@todoforai/tfa-memory 0.4.1 → 0.4.3

package/dist/cli.js

@@ -6,7 +6,7 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 import { parseArgs } from "node:util";
 import { readFileSync as readFileSync4 } from "node:fs";
 
-// node_modules/@todoforai/tfa-subagent/dist/auth.js
+// ../tfa-subagent/dist/auth.js
 import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir, platform } from "node:os";
@@ -21,10 +21,15 @@ function normalizeApiUrl(url) {
 function credentialsPath() {
   return platform() === "win32" ? join(homedir(), "AppData", "Roaming", "todoforai", "credentials.json") : platform() === "darwin" ? join(homedir(), "Library", "Application Support", "todoforai", "credentials.json") : join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "todoforai", "credentials.json");
 }
-function credentialsPaths() {
-  return [credentialsPath()];
+function read() {
+  try {
+    return JSON.parse(readFileSync(credentialsPath(), "utf-8"));
+  } catch {
+    return {};
+  }
 }
-function writeSecure(p, data) {
+function writeSecure(data) {
+  const p = credentialsPath();
   mkdirSync(dirname(p), { recursive: true });
   writeFileSync(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   try {
@@ -32,31 +37,29 @@ function writeSecure(p, data) {
   } catch {}
 }
 function readStoredAuth(apiUrl) {
-  for (const p of credentialsPaths()) {
-    try {
-      const c = JSON.parse(readFileSync(p, "utf-8"));
-      const apiToken = c[apiUrl] || c.apiToken || c.apiKey || "";
-      const host = c.backendHost || "";
-      const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
-      return {
-        apiToken,
-        apiUrl: storedApiUrl,
-        deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
-        deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
-      };
-    } catch {}
-  }
-  return { apiToken: "" };
+  const c = read();
+  const host = c.backendHost || "";
+  const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
+  const dstIsForThisUrl = !storedApiUrl || normalizeApiUrl(storedApiUrl) === normalizeApiUrl(apiUrl);
+  const isDst = typeof c.apiToken === "string" && c.apiToken.startsWith("dst_");
+  const dst = dstIsForThisUrl && isDst ? c.apiToken : "";
+  const fallbackApiToken = isDst && !dstIsForThisUrl ? "" : c.apiToken;
+  const apiToken = dst || c[apiUrl] || fallbackApiToken || c.apiKey || "";
+  return {
+    apiToken: typeof apiToken === "string" ? apiToken : "",
+    apiUrl: storedApiUrl,
+    deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
+    deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
+  };
 }
 function persistApiToken(token) {
-  for (const p of credentialsPaths()) {
-    try {
-      const c = JSON.parse(readFileSync(p, "utf-8"));
-      c.apiToken = token;
-      writeSecure(p, c);
-      return;
-    } catch {}
-  }
+  const c = read();
+  if (!Object.keys(c).length)
+    return;
+  c.apiToken = token;
+  try {
+    writeSecure(c);
+  } catch {}
 }
 async function refreshDeviceToken(opts = {}) {
   const envUrl = process.env.TODOFORAI_API_URL || process.env.API_URL;
@@ -65,6 +68,8 @@ async function refreshDeviceToken(opts = {}) {
   const apiUrl = normalizeApiUrl(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL);
   if (!stored.deviceId || !stored.deviceSecret)
     return "";
+  if (stored.apiUrl && normalizeApiUrl(stored.apiUrl) !== apiUrl)
+    return "";
   try {
     const res = await fetch(`${apiUrl}/api/v1/cli/device/token`, {
       method: "POST",
@@ -85,9 +90,13 @@ async function refreshDeviceToken(opts = {}) {
 async function fetchWithRenew(url, init, opts) {
   const header = opts.header ?? "x-api-key";
   const renewOn = opts.renewOn ?? [401];
-  const send = (token) => fetch(url, { ...init, headers: { ...init.headers, [header]: token } });
-  let res = await send(opts.token);
-  if (renewOn.includes(res.status) && opts.token.startsWith("dst_")) {
+  const send = (token) => {
+    const headers = new Headers(init.headers);
+    headers.set(header, token);
+    return fetch(url, { ...init, headers });
+  };
+  const res = await send(opts.token);
+  if (renewOn.includes(res.status)) {
     const fresh = await refreshDeviceToken({ apiUrl: opts.apiUrl });
