.dir),
+        remoteName: command.remoteName,
+        runner: commandRunnerForMemory(runtime),
+    });
+    const next = sync.status === 'failed'
+        ? `tender memory flush --dir ${command.dir} --remote ${command.remoteName}`
+        : sync.status === 'not_configured'
+            ? memoryRecoveryForArtifact(command.artifactId, command.dir)
+            : null;
+    const result = {
+        ok: sync.status === 'pushed',
+        command: command.command,
+        memorySync: sync,
+        next,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `memory_sync: ${sync.status}`,
+            sync.error ? `error: ${sync.error}` : null,
+            result.next ? `next: ${result.next}` : null,
+        ]
+            .filter((line) => Boolean(line))
+            .join('\n'));
+    }
+    return sync.status === 'pushed' ? 0 : 1;
+}
+async function runMemoryExport(command, io, runtime) {
+    const entries = await readArtifactMemoryEntries({
+        repoPath: path.resolve(command.dir),
+        commitSha: command.commitSha,
+        runner: commandRunnerForMemory(runtime),
+    });
+    if (command.format === 'jsonl') {
+        io.stdout(entries.map((entry) => JSON.stringify(entry)).join('\n'));
+        return 0;
+    }
+    throw new TenderCliUsageError(`Unsupported memory export format: ${command.format}.\nNext: tender memory export --format jsonl --dir ${command.dir}`);
+}
+async function readLocalChangedFiles(input) {
+    const result = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.repoPath,
+        args: ['status', '--porcelain'],
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0) {
+        return [];
+    }
+    return result.stdout
+        .split(/\r?\n/)
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean)
+        .slice(0, 50);
+}
+async function appendAutomaticMemory(input) {
+    try {
+        return await appendArtifactMemoryNote({
+            repoPath: input.repoPath,
+            artifactId: input.artifactId,
+            kind: input.kind,
+            summary: input.summary,
+            body: input.body,
+            tags: input.tags,
+            severity: input.severity,
+            status: input.status,
+            related: input.related,
+            source: {
+                actor: 'cli',
+                command: input.summary,
+            },
+            runner: commandRunnerForMemory(input.runtime),
+            now: input.runtime.now,
+        });
+    }
+    catch (error) {
+        return {
+            error: error instanceof Error ? error.message : String(error),
+            next: `tender memory add --dir ${input.repoPath} --artifact ${input.artifactId} --kind ${input.kind} --summary ${JSON.stringify(input.summary)}`,
+        };
+    }
+}
+async function flushAutomaticMemory(input) {
+    return pushArtifactMemoryNotes({
+        repoPath: input.repoPath,
+        remoteName: input.remoteName,
+        runner: commandRunnerForMemory(input.runtime),
+    });
+}
 async function resolveAnalyticsCredentials(command, runtime) {
     return await resolveApiCredentials({
         baseUrl: command.baseUrl,
@@ -8987,6 +9679,30 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'auth status') {
                 io.stdout(authStatusHelp());
             }
+            else if (command.topic === 'memory') {
+                io.stdout(memoryHelp());
+            }
+            else if (command.topic === 'memory start') {
+                io.stdout(memoryHelp());
+            }
+            else if (command.topic === 'memory add') {
+                io.stdout(memoryAddHelp());
+            }
+            else if (command.topic === 'memory handoff') {
+                io.stdout(memoryHandoffHelp());
+            }
+            else if (command.topic === 'memory show') {
+                io.stdout(memoryHelp());
+            }
+            else if (command.topic === 'memory brief') {
+                io.stdout(memoryHelp());
+            }
+            else if (command.topic === 'memory flush') {
+                io.stdout(memoryHelp());
+            }
+            else if (command.topic === 'memory export') {
+                io.stdout(memoryHelp());
+            }
             else if (command.topic === 'playbooks') {
                 io.stdout(playbooksHelp());
             }
@@ -9169,6 +9885,27 @@ export async function runTenderCli(args, io = {
         if (command.command === 'auth status') {
             return await runAuthStatus(command, io, runtime);
         }
+        if (command.command === 'memory start') {
+            return await runMemoryStart(command, io, runtime);
+        }
+        if (command.command === 'memory add') {
+            return await runMemoryAdd(command, io, runtime);
+        }
+        if (command.command === 'memory handoff') {
+            return await runMemoryHandoff(command, io, runtime);
+        }
+        if (command.command === 'memory show') {
+            return await runMemoryShow(command, io, runtime);
+        }
+        if (command.command === 'memory brief') {
+            return await runMemoryBrief(command, io, runtime);
+        }
+        if (command.command === 'memory flush') {
+            return await runMemoryFlush(command, io, runtime);
+        }
+        if (command.command === 'memory export') {
+            return await runMemoryExport(command, io, runtime);
+        }
         if (command.command === 'playbooks list') {
             return await runPlaybooksList(command, io, runtime);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@tenderprompt/cli",
-	"version": "0.1.20",
+	"version": "0.1.22",
 	"type": "module",
 	"bin": {
 		"tender": "bin/tender.js"