chat-recall 0.5.28 → 0.5.29

package/dist/mcp.js

@@ -4604,9 +4604,9 @@ function doResolve(realPath) {
   const bot = resolveBotWorktree(realPath);
   if (bot)
     return bot;
-  const git = resolveGit(realPath);
-  if (git)
-    return git;
+  const git2 = resolveGit(realPath);
+  if (git2)
+    return git2;
   const ws = resolveAutoWorkspace(realPath, cfg.autoWorkspaceMinRepos ?? DEFAULT_AUTO_WORKSPACE_MIN_REPOS);
   if (ws)
     return ws;
@@ -4675,9 +4675,9 @@ function resolveGit(realPath) {
   const toplevel = findGitToplevel(realPath);
   if (!toplevel)
     return null;
-  const remote = getGitRemote(toplevel);
-  if (remote) {
-    const parsed = parseGitRemote(remote);
+  const probe = getGitRemote(toplevel);
+  if (probe.kind === "remote") {
+    const parsed = parseGitRemote(probe.url);
     if (parsed) {
       return {
         id: `git:${parsed.host}/${parsed.owner}/${parsed.repo}`,
@@ -4686,6 +4686,9 @@ function resolveGit(realPath) {
       };
     }
   }
+  if (probe.kind === "failed") {
+    console.error(`[project] could not read git remotes in ${toplevel} \u2014 filing it as a local-only repo for now, which is probably wrong: ${probe.reason}`);
+  }
   const hash = createHash("sha1").update(toplevel).digest("hex").slice(0, 12);
   return {
     id: `git-local:${hash}`,
@@ -4704,23 +4707,39 @@ function findGitToplevel(realPath) {
   }
   return null;
 }
+function git(toplevel, args) {
+  return execSync(`git ${args}`, {
+    cwd: toplevel,
+    stdio: ["ignore", "pipe", "ignore"],
+    encoding: "utf-8",
+    timeout: GIT_TIMEOUT_MS
+  });
+}
+function probeGitRemote(toplevel) {
+  let names;
+  try {
+    names = git(toplevel, "remote").split("\n").map((n) => n.trim()).filter(Boolean);
+  } catch (err) {
+    return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  if (names.length === 0)
+    return { kind: "none" };
+  const pick = names.includes("origin") ? "origin" : names[0];
+  try {
+    const url = git(toplevel, `remote get-url ${pick}`).trim();
+    return url ? { kind: "remote", url } : { kind: "none" };
+  } catch (err) {
+    return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
 function getGitRemote(toplevel) {
   const cached = gitCache.get(toplevel);
   if (cached)
-    return cached.remote;
-  let remote = null;
-  try {
-    remote = execSync("git remote get-url origin", {
-      cwd: toplevel,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf-8",
-      timeout: 2e3
-    }).trim() || null;
-  } catch {
-    remote = null;
-  }
-  gitCache.set(toplevel, { remote });
-  return remote;
+    return cached;
+  const probe = probeGitRemote(toplevel);
+  if (probe.kind !== "failed")
+    gitCache.set(toplevel, probe);
+  return probe;
 }
 function parseGitRemote(url) {
   const trimmed = url.trim().replace(/\.git$/, "");
@@ -4850,7 +4869,7 @@ function globToRegex(glob) {
 function escapeRe(s) {
   return s.replace(/[.+^${}()|[\]\\]/g, "\\$&");
 }
-var DEFAULT_AUTO_WORKSPACE_MIN_REPOS, BOT_WORKTREE_MARKERS, resolveCache, gitCache, workspaceCache, cachedConfig, AUTO_WORKSPACE_MAX_DEPTH;
+var DEFAULT_AUTO_WORKSPACE_MIN_REPOS, BOT_WORKTREE_MARKERS, resolveCache, gitCache, workspaceCache, cachedConfig, GIT_TIMEOUT_MS, AUTO_WORKSPACE_MAX_DEPTH;
 var init_project_resolver = __esm({
   "../engine/dist/core/project-resolver.js"() {
     "use strict";
@@ -4861,6 +4880,7 @@ var init_project_resolver = __esm({
     gitCache = /* @__PURE__ */ new Map();
     workspaceCache = /* @__PURE__ */ new Map();
     cachedConfig = null;
+    GIT_TIMEOUT_MS = 1e4;
     AUTO_WORKSPACE_MAX_DEPTH = 2;
   }
 });
@@ -20633,7 +20653,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync37(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.28";
+        if (true) CLI_VERSION = "0.5.29";
       } catch {
       }
     }
@@ -21145,7 +21165,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.28" : "dev";
+        return true ? "0.5.29" : "dev";
       } catch {
         return "dev";
       }
@@ -22974,7 +22994,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync39(join49(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.28";
+        if (true) ownVersion = "0.5.29";
       } catch {
       }
     }
@@ -24369,7 +24389,8 @@ var RecallTaskUpdateSchema = z.object({
   id: z.string().describe("Task id (t_\u2026)"),
   status: z.enum(TASK_STATUS_SETTABLE).optional().describe("'done' needs linked_session_id \u2014 the session that did the work. 'closed' means the card no longer applies (its finding went away, or it duplicates another) and needs closed_reason. If it was never a real problem, do not close it: tell the user, because rejecting is their call."),