     if (fresh && fresh !== opts.token)
       return { res: await send(fresh), token: fresh };
@@ -99,13 +108,14 @@ function resolveToken(opts = {}) {
   const initialApiUrl = normalizeApiUrl(opts.apiUrl || envUrl || DEFAULT_API_URL);
   const stored = readStoredAuth(initialApiUrl);
   const apiUrl = normalizeApiUrl(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL);
-  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || stored.apiToken || "";
+  const finalStored = apiUrl === initialApiUrl ? stored : readStoredAuth(apiUrl);
+  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || finalStored.apiToken || "";
   if (!apiToken)
     throw new Error("TODOFORAI_API_TOKEN not set and no apiToken found in ~/.config/todoforai/credentials.json (run `<cli> login` or `todoforai-bridge login`, or pass --api-token)");
   return { apiUrl, apiToken };
 }
 
-// node_modules/@todoforai/tfa-subagent/dist/login.js
+// ../tfa-subagent/dist/login.js
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
 import { join as join2, dirname as dirname2 } from "node:path";
 import { homedir as homedir2, platform as platform2 } from "node:os";
@@ -122,10 +132,15 @@ function normalizeApiUrl2(url) {
 function credentialsPath2() {
   return platform2() === "win32" ? join2(homedir2(), "AppData", "Roaming", "todoforai", "credentials.json") : platform2() === "darwin" ? join2(homedir2(), "Library", "Application Support", "todoforai", "credentials.json") : join2(process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config"), "todoforai", "credentials.json");
 }
-function credentialsPaths2() {
-  return [credentialsPath2()];
+function read2() {
+  try {
+    return JSON.parse(readFileSync2(credentialsPath2(), "utf-8"));
+  } catch {
+    return {};
+  }
 }
-function writeSecure2(p, data) {
+function writeSecure2(data) {
+  const p = credentialsPath2();
   mkdirSync2(dirname2(p), { recursive: true });
   writeFileSync2(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   try {
@@ -133,39 +148,32 @@ function writeSecure2(p, data) {
   } catch {}
 }
 function writeCredentials(fields) {
-  const p = credentialsPath2();
-  let existing = {};
-  try {
-    existing = JSON.parse(readFileSync2(p, "utf-8"));
-  } catch {}
-  writeSecure2(p, { ...existing, ...fields });
+  writeSecure2({ ...read2(), ...fields });
 }
 function readStoredAuth2(apiUrl) {
-  for (const p of credentialsPaths2()) {
-    try {
-      const c = JSON.parse(readFileSync2(p, "utf-8"));
-      const apiToken = c[apiUrl] || c.apiToken || c.apiKey || "";
-      const host = c.backendHost || "";
-      const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
-      return {
-        apiToken,
-        apiUrl: storedApiUrl,
-        deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
-        deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
-      };
-    } catch {}
-  }
-  return { apiToken: "" };
+  const c = read2();
+  const host = c.backendHost || "";
+  const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
+  const dstIsForThisUrl = !storedApiUrl || normalizeApiUrl2(storedApiUrl) === normalizeApiUrl2(apiUrl);
+  const isDst = typeof c.apiToken === "string" && c.apiToken.startsWith("dst_");
+  const dst = dstIsForThisUrl && isDst ? c.apiToken : "";
+  const fallbackApiToken = isDst && !dstIsForThisUrl ? "" : c.apiToken;
+  const apiToken = dst || c[apiUrl] || fallbackApiToken || c.apiKey || "";
+  return {
+    apiToken: typeof apiToken === "string" ? apiToken : "",
+    apiUrl: storedApiUrl,
+    deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
+    deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
+  };
 }
 function persistApiToken2(token) {
-  for (const p of credentialsPaths2()) {
-    try {
-      const c = JSON.parse(readFileSync2(p, "utf-8"));
-      c.apiToken = token;
-      writeSecure2(p, c);
-      return;
-    } catch {}
-  }
+  const c = read2();
+  if (!Object.keys(c).length)
+    return;
+  c.apiToken = token;
+  try {
+    writeSecure2(c);
+  } catch {}
 }
 async function refreshDeviceToken2(opts = {}) {
   const envUrl = process.env.TODOFORAI_API_URL || process.env.API_URL;
