@vib795/agent-memory 0.1.15 → 0.3.0

package/README.md

@@ -94,6 +94,74 @@ recursive CTE *is* the graph engine, and `UNION` plus a depth bound is what keep
 - **Constraints are never dropped.** At any cap, in either tier. A constraint is what
   stops an agent burning a retry loop on an approach that was never going to ship.
 
+## Carrying knowledge between machines
+
+Client work usually lives in its own environment, and when the engagement ends the
+environment goes with it. What should survive is the part that was never the
+client's — the constraints your org imposes, the conventions you follow, what you
+have learned about working under them. What must not survive is their architecture.
+
+```bash
+agent-memory export --out carry.json     # global scope only, by default
+agent-memory import carry.json --dry-run # see what would land
+agent-memory import carry.json
+```
+
+**The default is the safe one.** `export` emits `scope: global` notes and nothing
+else, so a note tied to a client repository cannot leave by forgetting a flag.
+Taking one is possible — `--scope all` — but it takes saying so.
+
+Two things are deliberately dropped on the way through:
+
+- **`captured_sha` is not carried.** It names a commit that exists in one repository
+  on one machine. Carried across, it would either read as current forever or claim
+  the history was rewritten; a staleness signal you cannot check is worse than none.
+- **`source` becomes `import`.** How a note was originally captured describes an
+  environment that no longer exists. Here the honest answer to where it came from is
+  that someone brought it in, and an audit should be able to tell which notes those
+  are.
+
+Importing the same file twice updates rather than duplicates, so re-running after a
+change is safe.
+
+## Engagements
+
+If you work for more than one client on one machine, knowledge from one of them is
+not the next one's to see. An engagement is a **separate store**, and switching is a
+path change rather than a filter:
+
+```bash
+agent-memory engagement                    # which one is active, and why
+agent-memory engagement list               # all of them, with note counts
+agent-memory engagement use acme           # the fallback for every window
+agent-memory engagement purge acme --yes   # delete that client's store entirely
+```
+
+Pin a client's whole tree instead of remembering to switch. One file at the top of
+it, and every repository beneath is in that engagement:
+
+```bash
+echo acme > ~/clients/acme/.agent-memory-engagement
+```
+
+Resolution order is `AGENT_MEMORY_ENGAGEMENT`, then the nearest marker file walking
+up from where you are, then the machine-wide pointer, then `default`. `doctor` and
+`engagement` both print which one decided it, because the failure worth preventing is
+believing you are in one client's store while writing to another.
+
+**The isolation is structural, not a filter.** Each engagement is its own directory,
+its own markdown and its own index, so `search`, `get` and `tree` cannot reach across
+even by exact id — there is no query to forget. Filtering would have to be remembered
+at fourteen separate read paths, and two of them were already missed before this
+existed.
+
+That also makes removal something you can evidence rather than assert: `purge` deletes
+a directory and reports the count, and refuses without `--yes` after telling you
+exactly what would go.
+
+Everything already captured stays in `default`, at the same path as before. Nothing
+migrates and nothing changes until you create a second engagement.
+
 ## CLI
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vib795/agent-memory",
-  "version": "0.1.15",
+  "version": "0.3.0",
   "description": "Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.",
   "keywords": [
     "github-copilot",

package/src/cli.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync, rmSync, readdirSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { loadConfig, saveConfig, paths, NOTE_TYPES } from './config.js';
+import {
+  loadConfig, saveConfig, paths, NOTE_TYPES, ENGAGEMENT, ENGAGEMENT_RE, ENGAGEMENT_POINTER,
+  ENGAGEMENT_MARKER, DEFAULT_ENGAGEMENT, STORE_BASE, engagementRoot,
+} from './config.js';
 import { ensureStore, writeNote, normalizeTitle, listNotes } from './store.js';
 import {
   openDb, reindex, searchNodes, getNodeRow, markAccessed, nodeCount, hasFts,
@@ -13,6 +16,7 @@ import { staleness, currentRepo, reviewCandidates, captureGap } from './stalenes
 import { setup as runSetup, unlinkSkills, danglingSkillLinks, SKILLS } from './setup.js';
 import { detectTargets, installableTargets } from './targets.js';
 import { join } from 'node:path';
+import { atomicWrite } from './atomic.js';
 
