engineering-memory 1.10.0 → 1.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/git/verification-gate.js

@@ -1,3 +1,4 @@
+import { sha256 } from '../utilities/hash.js';
 import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { RepositoryResolver } from '../project/repository.js';
@@ -22,8 +23,10 @@ export class VerificationGate {
         }
         const verifiedAt = new Date();
         const taskChanges = await this.git.taskManifest(input.repoRoot, input.taskChanges);
-        await writeJson(this.pathFor(input.repoFingerprint), {
-            schemaVersion: 4,
+        const worktreeId = worktreeIdentity(await this.git.findRoot(input.repoRoot));
+        await writeJson(this.pathFor(input.repoFingerprint, worktreeId, input.taskId), {
+            schemaVersion: 5,
+            worktreeId,
             taskId: input.taskId,
             projectId: input.projectId,
             repoFingerprint: input.repoFingerprint,
@@ -39,16 +42,12 @@ export class VerificationGate {
         }, this.root);
     }
     async verify(repoRoot) {
-        const [repository, stagedChanges, pending, scaffolding] = await Promise.all([
+        const [repository, stagedChanges, scaffolding] = await Promise.all([
             this.repositories.resolve(repoRoot),
             this.git.stagedManifest(repoRoot),
-            this.outbox.list(),
             this.git.temporaryScaffolding(repoRoot),
         ]);
         const { repoFingerprint: fingerprint, git: manifest } = repository;
-        if (pending.length > 0) {
-            return { allowed: false, reason: 'offline_outbox_pending', diffHash: manifest.diffHash };
-        }
         const staged = scaffolding.filter((match) => match.staged);
         if (staged.length > 0) {
             return {
@@ -58,10 +57,29 @@ export class VerificationGate {
                 details: staged.map((match) => `${match.path}:${match.line}`),
             };
         }
-        const receipt = await readJson(this.pathFor(fingerprint), this.root);
+        const branch = await this.git.currentBranch(repository.repoRoot);
+        const candidates = await this.receiptsFor(fingerprint, worktreeIdentity(repository.repoRoot));
+        const relevant = candidates.filter((candidate) => !repository.projectId || candidate.projectId === repository.projectId);
+        relevant.sort((a, b) => b.verifiedAt.localeCompare(a.verifiedAt) || a.taskId.localeCompare(b.taskId));
+        const matchesBranch = (candidate) => !candidate.branch || candidate.branch === branch;
+        const receipt = relevant.find((candidate) => candidate.taskClosed &&
+            matchesBranch(candidate) &&
+            candidate.diffHash === manifest.diffHash &&
+            isTaskManifest(candidate.taskChanges) &&
+            stagedChanges.every((entry) => belongsToTask(entry, candidate.taskChanges))) ??
+            relevant.find(matchesBranch) ??
+            relevant[0];
         if (!receipt) {
             return { allowed: false, reason: 'task_verify_required', diffHash: manifest.diffHash };
         }
+        if ((await this.outbox.listForTask(receipt.taskId)).length > 0) {
+            return {
+                allowed: false,
+                reason: 'offline_outbox_pending',
+                diffHash: manifest.diffHash,
+                taskId: receipt.taskId,
+            };
+        }
         if (!receipt.taskClosed) {
             return {
                 allowed: false,
@@ -70,7 +88,7 @@ export class VerificationGate {
                 taskId: receipt.taskId,
             };
         }
-        if (receipt.schemaVersion !== 4 ||
+        if (![4, 5].includes(receipt.schemaVersion) ||
             !receipt.projectId ||
             typeof receipt.taskVersion !== 'number' ||
             !Number.isSafeInteger(receipt.taskVersion) ||
@@ -83,7 +101,6 @@ export class VerificationGate {
                 taskId: receipt.taskId,
             };
         }
-        const branch = await this.git.currentBranch(repoRoot);
         if (receipt.branch && branch !== receipt.branch) {
             return {
                 allowed: false,
@@ -191,10 +208,31 @@ export class VerificationGate {
             await removeFile(join(this.root, entry.name), this.root);
         }
     }
-    pathFor(repoFingerprint) {
-        return join(this.root, `${safeSegment(repoFingerprint)}.json`);
+    async receiptsFor(repoFingerprint, worktreeId) {
+        await ensureManagedDirectory(this.root, this.root);
+        const prefix = safeSegment(repoFingerprint);
+        const entries = await readdir(this.root, { withFileTypes: true });
+        const receipts = [];
+        for (const entry of entries) {
+            if (entry.name !== `${prefix}.json` &&
+                !(entry.name.startsWith(`${prefix}-`) && entry.name.endsWith('.json')))
+                continue;
+            if (!entry.isFile() || entry.isSymbolicLink())
+                throw new Error(`Unsafe verification gate entry: ${entry.name}`);
+            const receipt = await readJson(join(this.root, entry.name), this.root);
+            if (receipt?.repoFingerprint === repoFingerprint &&
+                (entry.name === `${prefix}.json` || receipt.worktreeId === worktreeId))
+                receipts.push(receipt);
+        }
+        return receipts;
+    }
+    pathFor(repoFingerprint, worktreeId, taskId) {
+        return join(this.root, `${safeSegment(repoFingerprint)}-${worktreeId}-${safeSegment(taskId)}.json`);
     }
 }
+function worktreeIdentity(repoRoot) {
+    return sha256(process.platform === 'win32' ? repoRoot.toLowerCase() : repoRoot);
+}
 function asObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }

package/runtime/dist/src/mcp/tool-definitions.js

@@ -487,6 +487,7 @@ export function registerEngineeringMemoryTools(server, service) {
             projectName: z.string().min(2),
             projectSlug: z.string().min(2).optional(),
             framework: z.string().optional(),
+            developmentArea: z.enum(['backend', 'web', 'mobile']).nullable().optional(),
             figmaConfig: jsonObject,
             initialProjectProfile: z.object({
                 title: z.string().min(2),
@@ -701,6 +702,7 @@ export function registerEngineeringMemoryTools(server, service) {
                 expectedVersion: z.number().int().min(1),
                 name: z.string().min(2).max(160).optional(),
                 framework: z.string().min(2).max(80).nullable().optional(),
+                developmentArea: z.enum(['backend', 'web', 'mobile']).nullable().optional(),
                 repositoryUrl: z.string().url().nullable().optional(),
                 workItemPrefix: z
                     .string()

package/runtime/dist/src/runtime/api-client.js

@@ -7,6 +7,7 @@ export const backendRecoveryOperationNames = [
     'organization.member_list',
     'organization.member_upsert',
     'project.setup',
+    'project.update',
     'project.resolve',
     'project.list',
     'project.restore',

package/runtime/dist/src/runtime/bridge-service.js

@@ -248,7 +248,7 @@ export class BridgeService {
                 });
             }
             const recoveredDeliveries = await this.recoverJournalOutbox(projectId, taskSlug);
-            const outbox = await this.flushOutbox();
+            const outbox = await this.flushOutbox(pointer?.taskId);
             const afterSequence = input.afterSequence ?? 0;
             const response = await this.dependencies.client.request(endpoints.sessionResume, {
                 method: 'POST',
@@ -278,7 +278,7 @@ export class BridgeService {
                     .release(backendTask.id);
             }
             let localJournal = await this.dependencies.journal.load(projectId, taskSlug);
-            let pendingOutbox = await this.dependencies.outbox.list();
+            let pendingOutbox = await this.dependencies.outbox.listForTask(backendTask.id);
             const responseSource = this.dependencies.client.getResponseSource(response);
             const recoveredVerification = responseSource !== 'stale_cache' && pointer
                 ? await this.retryVerificationRecovery(repository, pointer, backend)
@@ -306,7 +306,7 @@ export class BridgeService {
                     documents: backendDocuments,
                 });
                 blockedJournalEventIds = hydration.blockedEventIds;
-                const entries = await this.dependencies.outbox.list();
+                const entries = await this.dependencies.outbox.listForTask(backendTask.id);
                 for (const eventId of hydration.synchronizedEventIds) {
                     const entry = entries.find((value) => value.journalRef?.eventId === eventId);
                     if (entry) {
@@ -337,7 +337,7 @@ export class BridgeService {
                     }
                 }
                 localJournal = await this.dependencies.journal.load(projectId, taskSlug);
-                pendingOutbox = await this.dependencies.outbox.list();
+                pendingOutbox = await this.dependencies.outbox.listForTask(backendTask.id);
                 hydratedFromBackend = !hadLocalProjection;
                 mergedFromBackend = hadLocalProjection;
             }
@@ -437,10 +437,12 @@ export class BridgeService {
     async contextPrepareChange(input) {
         return await this.execute(async () => {
             const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
-            await this.recoverJournalOutbox();
-            const outbox = await this.flushOutbox();
-            const pendingOutbox = await this.dependencies.outbox.list();
             const pointer = await this.dependencies.activeContexts.loadForSession(repository.repoFingerprint, input.sessionId);
+            if (!pointer)
+                throw refuse('Resume this task before requesting a change lease.', 'session.resume');
+            await this.recoverJournalOutbox(pointer.projectId, pointer.taskSlug);
+            const outbox = await this.flushOutbox(pointer.taskId);