@@ -174,6 +182,8 @@ async function refreshDeviceToken2(opts = {}) {
   const apiUrl = normalizeApiUrl2(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL2);
   if (!stored.deviceId || !stored.deviceSecret)
     return "";
+  if (stored.apiUrl && normalizeApiUrl2(stored.apiUrl) !== apiUrl)
+    return "";
   try {
     const res = await fetch(`${apiUrl}/api/v1/cli/device/token`, {
       method: "POST",
@@ -287,7 +297,7 @@ async function handleLogin(argv, binName) {
   process.exit(await login({ binName, deviceName: get("--device-name"), apiUrl: get("--api-url") }));
 }
 
-// node_modules/@todoforai/tfa-subagent/dist/whoami.js
+// ../tfa-subagent/dist/whoami.js
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, chmodSync as chmodSync3 } from "node:fs";
 import { join as join3, dirname as dirname3 } from "node:path";
 import { homedir as homedir3, platform as platform3 } from "node:os";
@@ -302,10 +312,15 @@ function normalizeApiUrl3(url) {
 function credentialsPath3() {
   return platform3() === "win32" ? join3(homedir3(), "AppData", "Roaming", "todoforai", "credentials.json") : platform3() === "darwin" ? join3(homedir3(), "Library", "Application Support", "todoforai", "credentials.json") : join3(process.env.XDG_CONFIG_HOME || join3(homedir3(), ".config"), "todoforai", "credentials.json");
 }
-function credentialsPaths3() {
-  return [credentialsPath3()];
+function read3() {
+  try {
+    return JSON.parse(readFileSync3(credentialsPath3(), "utf-8"));
+  } catch {
+    return {};
+  }
 }
-function writeSecure3(p, data) {
+function writeSecure3(data) {
+  const p = credentialsPath3();
   mkdirSync3(dirname3(p), { recursive: true });
   writeFileSync3(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   try {
@@ -313,31 +328,29 @@ function writeSecure3(p, data) {
   } catch {}
 }
 function readStoredAuth3(apiUrl) {
-  for (const p of credentialsPaths3()) {
-    try {
-      const c = JSON.parse(readFileSync3(p, "utf-8"));
-      const apiToken = c[apiUrl] || c.apiToken || c.apiKey || "";
-      const host = c.backendHost || "";
-      const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
-      return {
-        apiToken,
-        apiUrl: storedApiUrl,
-        deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
-        deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
-      };
-    } catch {}
-  }
-  return { apiToken: "" };
+  const c = read3();
+  const host = c.backendHost || "";
+  const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
+  const dstIsForThisUrl = !storedApiUrl || normalizeApiUrl3(storedApiUrl) === normalizeApiUrl3(apiUrl);
+  const isDst = typeof c.apiToken === "string" && c.apiToken.startsWith("dst_");
+  const dst = dstIsForThisUrl && isDst ? c.apiToken : "";
+  const fallbackApiToken = isDst && !dstIsForThisUrl ? "" : c.apiToken;
+  const apiToken = dst || c[apiUrl] || fallbackApiToken || c.apiKey || "";
+  return {
+    apiToken: typeof apiToken === "string" ? apiToken : "",
+    apiUrl: storedApiUrl,
+    deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
+    deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
+  };
 }
 function persistApiToken3(token) {
-  for (const p of credentialsPaths3()) {
-    try {
-      const c = JSON.parse(readFileSync3(p, "utf-8"));
-      c.apiToken = token;
-      writeSecure3(p, c);
-      return;
-    } catch {}
-  }
+  const c = read3();
+  if (!Object.keys(c).length)
+    return;
+  c.apiToken = token;
+  try {
+    writeSecure3(c);
+  } catch {}
 }
 async function refreshDeviceToken3(opts = {}) {
   const envUrl = process.env.TODOFORAI_API_URL || process.env.API_URL;
@@ -346,6 +359,8 @@ async function refreshDeviceToken3(opts = {}) {
   const apiUrl = normalizeApiUrl3(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL3);
   if (!stored.deviceId || !stored.deviceSecret)
     return "";
+  if (stored.apiUrl && normalizeApiUrl3(stored.apiUrl) !== apiUrl)
+    return "";
   try {
     const res = await fetch(`${apiUrl}/api/v1/cli/device/token`, {
       method: "POST",
@@ -366,9 +381,13 @@ async function refreshDeviceToken3(opts = {}) {
 async function fetchWithRenew2(url, init, opts) {