 /**
  * One process, one answer.
@@ -82,8 +86,14 @@ const USAGE = `agent-memory — durable cross-repo knowledge for coding agents
         [--source <name>] [--repo <name>]
   compact                                dedup, decay, reindex, regenerate
   doctor                                 preflight and health report
+  export [--scope global|repo|all]       knowledge worth carrying to another machine
+         [--out <file>]                  defaults to global scope only
+  import <file> [--dry-run]              bring an export in, provenance intact
+  engagement [show|list|use <name>]      which client store this window writes to
+             [purge <name> --yes]        delete one engagement's store entirely
 
 Add --json to any command for machine-readable output.
+Engagement: ${ENGAGEMENT.name} (${ENGAGEMENT.source})
 Store: ${paths.root}`;
 
 // --- commands ---------------------------------------------------------------
@@ -422,6 +432,10 @@ function cmdDoctor() {
   const checks = [];
   const add = (name, ok, detail) => checks.push({ name, ok, detail });
 
+  // First, because everything below it is a fact about one engagement's store and
+  // reading it against the wrong client is the mistake this is here to prevent.
+  add('engagement', true, `${ENGAGEMENT.name} (${ENGAGEMENT.source})`);
+
   add('node version', nodeVersionOk(), `${process.versions.node} (need >= ${MIN_NODE.join('.')})`);
   if (!nodeVersionOk()) {
     return {
@@ -550,6 +564,299 @@ function cmdDoctor() {
 