   closed_reason: z.string().optional().describe("Why the card no longer applies. REQUIRED with status 'closed'."),
-  commits: z.array(z.string()).optional().describe("The commit sha(s) that fixed this, in THIS card's repository. REQUIRED with status 'done' \u2014 a session link alone proved the wrong thing once: a card closed with a real session attached showed 74 commits belonging to a DIFFERENT repository."),
+  diff: z.string().optional().describe("THE CHANGE YOU MADE for this card, as a unified diff (`git diff`, or the patch you applied). REQUIRED with status 'done' unless you pass commits. You are the only one who knows it: the board cannot reconstruct shell-driven edits, and its commit scan only sees repositories this session tool-touched."),
+  commits: z.array(z.string()).optional().describe("The commit sha(s) carrying that change, if you committed it. Pass them with the diff when you have both \u2014 the diff is what a reader sees, the sha is what makes it checkable."),
   files: z.array(z.string()).optional().describe("Files those commits changed. PASS THESE: without them the card cannot narrow the session's diff to this card, and shows no changes at all rather than another repository's."),
   summary: z.string().optional().describe("One line on what changed (optional)."),
   assignee: z.string().optional().describe("Reassign to this user id (sub); empty string unassigns"),
@@ -24394,7 +24415,8 @@ var RecallTaskPolicySchema = z.object({
   categories: z.array(z.string()).optional().describe('Only file these finding/action categories (e.g. ["security","clone"]). Pass an empty array for all of them.'),
   excluded_projects: z.array(z.string()).optional().describe("Projects that never file a card \u2014 replaces the whole list. Use exclude_project/include_project to change one."),
   exclude_project: z.string().optional().describe('Add ONE project to the never-file list. For "do not put work on my board for this repo" \u2014 a client codebase, an archive, a mirror.'),
-  include_project: z.string().optional().describe("Remove ONE project from the never-file list.")
+  include_project: z.string().optional().describe("Remove ONE project from the never-file list."),
+  project: z.string().optional().describe('Apply max_pri and categories to THIS PROJECT ONLY, leaving every other repo on the global setting. For "only security in the client repo, everything in mine".')
 });
 var RecallTaskCommentSchema = z.object({
   task_id: z.string().describe("Task id (t_\u2026) from recall_tasks"),
@@ -25189,11 +25211,23 @@ WORKFLOW \u2014 do this whenever the user asks you to work on a task from the bo
    server cannot see it). This is REQUIRED \u2014 claiming without it is refused,
    because "in progress" with nothing behind it cannot be asked about. The card
    then shows that session's changes as they land, not only after the commit.
-2. When you finish, set status 'done' AND pass commits \u2014 the sha(s) in this
-   card's repository that fixed it. Without them the close is refused. Pass
-   the FILES too: they are what lets the card show the exact change, because a
-   session's diff covers every repository it touched and only the file list can
-   narrow it to this card.
+2. When you finish, set status 'done' AND RECORD WHAT YOU CHANGED: pass the diff
+   (unified \u2014 what git diff printed for this fix) and the commits if you
+   committed it. The close is refused without one of them. Do not expect the
+   board to work it out \u2014 it cannot see edits made through a shell, and its
+   commit scan only searches repositories this session already tool-touched.
+   The diff you paste is what the next person reads on the card.
+
+STAY INSIDE THE CARD'S PROJECT. A card names one project; fix it there and
+nowhere else. If the real fix needs a change in another repository, say so and
+leave the card open rather than reaching across \u2014 the person who filed this board
+did not ask you to touch a second codebase, and a diff spanning repositories
+cannot be reviewed as one change.
+
+TELL THE USER WHAT YOU ARE DOING. Say that you are taking tasks off the
+chat-recall board, name the ones you picked, and say when each is done and what
+changed. A card closing on its own, with no word to the person whose board it is,
+is how this board stopped being trusted the first time.
 