   const header = opts.header ?? "x-api-key";
   const renewOn = opts.renewOn ?? [401];
-  const send = (token) => fetch(url, { ...init, headers: { ...init.headers, [header]: token } });
-  let res = await send(opts.token);
-  if (renewOn.includes(res.status) && opts.token.startsWith("dst_")) {
+  const send = (token) => {
+    const headers = new Headers(init.headers);
+    headers.set(header, token);
+    return fetch(url, { ...init, headers });
+  };
+  const res = await send(opts.token);
+  if (renewOn.includes(res.status)) {
     const fresh = await refreshDeviceToken3({ apiUrl: opts.apiUrl });
     if (fresh && fresh !== opts.token)
       return { res: await send(fresh), token: fresh };
@@ -380,7 +399,8 @@ function resolveToken2(opts = {}) {
   const initialApiUrl = normalizeApiUrl3(opts.apiUrl || envUrl || DEFAULT_API_URL3);
   const stored = readStoredAuth3(initialApiUrl);
   const apiUrl = normalizeApiUrl3(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL3);
-  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || stored.apiToken || "";
+  const finalStored = apiUrl === initialApiUrl ? stored : readStoredAuth3(apiUrl);
+  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || finalStored.apiToken || "";
   if (!apiToken)
     throw new Error("TODOFORAI_API_TOKEN not set and no apiToken found in ~/.config/todoforai/credentials.json (run `<cli> login` or `todoforai-bridge login`, or pass --api-token)");
   return { apiUrl, apiToken };
@@ -409,19 +429,46 @@ async function whoami(opts) {
   }
 }
 
-// node_modules/@todoforai/tfa-subagent/dist/update-notifier.js
+// ../tfa-subagent/dist/update-notifier.js
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-function isLinkedInstall() {
+function installer() {
+  let real;
   try {
-    return !fs.realpathSync(process.argv[1] || "").includes(`${path.sep}node_modules${path.sep}`);
+    real = fs.realpathSync(process.argv[1] || "");
   } catch {
-    return false;
+    return null;
   }
+  if (!real.includes(`${path.sep}node_modules${path.sep}`))
+    return null;
+  return real.includes(path.join(".bun", "install", "global")) ? "bun" : "npm";
 }
 var TTL_MS = 24 * 60 * 60 * 1000;
 var CACHE_DIR = path.join(os.homedir(), ".config", "todoforai");
+var cacheFileFor = (name) => path.join(CACHE_DIR, `notifier-${encodeURIComponent(name)}.json`);
+function readCache(name) {
+  try {
+    return JSON.parse(fs.readFileSync(cacheFileFor(name), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeCache(name, cache) {
+  try {
+    fs.mkdirSync(CACHE_DIR, { recursive: true });
+    fs.writeFileSync(cacheFileFor(name), JSON.stringify(cache));
+  } catch {}
+}
+function refreshCache(name, cache) {
+  if (Date.now() - (cache.ts ?? 0) <= TTL_MS)
+    return;
+  writeCache(name, { ...cache, ts: Date.now() });
+  fetch(`https://registry.npmjs.org/${name}/latest`, { signal: AbortSignal.timeout(3000) }).then((r) => r.ok ? r.json() : null).then((j) => {
+    if (j?.version)
+      writeCache(name, { ...cache, ts: Date.now(), latest: j.version });
+  }).catch(() => {});
+}
 function cmpVer(a, b) {
   const pa = a.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
   const pb = b.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
@@ -433,13 +480,11 @@ function cmpVer(a, b) {
   return 0;
 }
 function checkForUpdates(pkg) {
-  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER || isLinkedInstall())
+  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER || !installer())
     return;
-  const cacheFile = path.join(CACHE_DIR, `notifier-${encodeURIComponent(pkg.name)}.json`);
-  let cache = {};
-  try {
-    cache = JSON.parse(fs.readFileSync(cacheFile, "utf8"));
-  } catch {}
+  if (process.argv.includes("--json"))
+    return;
+  const cache = readCache(pkg.name);
   if (cache.latest && cmpVer(cache.latest, pkg.version) > 0) {
     process.stderr.write(`
 \x1B[33m  Update available: \x1B[2m${pkg.version}\x1B[22m → \x1B[1m${cache.latest}\x1B[0m
@@ -447,23 +492,13 @@ function checkForUpdates(pkg) {
 
 `);
   }
-  if (Date.now() - (cache.ts ?? 0) > TTL_MS) {
-    try {
-      fs.mkdirSync(CACHE_DIR, { recursive: true });