 // --- dispatch ---------------------------------------------------------------
 
+const EXPORT_SCOPES = ['global', 'repo', 'all'];
+
+/**
+ * Take the knowledge that is yours to take.
+ *
+ * Client work tends to live in its own environment, and when the engagement ends the
+ * environment goes with it. What should survive is what was never the client's: your
+ * conventions, the constraints an org imposes, the way you have learned to work.
+ * What must not survive is their architecture.
+ *
+ * So this defaults to global scope and nothing else. Exporting a client's notes is
+ * possible, because sometimes it is legitimately yours to move, but it takes saying
+ * so out loud rather than forgetting a flag.
+ *
+ * `captured_sha` is deliberately dropped. It names a commit that does not exist
+ * anywhere else, and a staleness signal that cannot be checked is worse than none:
+ * it would either read as current forever or claim the history was rewritten.
+ */
+function cmdExport(opts) {
+  const scope = opts.scope === true ? 'global' : (opts.scope ?? 'global');
+  if (!EXPORT_SCOPES.includes(scope)) {
+    return {
+      ok: false,
+      error: `scope must be one of ${EXPORT_SCOPES.join('|')}`,
+      text: `--scope must be one of ${EXPORT_SCOPES.join(', ')}. Default is global.`,
+    };
+  }
+
+  const all = listNotes().filter((n) => !n.__error && n.id);
+  const active = opts['include-archived'] ? all : all.filter((n) => !n.archived);
+  const picked = active.filter((n) => {
+    const s = n.scope || (n.repos?.length ? 'repo' : 'global');
+    return scope === 'all' || s === scope;
+  });
+
+  const nodes = picked.map((n) => ({
+    id: n.id,
+    type: n.type,
+    title: n.title,
+    body: n.body,
+    scope: n.scope || (n.repos?.length ? 'repo' : 'global'),
+    repos: n.repos ?? [],
+    confidence: n.confidence ?? 'observed',
+    supersedes: n.supersedes ?? null,
+    edges: n.edges ?? [],
+    source: n.source ?? 'manual',
+  }));
+
+  const payload = `${JSON.stringify({ nodes }, null, 2)}\n`;
+  if (typeof opts.out === 'string') {
+    atomicWrite(opts.out, payload);
+    return {
+      ok: true,
+      exported: nodes.length,
+      scope,
+      out: opts.out,
+      text: `Exported ${nodes.length} ${scope}-scope note${nodes.length === 1 ? '' : 's'} to ${opts.out}.`,
+    };
+  }
+  // Straight to stdout so it pipes, with the count on stderr where it will not
+  // corrupt the document.
+  process.stderr.write(`${nodes.length} ${scope}-scope notes\n`);
+  return { ok: true, exported: nodes.length, scope, nodes, text: payload.trimEnd() };
+}
+
+/**
+ * Bring exported knowledge into this environment.
+ *
+ * Separate from `write` because `write` stamps the current repository and commit onto
+ * whatever it is given, which is right for capture and wrong for this: it would
+ * relabel another environment's knowledge as having been observed here.
+ */
+function cmdImport(opts) {
+  const file = opts._[0] ?? opts.from;
+  if (!file || file === true || (file !== '-' && !existsSync(file))) {
+    return {
+      ok: false,
+      error: 'import requires a file, or - to read stdin',
+      text: 'Usage: agent-memory import <file>   (or - to read stdin)',
+    };
+  }
+
+  let incoming;
+  try {
+    incoming = readNodesFrom(file);
+  } catch (err) {
+    return { ok: false, error: `unreadable JSON: ${err.message}`, text: `Unreadable JSON: ${err.message}` };
+  }
+
+  const db = openDb();
+  const existing = new Set(db.prepare('SELECT id FROM nodes').all().map((r) => r.id));
+
+  if (opts['dry-run']) {
+    db.close();
+    const lines = incoming.map(
+      (n) => `${existing.has(n.id) ? 'would update' : 'would create'} ${n.id} [${n.type}]`,
+    );
+    return {
+      ok: true,
+      dryRun: true,
+      count: incoming.length,
+      text: [...lines, '', 'Nothing written. Re-run without --dry-run to apply.'].join('\n'),
+    };
+  }
+
+  const written = [];
+  const failed = [];
+  const warnings = [];
+  for (const raw of incoming) {
+    // Nothing from this environment is stamped on: no repo, no commit. An imported
+    // note claims only what it claimed where it was written.
+    // Stamped `import`, not the source it carried. How it was captured describes an
+    // environment that no longer exists; here, the honest answer to where this came
+    // from is that someone brought it in, and an audit should be able to see which.
+    const node = { ...raw, source: 'import' };
+    delete node.captured_sha;
+    try {
+      const res = writeNote(node);
+      written.push({ id: res.node.id, type: res.node.type, created: res.created });
+      if (res.findings.length) {
+        warnings.push(
+          `${res.node.id}: redacted ${res.findings.map((f) => `${f.count}x ${f.kind}`).join(', ')}`,
+        );
+      }
+    } catch (err) {
+      failed.push({ id: raw?.id ?? null, errors: err.errors ?? [err.message] });
+    }
+  }
+
+  reindex(db);
+  db.close();
+
+  return {
+    ok: failed.length === 0,
+    imported: written.length,
+    failed,
+    warnings,
+    text: [
+      ...written.map((w) => `${w.created ? 'created' : 'updated'} ${w.id} [${w.type}]`),
+      ...warnings.map((w) => `warning: ${w}`),
