engineering-memory 1.10.1 → 1.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/project/repository.js

@@ -59,19 +59,24 @@ export class RepositoryResolver {
             projectId: explicitProjectId ?? binding?.projectId ?? null,
             schemaVersion: binding?.schemaVersion ?? null,
             repoFingerprint,
+            legacyFingerprints: binding ? [] : [await this.git.fingerprint(repoRoot, 1)],
             git,
         };
     }
-    async writeBinding(repoRoot, projectId) {
+    async writeBinding(repoRoot, projectId, fingerprint) {
         assertProjectId(projectId);
         const repository = await this.resolve(repoRoot, projectId);
+        const older = repository.legacyFingerprints.includes(fingerprint);
+        if (fingerprint !== repository.repoFingerprint && !older) {
+            throw new Error('The confirmed project fingerprint does not identify this repository');
+        }
         const repositoryKey = await this.keyFor(repository.repoRoot);
         const bindingPath = this.pathFor(repositoryKey);
         await writeJson(bindingPath, {
             projectId,
-            schemaVersion: repository.schemaVersion ?? this.markerSchemaVersion,
+            schemaVersion: older ? 1 : (repository.schemaVersion ?? this.markerSchemaVersion),
             repositoryKey,
-            repoFingerprint: repository.repoFingerprint,
+            repoFingerprint: fingerprint,
         }, this.stateRoot);
         return bindingPath;
     }

package/runtime/dist/src/runtime/bridge-service.js

@@ -70,7 +70,10 @@ export class BridgeService {
             if (!repository.bindingPath) {
                 const resolved = await this.dependencies.client.request(endpoints.projectResolve, {
                     method: 'POST',
-                    body: { repoFingerprint: repository.repoFingerprint },
+                    body: {
+                        repoFingerprint: repository.repoFingerprint,
+                        legacyFingerprints: repository.legacyFingerprints,
+                    },
                 });
                 const project = objectValue(resolved.data);
                 const restoreRequired = Boolean(project?.archivedAt);
@@ -1361,6 +1364,7 @@ export class BridgeService {
                 projectName: input.projectName,
                 projectSlug: input.projectSlug ?? slugify(input.projectName),
                 repoFingerprint: repository.repoFingerprint,
+                legacyFingerprints: repository.legacyFingerprints,
                 framework: input.framework,
                 developmentArea: input.developmentArea,
                 figmaConfig: input.figmaConfig,
@@ -1384,6 +1388,7 @@ export class BridgeService {
             const marker = objectValue(data?.marker);
             if (!project ||
                 typeof project.id !== 'string' ||
+                typeof project.repoFingerprint !== 'string' ||
                 !profileResource ||
                 !profileRevision ||
                 !policy ||
@@ -1392,7 +1397,7 @@ export class BridgeService {
                 readDiscoveryUnits(policy).length === 0) {
                 throw refuse('Project setup response is not policy-ready', 'project.setup');
             }
-            const bindingPath = await this.dependencies.repositories.writeBinding(repository.repoRoot, project.id);
+            const bindingPath = await this.dependencies.repositories.writeBinding(repository.repoRoot, project.id, project.repoFingerprint);
             return asJsonValue({ ...data, marker: null, markerPath: null, bindingPath });
         });
     }
@@ -1689,13 +1694,18 @@ export class BridgeService {
                 }
                 const response = await this.dependencies.client.request(endpoints.projectBind(input.projectId), {
                     method: 'POST',
-                    body: { repoFingerprint: repository.repoFingerprint },
+                    body: {
+                        repoFingerprint: repository.repoFingerprint,
+                        legacyFingerprints: repository.legacyFingerprints,
+                    },
                 });
                 const project = objectValue(response.data);
-                if (!project || project.id !== input.projectId) {
+                if (!project ||
+                    project.id !== input.projectId ||
+                    typeof project.repoFingerprint !== 'string') {
                     throw refuse('Project bind response does not match the selected project', 'project.resolve');
                 }
-                const bindingPath = await this.dependencies.repositories.writeBinding(repository.repoRoot, input.projectId);
+                const bindingPath = await this.dependencies.repositories.writeBinding(repository.repoRoot, input.projectId, project.repoFingerprint);
                 return asJsonValue({
                     resolved: true,
                     bound: true,
@@ -1708,7 +1718,10 @@ export class BridgeService {
             }
             const response = await this.dependencies.client.request(endpoints.projectResolve, {
                 method: 'POST',
-                body: { repoFingerprint: repository.repoFingerprint },
+                body: {
+                    repoFingerprint: repository.repoFingerprint,
+                    legacyFingerprints: repository.legacyFingerprints,
+                },
             });
             const project = objectValue(response.data);
             const restoreRequired = Boolean(project?.archivedAt);

package/skill/references/lifecycle.md

@@ -4,7 +4,7 @@
 
 Sign-in decides nothing beyond who the user is. The organization and the project are chosen after it, through the questionnaires in `questionnaires.md`, and both listings end with an option to create a new one. Ask for both whenever this session has not already confirmed them, and ask again the moment the user says they want to change either — changing the organization always means choosing the project again.
 
-Use the binding returned by `session.entry` as the authority. The bridge stores the selected project and repository identity under `~/.engineering-memory/origins/<api-hash>/project-bindings/`, outside the installed runtime and working tree. It imports a legacy `.engineering-memory/project.json` once, preserving its schema and exact backend fingerprint for existing tasks and receipts. It leaves that file unchanged; after migration the file is optional and may be removed through the repository's normal Git workflow. New bindings never create it. Never infer a selection from a directory or remote, and never edit binding records by hand. Separate clones or a changed remote require a new explicit selection; worktrees of the same checkout share the local binding.
+Use the binding returned by `session.entry` as the authority. The bridge stores the selected project and repository identity under `~/.engineering-memory/origins/<api-hash>/project-bindings/`, outside the installed runtime and working tree. It imports a legacy `.engineering-memory/project.json` once, preserving its schema and exact backend fingerprint for existing tasks and receipts. It leaves that file unchanged; after migration the file is optional and may be removed through the repository's normal Git workflow. New bindings never create it. A checkout that never imported the marker still finds a project bound under the older identity: the bridge presents that identity alongside the current one and stores whichever the backend confirms. Never infer a selection from a directory or remote, and never edit binding records by hand. Separate clones or a changed remote require a new explicit selection; worktrees of the same checkout share the local binding.
 
 An archived project is recoverable state, not a missing or conflicting binding. When an owner receives `project.restore`, use the `projectId` and `expectedVersion` in its data and call that operation before retrying. A non-owner receives `project.member_list` instead: list the members, identify a project owner and explain that the owner must restore the exact project before this session can retry. Use `project.list` with `includeArchived: true` when an owner must first select the archived project. Never create or bind a replacement project to escape archive state.