-      fs.writeFileSync(cacheFile, JSON.stringify({ ...cache, ts: Date.now() }));
-    } catch {}
-    fetch(`https://registry.npmjs.org/${pkg.name}/latest`, { signal: AbortSignal.timeout(3000) }).then((r) => r.ok ? r.json() : null).then((j) => {
-      if (!j?.version)
-        return;
-      fs.writeFileSync(cacheFile, JSON.stringify({ ts: Date.now(), latest: j.version }));
-    }).catch(() => {});
-  }
+  refreshCache(pkg.name, cache);
 }
 // package.json
 var package_default = {
   name: "@todoforai/tfa-memory",
-  version: "0.4.1",
-  description: "Zero-config TODOforAI memory CLI — add/search/ls/get/rm text memory rows addressed as source/ref, plus federated search over every message of every past TODO (read-only `todo` source), with full-text and semantic search. Reuses bridge credentials.",
+  version: "0.4.3",
+  description: "Zero-config TODOforAI memory CLI — add/search/ls/get/rm/live text memory rows addressed as source/ref, plus federated search over every message of every past TODO (read-only `todo` source), with full-text and semantic search, plus L2 working-memory re-render. Reuses bridge credentials.",
   type: "module",
   bin: {
     "tfa-memory": "dist/cli.js"
@@ -504,6 +539,10 @@ every TODO under the read-only \`todo\` source (\`todo/<todoId>:<messageId>\`,
 live from the backend index, nothing separate to sync). \`--source todo\` searches
 past TODO messages only; \`get todo/<todoId>:<messageId>\` prints the whole message.
 
+Owner-private TODOs are searchable in personal contexts. In agent shells,
+TODOFORAI_TODO_ID supplies the destination; shared conversations cannot read
+private TODOs or account-private saved notes. --todo selects a source, not an audience.
+
 Usage:
   tfa-memory <command> [options] [args...]
 
@@ -511,8 +550,10 @@ Commands:
   add [source/ref] <text|->     Save a row. Without an address → manual/<timestamp>.
                                 "-" reads stdin.
   search <query>                Full-text search over saved rows + past TODO messages
+  live                          Re-render L2 working memory (the always-on prompt block)
   ls                            List saved rows, newest first (todo messages excluded)
   get <source/ref>              Print full content of one row
+  around <source/ref>           Neighbours of one row: todo messages in chat order, saved rows by time within the source
   rm <source/ref>               Delete one row
   rm --source <name>            Delete every row in a source
   sources                       List sources with counts and last write
@@ -522,7 +563,11 @@ Commands:
 Options:
   -s, --source <a,b>            Restrict search/ls to sources (comma-separated; "todo" = TODO messages)
       --todo <id>               Restrict a todo-message search to one TODO
-      --semantic                Embedding KNN search (meaning, not keywords)
+  -B, --budget <n>              Token budget for \`live\` (default 1500, 100–20000)
+      --mode lexical|semantic|fused  lexical: all words, newest first (default) · semantic: meaning · fused: best recall
+      --exclude <address>       Leave out an already-read row (repeatable); fused also prints the lexical match count
+      --before <n>              around: rows before the pivot (default 2, max 200)
+      --after <n>               around: rows after the pivot (default 2, max 200); large = read the rest
       --meta <json>             Attach JSON metadata to the row (e.g. '{"todoId":"..."}')
   -n, --limit <n>               Max rows (default 5, max 50)
   -j, --json                    Machine-readable output
@@ -537,8 +582,10 @@ Examples:
   tfa-memory add deploy-notes/rollback "run scripts/rollback.sh, then verify /health"
   cat docs/auth.md | tfa-memory add acme/docs/auth.md -
   tfa-memory search "rollback procedure"
-  tfa-memory search "how do we deploy" --semantic
+  tfa-memory search "how do we deploy" --mode semantic
   tfa-memory search "android build" --source todo
+  tfa-memory live
+  tfa-memory live -B 800
   tfa-memory get todo/<todoId>:<messageId>
   tfa-memory ls --source deploy-notes
   tfa-memory get deploy-notes/rollback
@@ -574,7 +621,10 @@ function resolveMemoryUrl(flag, apiUrl) {