+      ...failed.map((f) => `failed ${f.id}: ${f.errors.join('; ')}`),
+    ].join('\n'),
+  };
+}
+
+/**
+ * Show, switch and purge engagements.
+ *
+ * Each engagement is a whole store on disk, so switching is a path change and
+ * purging is a directory removal. Nothing here filters anything: the isolation is
+ * structural, and a subcommand that got it wrong could not leak across the boundary
+ * even if it tried.
+ */
+function cmdEngagement(opts) {
+  const sub = opts._[0] ?? 'show';
+
+  if (sub === 'show') {
+    return {
+      ok: true,
+      engagement: ENGAGEMENT.name,
+      source: ENGAGEMENT.source,
+      store: paths.root,
+      text: [
+        `engagement: ${ENGAGEMENT.name}`,
+        `decided by: ${ENGAGEMENT.source}`,
+        `store:      ${paths.root}`,
+      ].join('\n'),
+    };
+  }
+
+  if (sub === 'list') {
+    const found = listEngagements();
+    return {
+      ok: true,
+      engagements: found,
+      text: found
+        .map((e) => `${e.name === ENGAGEMENT.name ? '*' : ' '} ${e.name.padEnd(24)} ${e.notes} notes`)
+        .join('\n'),
+    };
+  }
+
+  if (sub === 'use') {
+    const name = opts._[1];
+    if (!name || !ENGAGEMENT_RE.test(name)) return badEngagementName(name);
+    mkdirSync(STORE_BASE, { recursive: true });
+    atomicWrite(ENGAGEMENT_POINTER, `${name}\n`);
+    return {
+      ok: true,
+      engagement: name,
+      store: engagementRoot(name),
+      text: [
+        `engagement: ${name}`,
+        `store:      ${engagementRoot(name)}`,
+        '',
+        'This is the fallback for every window on this machine. To pin one client tree',
+        `instead, put the name in a ${ENGAGEMENT_MARKER} file at the top of it.`,
+      ].join('\n'),
+    };
+  }
+
+  if (sub === 'purge') {
+    const name = opts._[1];
+    if (!name || !ENGAGEMENT_RE.test(name)) return badEngagementName(name);
+    if (name === DEFAULT_ENGAGEMENT) {
+      return {
+        ok: false,
+        error: 'the default engagement cannot be purged',
+        text: 'The default engagement cannot be purged. Delete individual notes instead.',
+      };
+    }
+    const dir = engagementRoot(name);
+    if (!existsSync(dir)) {
+      return { ok: false, error: `no engagement named ${name}`, text: `No engagement named ${name}.` };
+    }
+    const notes = countNotes(dir);
+    if (!opts.yes) {
+      // Deleting a client's captured knowledge is not something to do because a name
+      // was typed. Say exactly what goes, and make the caller ask again.
+      return {
+        ok: false,
+        error: 'purge requires --yes',
+        engagement: name,
+        notes,
+        text: [
+          `This deletes ${notes} note${notes === 1 ? '' : 's'} and the whole store at:`,
+          `  ${dir}`,
+          '',
+          'Nothing else is touched, and this cannot be undone. To go ahead:',
+          `  agent-memory engagement purge ${name} --yes`,
+        ].join('\n'),
+      };
+    }
+    rmSync(dir, { recursive: true, force: true });
+    return {
+      ok: true,
+      engagement: name,
+      notes,
+      removed: dir,
+      // Stated as a fact someone can check, because "we deleted it" is a claim that
+      // eventually has to be evidenced rather than asserted.
+      text: [
+        `Purged engagement ${name}: ${notes} note${notes === 1 ? '' : 's'} removed.`,
+        `${dir} no longer exists.`,
+      ].join('\n'),
+    };
+  }
+
+  return {
+    ok: false,
+    error: `unknown subcommand ${sub}`,
+    text: 'Usage: agent-memory engagement [show|list|use <name>|purge <name> --yes]',
+  };
+}
+
+function badEngagementName(name) {
+  return {
+    ok: false,
+    error: 'invalid engagement name',
+    text: [
+      name ? `"${name}" is not a usable engagement name.` : 'An engagement name is required.',
+      'Names become directory names: lower case, digits and hyphens, up to 64 characters.',
+    ].join('\n'),
+  };
+}
+
+/** Markdown files under a store, counted without opening its index. */
+function countNotes(root) {
+  const dir = join(root, 'notes');
+  if (!existsSync(dir)) return 0;
+  let n = 0;
+  const walk = (d) => {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      if (entry.isDirectory()) walk(join(d, entry.name));
+      else if (entry.name.endsWith('.md')) n += 1;
+    }
+  };
+  walk(dir);
+  return n;
+}
+
+function listEngagements() {
+  const out = [{ name: DEFAULT_ENGAGEMENT, notes: countNotes(engagementRoot(DEFAULT_ENGAGEMENT)) }];
+  const dir = join(STORE_BASE, 'engagements');
+  if (existsSync(dir)) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) out.push({ name: entry.name, notes: countNotes(join(dir, entry.name)) });
+    }
+  }
+  // The active one may not exist on disk yet, and omitting it would read as absent.
+  if (!out.some((e) => e.name === ENGAGEMENT.name)) out.push({ name: ENGAGEMENT.name, notes: 0 });
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
 const COMMANDS = {
   setup: cmdSetup,
   uninstall: cmdUninstall,
@@ -561,6 +868,9 @@ const COMMANDS = {
   write: cmdWrite,
   compact: cmdCompact,
   doctor: cmdDoctor,
+  engagement: cmdEngagement,
+  export: cmdExport,
+  import: cmdImport,
 };
 