 THE THREE ENDINGS ARE NOT THE SAME:
 - 'done'     \u2014 you fixed it. Needs linked_session_id; refused without one.
@@ -25211,7 +25245,8 @@ nobody had done.`,
             id: { type: "string", description: "Task id (t_\u2026)" },
             status: { type: "string", enum: [...TASK_STATUS_SETTABLE], description: "Set the card's state. 'done' needs linked_session_id; 'closed' needs closed_reason. There is no 'rejected' here on purpose: rejecting is the user's verdict, not yours." },
             closed_reason: { type: "string", description: "Why the card no longer applies. REQUIRED with status 'closed'." },
-            commits: { type: "array", items: { type: "string" }, description: "Commit sha(s) in THIS card's repository that fixed it. REQUIRED with status 'done'." },
+            diff: { type: "string", description: "THE CHANGE YOU MADE for this card, as a unified diff. REQUIRED with status 'done' unless you pass commits \u2014 the board cannot reconstruct shell-driven edits, so this is the only reliable record." },
+            commits: { type: "array", items: { type: "string" }, description: "Commit sha(s) carrying that change, if you committed it." },
             files: { type: "array", items: { type: "string" }, description: "Files those commits changed. PASS THESE: the card scopes the session's diff by them, and without them it can show no changes rather than risk showing another repository's." },
             summary: { type: "string", description: "One line on what changed (optional)." },
             assignee: { type: "string", description: "Reassign to this user id (sub)" },
@@ -25244,6 +25279,8 @@ without editing the task itself. Pass the task id (t_\u2026) from recall_tasks.`
   ceiling      how many auto-filed cards may be open at once
   max_per_run  cap on new cards per run
   categories   only file these categories (e.g. ["security"]); [] means all
+  project      apply max_pri/categories to THAT REPOSITORY ONLY \u2014 one floor
+               across every repo forces the strictest one on all of them
   exclude_project / include_project
                a repository that never files a card \u2014 a client's codebase, an
                archive, a mirror. Indexed and searchable as before; simply never
@@ -25260,6 +25297,7 @@ explains a quiet board: at the ceiling, filing pauses until cards close.`,
             ceiling: { type: "number", description: "How many auto-filed cards may be OPEN at once." },
             max_per_run: { type: "number", description: "Cap on NEW cards per run." },
             categories: { type: "array", items: { type: "string" }, description: "Only file these categories; [] means all." },
+            project: { type: "string", description: "Apply max_pri/categories to THIS project only, leaving other repos on the global setting." },
             excluded_projects: { type: "array", items: { type: "string" }, description: "Replace the never-file list." },
             exclude_project: { type: "string", description: "Add ONE project to the never-file list." },
             include_project: { type: "string", description: "Remove ONE project from the never-file list." }
@@ -26984,11 +27022,16 @@ ${howTo}` }] };
           patch.linkedSessionId = params.linked_session_id;
         if (params.closed_reason !== void 0)
           patch.closedReason = params.closed_reason;
-        if (params.commits?.length) {
-          patch.doneEvidence = { commits: params.commits, files: params.files, summary: params.summary };
+        if (params.commits?.length || params.diff) {
+          patch.doneEvidence = {
+            diff: params.diff,
+            commits: params.commits,
+            files: params.files,
+            summary: params.summary
+          };
         }
-        if (params.status === "done" && !params.commits?.length) {
-          return { content: [{ type: "text", text: "Closing as 'done' needs the commit sha(s) that fixed it, in this card's repository \u2014 pass commits. Commit the fix first if you have not. If the card no longer applies, use status 'closed' with closed_reason; if it was never a real problem, leave it open and tell the user, because rejecting is their call." }] };
+        if (params.status === "done" && !params.commits?.length && !params.diff) {
+          return { content: [{ type: "text", text: "Closing as 'done' needs the change that fixed it: pass `diff` \u2014 the unified diff of what you changed for this card \u2014 and `commits` if you committed it. Nothing else can supply it: the board cannot see shell-driven edits, and its commit scan only searches repositories this session tool-touched. If the card no longer applies, use status 'closed' with closed_reason; if it was never a real problem, leave it open and tell the user, because rejecting is their call." }] };
         }
         if (params.status === "closed" && !(params.closed_reason ?? "").trim()) {
           return { content: [{ type: "text", text: "closed_reason is required when closing a task. Say why the card no longer applies (its finding stopped being reported, or it duplicates another card). If you FIXED it, use status 'done' with linked_session_id instead; if it was never a real problem, leave it open and tell the user, because rejecting it is their call." }] };
@@ -27012,14 +27055,23 @@ ${howTo}` }] };
         const patch = {};
         if (params.enabled !== void 0)
           patch.enabled = params.enabled;
-        if (params.max_pri !== void 0)
-          patch.maxPri = params.max_pri;
+        if (params.project) {
+          const over = {};
+          if (params.max_pri !== void 0)
+            over.maxPri = params.max_pri;
+          if (params.categories !== void 0)
+            over.categories = params.categories;
+          patch.perProject = { [params.project]: Object.keys(over).length ? over : null };
+        } else {
+          if (params.max_pri !== void 0)
+            patch.maxPri = params.max_pri;
+          if (params.categories !== void 0)
+            patch.categories = params.categories;
+        }
         if (params.ceiling !== void 0)
           patch.ceiling = params.ceiling;
         if (params.max_per_run !== void 0)
           patch.maxPerRun = params.max_per_run;
-        if (params.categories !== void 0)
-          patch.categories = params.categories;
         if (params.excluded_projects !== void 0)
           patch.excludedProjects = params.excluded_projects;
         const cur = await remoteGetQS("/api/tasks/policy", {});

