chat-recall 0.5.16 → 0.5.18

package/dist/watch.js

@@ -115,6 +115,37 @@ var init_tool_backend = __esm({
   }
 });
 
+// ../engine/dist/core/project-path-match.js
+function canonicalProjectPath(p) {
+  return (p || "").trim().replace(/\\/g, "/").replace(/[-_]/g, "/").replace(/\/{2,}/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function projectPathIncludes(candidate, rule) {
+  if (!candidate || !rule)
+    return false;
+  if (candidate.includes(rule))
+    return true;
+  const c = canonicalProjectPath(candidate);
+  const r = canonicalProjectPath(rule);
+  return !!r && c.includes(r);
+}
+function projectPathAtOrUnder(candidate, rule) {
+  if (!candidate || !rule)
+    return false;
+  const strip = (s) => s.replace(/\/+$/, "");
+  const cRaw = strip(candidate);
+  const rRaw = strip(rule);
+  if (cRaw === rRaw || cRaw.startsWith(`${rRaw}/`))
+    return true;
+  const c = canonicalProjectPath(candidate);
+  const r = canonicalProjectPath(rule);
+  return !!r && (c === r || c.startsWith(`${r}/`));
+}
+var init_project_path_match = __esm({
+  "../engine/dist/core/project-path-match.js"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/pino-std-serializers/lib/err-helpers.js
 var require_err_helpers = __commonJS({
   "../../node_modules/pino-std-serializers/lib/err-helpers.js"(exports, module) {
@@ -4649,7 +4680,7 @@ function isProjectSyncable(projectId, projectPath, cfg) {
   if (projectId && cfg.syncOnly.has(projectId))
     return true;
   for (const x of cfg.syncOnly)
-    if (x && projectPath.includes(x))
+    if (projectPathIncludes(projectPath, x))
       return true;
   return false;
 }
@@ -4963,6 +4994,7 @@ var CLI_DETECTION_ORDER, SCHEMA_VERSION, PERSONAL_DIR_NAMES, PERSONAL_DIR_PATTER
 var init_settings = __esm({
   "../engine/dist/core/settings.js"() {
     "use strict";
+    init_project_path_match();
     init_paths();
     CLI_DETECTION_ORDER = [
       { preset: "gemini", bin: "gemini", cmd: 'gemini -p " "' },
@@ -14828,7 +14860,7 @@ function matchesProjectList(projectPath, patterns) {
       const tail = projectPath.slice(parent.length + 1);
       if (projectPath.startsWith(parent + "/") && !tail.includes("/"))
         return true;
-    } else if (projectPath === p || projectPath.startsWith(p + "/")) {
+    } else if (projectPathAtOrUnder(projectPath, p)) {
       return true;
     }
   }
@@ -14854,6 +14886,7 @@ var cache2, TOOLS;
 var init_source_policy = __esm({
   "../engine/dist/core/source-policy.js"() {
     "use strict";
+    init_project_path_match();
     init_settings();
     cache2 = null;
     TOOLS = ["claude", "gemini", "opencode", "codex", "agy", "cursor"];
@@ -19177,7 +19210,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.16";
+        if (true) CLI_VERSION = "0.5.18";
       } catch {
       }
     }
@@ -19670,8 +19703,8 @@ async function flush() {
 }
 function hashHost() {
   try {
-    const { createHash: createHash16 } = __require("node:crypto");
-    return createHash16("sha256").update(hostname()).digest("hex").slice(0, 12);
+    const { createHash: createHash17 } = __require("node:crypto");
+    return createHash17("sha256").update(hostname()).digest("hex").slice(0, 12);
   } catch {
     return "";
   }
@@ -19685,7 +19718,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion = () => {
       try {
-        return true ? "0.5.16" : "dev";
+        return true ? "0.5.18" : "dev";
       } catch {
         return "dev";
       }
@@ -20008,6 +20041,25 @@ async function fetchTenantSecurityConfig(cred) {
     return { tenantRules: [], verifySecrets: true, rulePackVersion: null };
   }
 }
+function syncConfigCachePath() {
+  return join44(getDataDir(), "sync-config-cache.json");
+}
+function readPersistedSyncConfigs() {
+  try {
+    return JSON.parse(readFileSync36(syncConfigCachePath(), "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function persistSyncConfig(base2, config) {
+  try {