 async function api(ctx, method, path2, body) {
   const init = {
     method,
-    headers: body !== undefined ? { "content-type": "application/json" } : {},
+    headers: {
+      ...body !== undefined && { "content-type": "application/json" },
+      ...process.env.TODOFORAI_TODO_ID && { "x-tfa-todo-id": process.env.TODOFORAI_TODO_ID }
+    },
     body: body !== undefined ? JSON.stringify(body) : undefined
   };
   const { res, token } = await fetchWithRenew(`${ctx.memoryUrl}/v1${path2}`, init, { apiUrl: ctx.apiUrl, token: ctx.token, renewOn: [401, 403] });
@@ -614,8 +664,12 @@ async function main() {
     options: {
       source: { type: "string", short: "s" },
       todo: { type: "string" },
+      budget: { type: "string", short: "B" },
       meta: { type: "string" },
-      semantic: { type: "boolean", default: false },
+      mode: { type: "string" },
+      exclude: { type: "string", multiple: true },
+      before: { type: "string" },
+      after: { type: "string" },
       limit: { type: "string", short: "n" },
       json: { type: "boolean", short: "j", default: false },
       "api-token": { type: "string" },
@@ -687,17 +741,35 @@ async function main() {
           die(`--meta must be a JSON object`, 2);
       }
       const res = await api(ctx, "POST", "/memory", { source, ref, content: text, meta });
+      for (const w of res.warnings ?? [])
+        console.error(`Warning: ${w}`);
       console.log(json ? JSON.stringify(res) : `${res.status} ${res.address}`);
       break;
     }
     case "search": {
       const query = rest[0] ?? die(`usage: tfa-memory search "query"`, 2);
-      const res = await api(ctx, "GET", `/memory/search${qs({ query, semantic: values.semantic ? true : undefined, sources, limit, todoId: values.todo })}`);
+      const exclude = values.exclude?.join(",");
+      const res = await api(ctx, "GET", `/memory/search${qs({ query, mode: values.mode, sources, limit, todoId: values.todo, exclude })}`);
       for (const w of res.warnings ?? [])
         console.error(`Warning: ${w}`);
+      if (res.lexicalCount !== undefined)
+        console.error(`${res.lexicalCount} row(s) contain a query word`);
       printRows(res.rows, json);
       break;
     }
+    case "live": {
+      const budget = values.budget !== undefined ? Number(values.budget) : 1500;
+      if (!Number.isInteger(budget) || budget < 100 || budget > 20000)
+        die(`--budget must be an integer from 100 to 20000`, 2);
+      const res = await api(ctx, "GET", `/live/render${qs({ budget })}`);
+      const block = res.block ?? "";
+      if (json)
+        console.log(JSON.stringify({ block }));
+      else
+        process.stdout.write((block || "(empty live memory)") + `
+`);
+      break;
+    }
     case "ls": {
       const res = await api(ctx, "GET", `/memory${qs({ sources, limit })}`);
       printRows(res.rows, json);
@@ -713,6 +785,14 @@ async function main() {
 `);
       break;
     }
+    case "around": {
+      const [source, ref] = splitAddr(rest[0] ?? die("address required (source/ref)", 2));
+      const res = await api(ctx, "GET", `/memory/around${qs({ source, ref, before: values.before, after: values.after })}`);
+      if (res.total !== undefined)
+        console.error(`message ${res.index + 1} of ${res.total}`);
+      printRows(res.rows, json, 2000);
+      break;
+    }
     case "rm":
     case "delete":
     case "del": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@todoforai/tfa-memory",
-  "version": "0.4.1",
-  "description": "Zero-config TODOforAI memory CLI — add/search/ls/get/rm text memory rows addressed as source/ref, plus federated search over every message of every past TODO (read-only `todo` source), with full-text and semantic search. Reuses bridge credentials.",
+  "version": "0.4.3",
+  "description": "Zero-config TODOforAI memory CLI — add/search/ls/get/rm/live text memory rows addressed as source/ref, plus federated search over every message of every past TODO (read-only `todo` source), with full-text and semantic search, plus L2 working-memory re-render. Reuses bridge credentials.",
   "type": "module",
   "bin": {
     "tfa-memory": "dist/cli.js"