package/dist/watch.js

@@ -14102,9 +14102,9 @@ function doResolve(realPath) {
   const bot = resolveBotWorktree(realPath);
   if (bot)
     return bot;
-  const git = resolveGit(realPath);
-  if (git)
-    return git;
+  const git2 = resolveGit(realPath);
+  if (git2)
+    return git2;
   const ws = resolveAutoWorkspace(realPath, cfg.autoWorkspaceMinRepos ?? DEFAULT_AUTO_WORKSPACE_MIN_REPOS);
   if (ws)
     return ws;
@@ -14173,9 +14173,9 @@ function resolveGit(realPath) {
   const toplevel = findGitToplevel(realPath);
   if (!toplevel)
     return null;
-  const remote = getGitRemote(toplevel);
-  if (remote) {
-    const parsed = parseGitRemote(remote);
+  const probe = getGitRemote(toplevel);
+  if (probe.kind === "remote") {
+    const parsed = parseGitRemote(probe.url);
     if (parsed) {
       return {
         id: `git:${parsed.host}/${parsed.owner}/${parsed.repo}`,
@@ -14184,6 +14184,9 @@ function resolveGit(realPath) {
       };
     }
   }
+  if (probe.kind === "failed") {
+    console.error(`[project] could not read git remotes in ${toplevel} \u2014 filing it as a local-only repo for now, which is probably wrong: ${probe.reason}`);
+  }
   const hash = createHash7("sha1").update(toplevel).digest("hex").slice(0, 12);
   return {
     id: `git-local:${hash}`,
@@ -14202,23 +14205,39 @@ function findGitToplevel(realPath) {
   }
   return null;
 }
+function git(toplevel, args) {
+  return execSync(`git ${args}`, {
+    cwd: toplevel,
+    stdio: ["ignore", "pipe", "ignore"],
+    encoding: "utf-8",
+    timeout: GIT_TIMEOUT_MS
+  });
+}
+function probeGitRemote(toplevel) {
+  let names;
+  try {
+    names = git(toplevel, "remote").split("\n").map((n) => n.trim()).filter(Boolean);
+  } catch (err) {
+    return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  if (names.length === 0)
+    return { kind: "none" };
+  const pick = names.includes("origin") ? "origin" : names[0];
+  try {
+    const url = git(toplevel, `remote get-url ${pick}`).trim();
+    return url ? { kind: "remote", url } : { kind: "none" };
+  } catch (err) {
+    return { kind: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
 function getGitRemote(toplevel) {
   const cached = gitCache.get(toplevel);
   if (cached)
-    return cached.remote;
-  let remote = null;
-  try {
-    remote = execSync("git remote get-url origin", {
-      cwd: toplevel,
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf-8",
-      timeout: 2e3
-    }).trim() || null;
-  } catch {
-    remote = null;
-  }
-  gitCache.set(toplevel, { remote });
-  return remote;
+    return cached;
+  const probe = probeGitRemote(toplevel);
+  if (probe.kind !== "failed")
+    gitCache.set(toplevel, probe);
+  return probe;
 }
 function parseGitRemote(url) {
   const trimmed = url.trim().replace(/\.git$/, "");
@@ -14348,7 +14367,7 @@ function globToRegex(glob) {
 function escapeRe(s) {
   return s.replace(/[.+^${}()|[\]\\]/g, "\\$&");
 }
-var DEFAULT_AUTO_WORKSPACE_MIN_REPOS, BOT_WORKTREE_MARKERS, resolveCache, gitCache, workspaceCache, cachedConfig, AUTO_WORKSPACE_MAX_DEPTH;
+var DEFAULT_AUTO_WORKSPACE_MIN_REPOS, BOT_WORKTREE_MARKERS, resolveCache, gitCache, workspaceCache, cachedConfig, GIT_TIMEOUT_MS, AUTO_WORKSPACE_MAX_DEPTH;
 var init_project_resolver = __esm({
   "../engine/dist/core/project-resolver.js"() {
     "use strict";
@@ -14359,6 +14378,7 @@ var init_project_resolver = __esm({
     gitCache = /* @__PURE__ */ new Map();
     workspaceCache = /* @__PURE__ */ new Map();
     cachedConfig = null;
+    GIT_TIMEOUT_MS = 1e4;
     AUTO_WORKSPACE_MAX_DEPTH = 2;
   }
 });
@@ -19213,7 +19233,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.28";
+        if (true) CLI_VERSION = "0.5.29";
       } catch {
       }
     }
@@ -19721,7 +19741,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion = () => {
       try {
-        return true ? "0.5.28" : "dev";
+        return true ? "0.5.29" : "dev";
       } catch {
         return "dev";
       }
@@ -21586,7 +21606,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync37(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.28";
+        if (true) ownVersion = "0.5.29";
       } catch {
       }
     }
@@ -24374,7 +24394,7 @@ try {
   ownVersion2 = JSON.parse(readFileSync41(join50(dir, "../package.json"), "utf-8")).version || ownVersion2;
 } catch {
   try {
-    if (true) ownVersion2 = "0.5.28";
+    if (true) ownVersion2 = "0.5.29";
   } catch {
   }
 }
@@ -24718,7 +24738,7 @@ async function runCollectorMigration(opts) {
 init_sync_ledger();
 init_collector_health();
 import { existsSync as existsSync50, readFileSync as readFileSync46 } from "fs";
-var CLI_VERSION3 = true ? "0.5.28" : "0.0.0";
+var CLI_VERSION3 = true ? "0.5.29" : "0.0.0";
 var DEBOUNCE_MS = 5e3;
 var CLAUDE_DIR = claudeBackend.projectsDir();
 var PLANS_DIR = claudeBackend.plansDir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chat-recall",
-  "version": "0.5.28",
+  "version": "0.5.29",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/munhq/chat-recall.git"