+    const all = readPersistedSyncConfigs();
+    all[base2] = { fetchedAt: Date.now(), config };
+    mkdirSync9(dirname18(syncConfigCachePath()), { recursive: true });
+    writeFileSync9(syncConfigCachePath(), JSON.stringify(all, null, 2));
+  } catch {
+  }
+}
 async function fetchTenantSyncConfig(cred) {
   const base2 = cred.serverUrl.replace(/\/+$/, "");
   const cached = _syncConfigCache.get(base2);
@@ -20027,7 +20079,11 @@ async function fetchTenantSyncConfig(cred) {
     } catch {
     }
     const res = await fetchWithTimeout(`${base2}/api/sync-config`, { headers });
-    if (!res.ok) return { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
+    if (res.status === 404) {
+      _syncConfigCache.set(base2, { fetchedAt: Date.now(), config: EMPTY_SYNC_CONFIG });
+      return EMPTY_SYNC_CONFIG;
+    }
+    if (!res.ok) return lastKnownSyncConfig(base2, `HTTP ${res.status}`);
     const body = await res.json().catch(() => ({}));
     const config = {
       excludeTools: Array.isArray(body.excludeTools) ? body.excludeTools.filter((t) => typeof t === "string") : [],
@@ -20065,11 +20121,22 @@ async function fetchTenantSyncConfig(cred) {
     } catch {
     }
     _syncConfigCache.set(base2, { fetchedAt: Date.now(), config });
+    persistSyncConfig(base2, config);
     return config;
-  } catch {
-    return { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
+  } catch (err) {
+    return lastKnownSyncConfig(base2, err instanceof Error ? err.message : "request failed");
   }
 }
+function lastKnownSyncConfig(base2, reason) {
+  const remembered = _syncConfigCache.get(base2) ?? readPersistedSyncConfigs()[base2];
+  if (remembered) {
+    console.error(`[sync] could not read server-side sync rules (${reason}) \u2014 applying the last known set from ${new Date(remembered.fetchedAt).toISOString()}`);
+    return remembered.config;
+  }
+  throw new Error(
+    `Cannot read the server-side sync rules from ${base2} (${reason}), and this machine has never successfully read them. Refusing to sync: uploading without knowing your exclusions could ship a project you told the dashboard to hold back. Fix the server or retry.`
+  );
+}
 function deviceLabel() {
   try {
     return hostname2();
@@ -20322,7 +20389,7 @@ async function syncToTargetInScope(cred, opts = {}) {
   };
   const cleartext = opts.cleartextPaths ?? sync?.pathsCleartext === true;
   const mapPath = (p) => cleartext ? p : hashPath(p);
-  const excluded = (projectPath) => excludeProjects.some((x) => x && projectPath.includes(x));
+  const excluded = (projectPath) => excludeProjects.some((x) => projectPathIncludes(projectPath, x));
   const syncOnly = /* @__PURE__ */ new Set([...sync?.syncOnlyProjects ?? [], ...serverCfg.syncOnlyProjects ?? []]);
   const includedProject = (projectPath) => {
     if ((sync?.syncMode ?? "all") !== "only") return true;
@@ -21282,7 +21349,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -21304,6 +21371,7 @@ var init_sync_client = __esm({
     init_tool_backend();
     init_session();
     init_project_resolver();
+    init_project_path_match();
     init_entity_extractor();
     init_all_sources();
     init_sync_ledger();
@@ -21327,7 +21395,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync36(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.16";
+        if (true) ownVersion = "0.5.18";
       } catch {
       }
     }
@@ -21337,6 +21405,7 @@ var init_sync_client = __esm({
     _securityConfigCache = /* @__PURE__ */ new Map();
     SECURITY_CONFIG_TTL_MS = 5 * 60 * 1e3;
     _syncConfigCache = /* @__PURE__ */ new Map();
+    EMPTY_SYNC_CONFIG = { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
     hashPath = (p) => p ? "p_" + createHash12("sha256").update(p).digest("hex").slice(0, 12) : "";
     MAX_DERIVED_ROW_BYTES = 2 * 1024 * 1024;
     isLocalHost = isPrivateHost;
@@ -22531,6 +22600,49 @@ var init_shadow_prune = __esm({
   }
 });
 