+            const pendingOutbox = await this.dependencies.outbox.listForTask(pointer.taskId);
             if (pointer?.verificationIntent || pointer?.closeIntent) {
                 throw refuse('A verification or close intent from an earlier session is still unsettled, so a new lease would be taken against the wrong state.', 'session.resume');
             }
@@ -992,8 +994,9 @@ export class BridgeService {
         return await this.execute(async () => {
             return await this.taskExclusive(input.taskId, async () => {
                 await this.recoverJournalOutbox();
-                const outbox = await this.flushOutbox();
-                const pendingOutboxCount = (await this.dependencies.outbox.list()).length;
+                const outbox = await this.flushOutbox(input.taskId);
+                const pendingOutboxCount = (await this.dependencies.outbox.listForTask(input.taskId))
+                    .length;
                 const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
                 if (pendingOutboxCount > 0) {
                     return asJsonValue({
@@ -1359,6 +1362,7 @@ export class BridgeService {
                 projectSlug: input.projectSlug ?? slugify(input.projectName),
                 repoFingerprint: repository.repoFingerprint,
                 framework: input.framework,
+                developmentArea: input.developmentArea,
                 figmaConfig: input.figmaConfig,
                 initialProjectProfile: input.initialProjectProfile,
             });
@@ -2085,11 +2089,17 @@ export class BridgeService {
             return asJsonValue({ queued: true, outboxId: queued.id, idempotencyKey });
         }
     }
-    async flushOutbox() {
-        const entries = await this.dependencies.outbox.list();
+    async flushOutbox(taskId) {
+        const entries = taskId
+            ? await this.dependencies.outbox.listForTask(taskId)
+            : await this.dependencies.outbox.list();
         const synchronized = [];
         const blocked = [];
+        const blockedTasks = new Set();
         for (const entry of entries) {
+            const deliveryTaskId = taskIdFromDeliverySafe(entry);
+            if (blockedTasks.has(deliveryTaskId))
+                continue;
             try {
                 const response = await this.dependencies.client.request(entry.path, {
                     method: entry.method,
@@ -2115,7 +2125,7 @@ export class BridgeService {
                     await this.dependencies.journal.markDeliveryAttempt(entry.journalRef.projectId, entry.journalRef.taskSlug, entry.journalRef.eventId, errorKind);
                 }
                 blocked.push({ id: entry.id, error: errorKind });
-                break;
+                blockedTasks.add(deliveryTaskId);
             }
         }
         return asJsonValue({

package/runtime/dist/src/runtime/offline-outbox.js

@@ -81,6 +81,12 @@ export class OfflineOutbox {
         }));
         return values.filter((entry) => entry !== null).sort(compareEntries);
     }
+    async listForTask(taskId) {
+        return (await this.list()).filter((entry) => {
+            const body = entry.body;
+            return (body !== null && typeof body === 'object' && !Array.isArray(body) && body.taskId === taskId);
+        });
+    }
     async markAttempt(id, errorKind) {
         await this.exclusive(id, async () => {
             const path = this.pathFor(id);

package/skill/references/lifecycle.md

@@ -184,4 +184,4 @@ When a pull request has been opened, keep going: check whether it merges cleanly
 
 ## Offline Behavior
 
-An unexpired cached context pack may be used for implementation. The bridge records checkpoints in its outbox. Permanent proposal review, strict verification, task close, and Git commit remain blocked until the backend is reachable and the outbox is synchronized.
+An unexpired cached context pack may be used for implementation. The bridge records checkpoints in its outbox. Permanent proposal review, strict verification, task close, and Git commit require the backend and synchronization of the relevant task deliveries. An unrelated task or repository queue does not block this task; account switching and logout still require all deliveries to be resolved. Commit receipts are retained per task and worktree and still require an online attestation for the selected closed task and exact staged content.