package/skills/chat-recall-project/SKILL.md

@@ -59,12 +59,25 @@ diary conclusions, and cost. Accepts a path, a name substring, or a project id
 
 ## Tasks and team (shared, not personal notes)
 
+**Working the board out loud.** When you take work from here, say so: that you are
+pulling tasks from the chat-recall board, which ones you picked, and — as each one
+lands — that it is done and what changed. The board is the user's, and a card that
+claims and closes itself with no word to them is how it stopped being trusted the
+first time. `recall_tasks detail:true` gives you the brief, the locations and the
+agent prompt for each card, so "what can I pick up" is one call.
+
+
 - `mcp__chat-recall__recall_tasks` — the shared task board: status, assignee,
   project. This is the answer to "what are my open tasks".
 - `mcp__chat-recall__recall_task_create` — create a task, optionally assigned to
   a teammate and attached to a project. Returns the new task id.
 - `mcp__chat-recall__recall_task_update` — change status, reassign, rename or
   comment. Takes the `t_…` id from `recall_tasks`.
+  - **`done` needs the CHANGE.** Pass `diff` — the unified diff of what you changed
+    for that card — and `commits` if you committed it. Nothing else can supply it:
+    the board cannot see edits made through a shell, and its commit scan only
+    searches repositories the session already touched with file tools. The diff you
+    record is what the person reads on the card.
   - **`done` needs the session that did the work.** Pass your own session id;
     without one the update is refused. A card asserts a problem in the code, so
     closing it asserts the code changed, and the board shows the files and commits
@@ -73,6 +86,10 @@ diary conclusions, and cost. Accepts a path, a name substring, or a project id
   - Cards filed from findings also close THEMSELVES once a re-index stops
     reporting the finding, so fixing the code and re-indexing is usually enough.
     Attach your session anyway: the closure keeps its evidence.
+  - **Stay inside the card's project.** A card names one repository; fix it there
+    and nowhere else. If the real fix needs a change in another repo, say so and
+    leave the card open — the API refuses evidence whose file paths climb out of
+    the project, and a diff spanning repositories cannot be reviewed as one change.
   - Filing is capped — at most 10 new cards per run and 50 open at once. A board
     at the ceiling files nothing until cards close; the backlog stays visible in
     the ranked findings view.