+// ../engine/dist/types/code-intel.js
+import { createHash as createHash15 } from "crypto";
+function shortHash(s) {
+  return createHash15("sha256").update(s).digest("hex").slice(0, 16);
+}
+function snippetKey(snippet) {
+  return (snippet ?? "").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function codeFindingIds(projectId, findings) {
+  const groups = /* @__PURE__ */ new Map();
+  findings.forEach((f, i) => {
+    const key2 = [f.category, f.file, f.rule, identityTitle(f.title ?? ""), snippetKey(f.snippet)].join("|");
+    const g = groups.get(key2);
+    if (g)
+      g.push(i);
+    else
+      groups.set(key2, [i]);
+  });
+  const lineOf = (i) => findings[i].line ?? -1;
+  const ids = new Array(findings.length);
+  for (const [key2, idxs] of groups) {
+    idxs.sort((a, b) => lineOf(a) - lineOf(b));
+    let ordinal = -1;
+    let prevLine = Number.NaN;
+    for (const idx of idxs) {
+      if (lineOf(idx) !== prevLine) {
+        ordinal++;
+        prevLine = lineOf(idx);
+      }
+      ids[idx] = "cf_" + shortHash([projectId, key2, ordinal].join("|"));
+    }
+  }
+  return ids;
+}
+function identityTitle(title) {
+  return title.replace(/\d+/g, "#");
+}
+var init_code_intel = __esm({
+  "../engine/dist/types/code-intel.js"() {
+    "use strict";
+  }
+});
+
 // ../engine/dist/core/which.js
 import { existsSync as existsSync48, statSync as statSync43, accessSync, constants } from "node:fs";
 import { join as join52, isAbsolute as isAbsolute3, delimiter as delimiter3, sep as sep2 } from "node:path";
@@ -22595,7 +22707,7 @@ import { existsSync as existsSync49, mkdirSync as mkdirSync15, statSync as statS
 import { homedir as homedir19 } from "node:os";
 import { join as join53 } from "node:path";
 import { execSync as execSync3 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 function expectedCodeindexSha256(artifact) {
   return CODEINDEX_SHA256[artifact.replace(/^codeindex-/, "").replace(/\.exe$/, "")] ?? null;
 }
@@ -22703,7 +22815,7 @@ async function installCodeindex(opts = {}) {
     if (!expected) {
       throw new Error(`No pinned checksum for ${status.artifactName} \u2014 refusing to install an unverified binary. Add its sha256 to CODEINDEX_SHA256 in companions.ts.`);
     }
-    const actual = createHash15("sha256").update(readFileSync43(tmpPath)).digest("hex");
+    const actual = createHash16("sha256").update(readFileSync43(tmpPath)).digest("hex");
     if (actual !== expected) {
       throw new Error(`Checksum mismatch for ${status.artifactName}.
   expected ${expected}
@@ -23090,6 +23202,11 @@ async function collectCode(opts) {
     }
   }
   const findings = [];
+  const coveredBySecurityRule = /* @__PURE__ */ new Map();
+  const coveredByCloneGroup = /* @__PURE__ */ new Map();
+  const coveredByDupCluster = /* @__PURE__ */ new Map();
+  const coveredByGodModule = /* @__PURE__ */ new Map();
+  const coveredByCycle = /* @__PURE__ */ new Map();
   const sevFromLiteral = (cat) => cat === "secret_suspect" ? "medium" : cat === "todo_marker" ? "info" : "low";
   const securityRows = [];
   const heuristicSec = [];
@@ -23139,7 +23256,7 @@ async function collectCode(opts) {
     log6(`security: repo secret scan unavailable (${e instanceof Error ? e.message : e}) \u2014 install gitleaks/trufflehog for secret coverage`);
   }
   for (const f of [...securityRows, ...heuristicSec]) {
-    findings.push({
+    const finding = {
       category: "security",
       severity: f.severity,
       file: f.file,
@@ -23149,7 +23266,13 @@ async function collectCode(opts) {
       snippet: f.snippet,
       why: FINDING_WHY.security,
       agentPrompt: securityPrompt(f.rule, f.severity, f.file, f.line)
-    });
+    };
+    findings.push(finding);
+    const byRuleList = coveredBySecurityRule.get(f.rule);
+    if (byRuleList)
+      byRuleList.push(finding);
+    else
+      coveredBySecurityRule.set(f.rule, [finding]);
   }
   for (const f of (lit?.findings ?? []).slice(0, 150)) {
     const file = rel(f.file);
@@ -23171,7 +23294,7 @@ async function collectCode(opts) {
     const names = [...new Set(fns.map((x) => x.name))];
     const fileList = fns.map((x) => rel(x.file)).slice(0, 6);
     const heavy = (g.lines ?? 0) * (g.count ?? 0) >= 150;
-    findings.push({