 function main(argv) {

package/src/config.js

@@ -1,14 +1,81 @@
 import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, dirname, parse as parsePath } from 'node:path';
 import { homedir } from 'node:os';
 import { atomicWrite } from './atomic.js';
 
 // The store lives outside every repository on purpose. That is what makes a note
 // written in one window readable from a window opened on a different project.
-export const STORE_ROOT =
+export const STORE_BASE =
   process.env.AGENT_MEMORY_HOME ||
   join(process.env.USERPROFILE || homedir(), '.agents', 'memory');
 
+export const DEFAULT_ENGAGEMENT = 'default';
+
+/** Where the pointer to the active engagement lives, outside every engagement. */
+export const ENGAGEMENT_POINTER = join(STORE_BASE, '.engagement');
+
+/** Engagement names become directory names, so they have to be safe as one. */
+export const ENGAGEMENT_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+
+/** The file a client tree carries to pin itself to an engagement. */
+export const ENGAGEMENT_MARKER = '.agent-memory-engagement';
+
+/**
+ * Which engagement this process is working in, and how that was decided.
+ *
+ * A consultant runs several clients through one machine, and knowledge from one is
+ * not the next one's to see. The boundary is a separate store per engagement rather
+ * than a column to filter on, because filtering has to be remembered at every read
+ * and there are fourteen of them; two were already missed. A separate directory
+ * cannot be forgotten, and purging one is a directory removal that can be shown to
+ * have happened.
+ *
+ * The marker file is what makes this survive real use: drop one at the root of a
+ * client's tree and every repository beneath it is in that engagement, with nothing
+ * to remember when switching windows.
+ */
+export function resolveEngagement(cwd = process.cwd()) {
+  const env = process.env.AGENT_MEMORY_ENGAGEMENT?.trim();
+  if (env) return { name: env, source: 'AGENT_MEMORY_ENGAGEMENT' };
+
+  let dir = cwd;
+  for (;;) {
+    const marker = join(dir, ENGAGEMENT_MARKER);
+    if (existsSync(marker)) {
+      try {
+        const name = readFileSync(marker, 'utf8').trim().split('\n')[0].trim();
+        if (name) return { name, source: marker };
+      } catch {
+        // An unreadable marker is not a reason to fall back silently to another
+        // client's store. Treat it as unset and let the pointer or default decide.
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir || dir === parsePath(dir).root) break;
+    dir = parent;
+  }
+
+  if (existsSync(ENGAGEMENT_POINTER)) {
+    try {
+      const name = readFileSync(ENGAGEMENT_POINTER, 'utf8').trim();
+      if (name) return { name, source: ENGAGEMENT_POINTER };
+    } catch {
+      /* fall through to the default */
+    }
+  }
+  return { name: DEFAULT_ENGAGEMENT, source: 'default' };
+}
+
+/** The store directory for an engagement. The default one is the base itself. */
+export function engagementRoot(name) {
+  return name === DEFAULT_ENGAGEMENT ? STORE_BASE : join(STORE_BASE, 'engagements', name);
+}
+
+export const ENGAGEMENT = resolveEngagement();
+
+// Resolved once per process, like everything else here. One process, one answer.
+export const STORE_ROOT = engagementRoot(ENGAGEMENT.name);
+
 export const NOTE_TYPES = ['system', 'decision', 'convention', 'constraint'];
 
 export const paths = {