+    const finding = {
       category: "clone",
       severity: heavy ? "high" : "medium",
       file: fileList[0] ?? "",
@@ -23181,10 +23304,12 @@ async function collectCode(opts) {
       snippet: `${g.lines} lines, ${g.count} copies`,
       why: FINDING_WHY.clone,
       agentPrompt: clonePrompt(names, g.lines ?? 0, g.count ?? 0, fileList)
-    });
+    };
+    findings.push(finding);
+    coveredByCloneGroup.set(g, finding);
   }
   for (const c of (dup?.clusters ?? []).slice(0, 40)) {
-    findings.push({
+    const finding = {
       category: "duplication",
       severity: "low",
       file: c.name ?? "",
@@ -23194,7 +23319,9 @@ async function collectCode(opts) {
       snippet: `${c.kind}, ${c.count} files`,
       why: FINDING_WHY.duplication,
       agentPrompt: duplicationPrompt(c.name, c.kind ?? "", c.count ?? 0)
-    });
+    };
+    findings.push(finding);
+    coveredByDupCluster.set(c, finding);
   }
   for (const s of (dead?.symbols ?? []).slice(0, 120)) {
     const file = rel(s.file);
@@ -23212,7 +23339,7 @@ async function collectCode(opts) {
   }
   for (const m of (coup?.god_modules ?? []).slice(0, 15)) {
     const file = rel(m.file);
-    findings.push({
+    const finding = {
       category: "coupling",
       severity: "medium",
       file,
@@ -23222,11 +23349,13 @@ async function collectCode(opts) {
       snippet: `fan-in ${m.fan_in}, fan-out ${m.fan_out}`,
       why: FINDING_WHY.coupling,
       agentPrompt: couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100)
-    });
+    };
+    findings.push(finding);
+    coveredByGodModule.set(file, finding);
   }
   for (const c of (cyc?.cycles ?? []).slice(0, 25)) {
     const chain = (c.files ?? []).map(rel);
-    findings.push({
+    const finding = {
       category: "cycle",
       severity: "medium",
       file: chain[0] ?? "",
@@ -23236,7 +23365,9 @@ async function collectCode(opts) {
       snippet: chain.slice(0, 4).join(" \u2192 "),
       why: FINDING_WHY.cycle,
       agentPrompt: cyclePrompt(chain.slice(0, 6))
-    });
+    };
+    findings.push(finding);
+    coveredByCycle.set(c, finding);
   }
   for (const f of (unwrap?.findings ?? []).slice(0, 150)) {
     const file = rel(f.file);
@@ -23465,7 +23596,13 @@ async function collectCode(opts) {
   }
   log6("synthesising action plan \u2026");
   const actions = [];
-  const pushAction = (pri, category, title, fix, loc, agentPrompt) => actions.push({ pri, category, title, fix, loc, agentPrompt });
+  const findingIdOf = /* @__PURE__ */ new Map();
+  {
+    const ids = codeFindingIds(projectId, findings);
+    findings.forEach((f, i) => findingIdOf.set(f, ids[i]));
+  }
+  const coversOf = (fs) => [...new Set(fs.map((f) => f ? findingIdOf.get(f) : void 0).filter((id) => !!id))];
+  const pushAction = (pri, category, title, fix, loc, agentPrompt, covers = []) => actions.push({ pri, category, title, fix, loc, agentPrompt, covers });
   const byRule = /* @__PURE__ */ new Map();
   for (const f of securityRows) {
     if (isTestOrExampleFile(f.file))
@@ -23477,7 +23614,17 @@ async function collectCode(opts) {
   for (const [rule, hits] of byRule) {
     const sev = hits.some((h) => h.sev === "critical") ? "critical" : hits.some((h) => h.sev === "high") ? "high" : "medium";
     const pri = sev === "critical" ? 0 : sev === "high" ? 1 : 2;
-    pushAction(pri, "security", `${rule} \u2014 ${hits.length} occurrence(s)`, secFix(rule), hits.slice(0, 4).map((h) => ({ file: h.file, line: h.line })), securityPrompt(rule, sev, hits[0].file, hits[0].line));
+    pushAction(
+      pri,
+      "security",
+      `${rule} \u2014 ${hits.length} occurrence(s)`,
+      secFix(rule),
+      hits.slice(0, 4).map((h) => ({ file: h.file, line: h.line })),
+      securityPrompt(rule, sev, hits[0].file, hits[0].line),
+      // Every security finding on this rule. The card IS the roll-up, so the
+      // members must not each file one of their own.
+      coversOf(coveredBySecurityRule.get(rule) ?? [])
+    );
   }
   for (const g of clones?.groups ?? []) {
     if ((g.count ?? 0) >= 3 || (g.lines ?? 0) >= 12) {
@@ -23486,7 +23633,7 @@ async function collectCode(opts) {
         continue;
       const names = [...new Set(fns.map((x) => x.name))];
       const locs = fns.map((x) => rel(x.file)).slice(0, 5);
-      pushAction((g.lines ?? 0) * (g.count ?? 0) >= 150 ? 1 : 2, "duplication", `${names.join(", ")} copy-pasted ${g.count}\xD7 (${g.lines} lines each)`, "Extract one shared implementation and replace the copies.", locs.map((f) => ({ file: f })), clonePrompt(names, g.lines ?? 0, g.count ?? 0, locs));
+      pushAction((g.lines ?? 0) * (g.count ?? 0) >= 150 ? 1 : 2, "duplication", `${names.join(", ")} copy-pasted ${g.count}\xD7 (${g.lines} lines each)`, "Extract one shared implementation and replace the copies.", locs.map((f) => ({ file: f })), clonePrompt(names, g.lines ?? 0, g.count ?? 0, locs), coversOf([coveredByCloneGroup.get(g)]));
     }
   }
   for (const c of (dup?.clusters ?? []).slice(0, 12)) {
@@ -23498,19 +23645,19 @@ async function collectCode(opts) {
       continue;
     if (kind === "type_alias" || kind === "interface" || kind === "enum" || kind === "type")
       continue;
-    pushAction(2, "reuse", `${nm} (${c.kind}) reimplemented in ${c.count} files`, "Consolidate into a single shared utility/module.", [], duplicationPrompt(nm, c.kind ?? "", c.count));
+    pushAction(2, "reuse", `${nm} (${c.kind}) reimplemented in ${c.count} files`, "Consolidate into a single shared utility/module.", [], duplicationPrompt(nm, c.kind ?? "", c.count), coversOf([coveredByDupCluster.get(c)]));
   }
   for (const m of (coup?.god_modules ?? []).slice(0, 5)) {
     const file = rel(m.file);
     if (isGenerated(file))
       continue;
-    pushAction(2, "modularity", `God module ${file} (fan-in ${m.fan_in}, fan-out ${m.fan_out})`, "Split into cohesive sub-modules; introduce interfaces to cut fan-out.", [{ file }], couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100));
+    pushAction(2, "modularity", `God module ${file} (fan-in ${m.fan_in}, fan-out ${m.fan_out})`, "Split into cohesive sub-modules; introduce interfaces to cut fan-out.", [{ file }], couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100), coversOf([coveredByGodModule.get(file)]));
   }
   for (const c of (cyc?.cycles ?? []).slice(0, 5)) {
     const chain = (c.files ?? []).map(rel).filter((f) => !isGenerated(f));
     if (chain.length < 2)
       continue;
-    pushAction(2, "architecture", `Circular dependency (${chain.length} files)`, "Break the cycle: extract the shared type/interface into a separate module.", chain.slice(0, 4).map((f) => ({ file: f })), cyclePrompt(chain.slice(0, 6)));
+    pushAction(2, "architecture", `Circular dependency (${chain.length} files)`, "Break the cycle: extract the shared type/interface into a separate module.", chain.slice(0, 4).map((f) => ({ file: f })), cyclePrompt(chain.slice(0, 6)), coversOf([coveredByCycle.get(c)]));
   }
   for (const h of hotspotsAll.slice(0, 5)) {
     pushAction(2, "stability", `Hotspot ${h.file} (${h.churn}\xD7 changes, complexity ${h.complexity})`, "Add regression tests and refactor into smaller functions before the next change.", [{ file: h.file }], hotspotPrompt(h.file, h.churn, h.complexity, h.suggestion));
@@ -23623,11 +23770,12 @@ var init_collector = __esm({
   "../engine/dist/core/code/collector.js"() {
     "use strict";
     init_project_resolver();
+    init_code_intel();
     init_companions();
     init_secret_redactor();
     init_secret_scanner();
     init_prompts();
-    COLLECTOR_VERSION = 2;
+    COLLECTOR_VERSION = 3;
     ANALYSES = [
       "health",
       "security",
@@ -24040,7 +24188,7 @@ try {
   ownVersion2 = JSON.parse(readFileSync40(join49(dir, "../package.json"), "utf-8")).version || ownVersion2;
 } catch {
   try {
-    if (true) ownVersion2 = "0.5.16";
+    if (true) ownVersion2 = "0.5.18";
   } catch {
   }
 }
@@ -24384,7 +24532,7 @@ async function runCollectorMigration(opts) {
 init_sync_ledger();
 init_collector_health();
 import { existsSync as existsSync50, readFileSync as readFileSync45 } from "fs";
-var CLI_VERSION3 = true ? "0.5.16" : "0.0.0";
+var CLI_VERSION3 = true ? "0.5.18" : "0.0.0";
 var DEBOUNCE_MS = 5e3;
 var CLAUDE_DIR = claudeBackend.projectsDir();
 var PLANS_DIR = claudeBackend.plansDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chat-recall",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/munhq/chat-recall.git"

package/skills/chat-recall/SKILL.md

@@ -35,6 +35,16 @@ and apply the test in `chat-recall-memory` before calling one:
 `recall_security_dismiss`, `recall_rename_session`, `recall_regenerate_summary`,
 `recall_reclassify`, `recall_index`, `recall_code_index`.
 
+Two of those are in a class of their own — they REMOVE what the user has stored,
+and the host will ask before each call because they are deliberately not on the
+auto-approve list. `recall_forget` deletes one conversation from the server
+permanently (their own transcript file is untouched — say so). `recall_exclude_path`
+stops a path syncing, here and on their other devices. Both take `confirm: true`,
+and you pass it only when the user actually asked: "forget this conversation",
+"stop syncing this repo". Never infer it from frustration about a conversation.
+There is no tool that undoes either — an agent may narrow what is stored, never
+widen it. Widening is `chat-recall exclude remove` or the dashboard.
+
 `recall_improvements` is a read UNLESS you pass `create_tasks: true`, which opens
 one task per returned item on the shared team board. Pass it only when the user
 asked for the work to be tracked — the board is visible to teammates and the API
@@ -81,6 +91,8 @@ CLAUDE.md rule is additive and reversible, so take it; ask first before setting
 **Security** — `recall_security_summary` (leaked secrets that still need action — start here for "did I paste a key somewhere"), `recall_security_session` (findings for one session), `recall_security_dismiss` (mark rotated / false positive — do this only when the user confirms which), `recall_security_rules` (tenant detection rules; also tests a regex).
 **Health / maintenance** — `recall_status` (is the index alive, what is synced), `recall_index` (sync now), `recall_help` (names the tools the lean profile leaves unlisted — they all still work by name), `recall_heal_audit` (sessions whose rendered text is thinner than the raw archive, i.e. truncated upstream), `recall_regenerate_summary` (stored summary is stale or wrong), `recall_reclassify` (re-run the classifier over old chunks), `recall_rename_session`.
 
+**Removing things** — `recall_forget` (delete one conversation from the server, permanently, tombstoned so no later sync restores it), `recall_exclude_path` (stop syncing a path, on this machine and on the account). Both need `confirm: true` and an explicit request from the user.
+
 ## If you're unsure where to start
 
 - Free-text "is there past work relevant to this?" → `recall_search` with `include_outcome: true`.

package/skills/chat-recall-project/SKILL.md

@@ -65,6 +65,17 @@ diary conclusions, and cost. Accepts a path, a name substring, or a project id
   a teammate and attached to a project. Returns the new task id.
 - `mcp__chat-recall__recall_task_update` — change status, reassign, rename or
   comment. Takes the `t_…` id from `recall_tasks`.
+  - **`done` needs the session that did the work.** Pass your own session id;
+    without one the update is refused. A card asserts a problem in the code, so
+    closing it asserts the code changed, and the board shows the files and commits
+    behind the claim. If a card should not be worked at all, use `rejected` — that
+    is the verdict a machine may not give itself.
+  - Cards filed from findings also close THEMSELVES once a re-index stops
+    reporting the finding, so fixing the code and re-indexing is usually enough.
+    Attach your session anyway: the closure keeps its evidence.
+  - Filing is capped — at most 10 new cards per run and 50 open at once. A board
+    at the ceiling files nothing until cards close; the backlog stays visible in
+    the ranked findings view.
 - `mcp__chat-recall__recall_team_activity` — per-teammate × per-project rollup
   (session counts, last activity) for "what is the team working on".
 - `mcp__chat-recall__recall_shares` — which projects are shared into the team