engineering-memory 1.11.10 → 1.11.12

package/dispatcher/sections.mjs

@@ -2,12 +2,13 @@ const shared = `This section is managed by the Engineering Memory installer.
 
 Repository bindings live in the user-level Engineering Memory state directory, not in the working tree. Do not require or create a repository settings file. Always discover the binding with \`session.entry\`; the absence of \`.engineering-memory/project.json\` does not mean the repository is unbound.
 
-Call \`session.entry\` before you answer anything in a repository, whatever the user asked for. It reports whether they are signed in, whether this repository is bound, what they decided about it last time, and the one thing to do now. Act on that before the message itself:
+Call \`session.entry\` before you answer anything in a repository, whatever the user asked for. It reports whether they are signed in, whether this repository is bound, what they decided about it last time, and the one thing to do now. Pass \`language\` on that call and on every tool that opens a form: the BCP-47 tag of the language the user is writing in, such as tr, en or pt-BR. It is remembered, so forms keep opening in that language. Act on what \`session.entry\` reports before the message itself:
 
 - Not signed in: ask them to sign in and start the browser flow when they agree. Nothing about the project can be answered until that resolves.
 - No decision recorded: ask which organization and then which project, whatever the message was. The other answer is switching Engineering Memory off in this repository, and it is remembered with \`session.set_decision\`.
 - Switched off: say nothing about Engineering Memory, offer nothing, hint at nothing, however useful it would be for what was asked. They turned it off; raising it again is what this prevents. Record it back on only when they ask.
 - Bound: continue into the lifecycle.
+- Project lives elsewhere: binding the chosen project is refused because its code moved to another repository, or \`session.entry\` reports the project moved away from this checkout. Follow the skill's lifecycle reference: a project owner moves the project here with \`project.move_repository\`, anyone else is told that an owner has to. Never create a second project for moved code and never bind a different one to get past the refusal.
 
 \`session.entry\` also reports this client's version. When it says an update is available, offer once to run \`npx engineering-memory@latest install\` and tell the user that the running bridge switches to the new release by itself on its next call, so nothing needs restarting; only a bridge older than 1.11.9 needs the client restarted once after that install. If they decline, record it with \`session.decline_update\` and never raise that version again. When it says an update is required, there is no choice to offer: say that this client is older than the backend supports, give the command, and do not carry on as though the lifecycle works.
 
@@ -27,7 +28,7 @@ Do not block independent task work on \`memory.propose_revision\` drafting, subm
 
 A check whose answer decides the next action — delivery preconditions such as the commit hook, the remote and the branch; whether verification or close can pass; what a waiver allows — is run by the agent that takes that action, in its own turn. Hand work to another agent only when you have other real work to do while it runs, and never take the action a delegated check gates before its answer is back. Work another agent checked is neither the user's approval nor task verification. Size delegation to the task — a one- or two-file change needs no multi-agent workflow — and once work is delegated, wait for its real completion signal, never a sleep loop polling its output.
 
-Use the host's native questionnaire for every question to the user, including implementation choices, names, clarification, branch/worktree decisions and delivery. For a required decision, use \`questionnaire.ask\` to open a durable native MCP form and \`questionnaire.resume\` to return to the same unanswered question. Read the skill's questionnaires reference first. Never use request_user_input_async for a required decision: it does not wait for an answer. When the durable form is unavailable, use a blocking native control only where the host permits it: request_user_input in Codex or AskUserQuestion in Claude. Never replace the questionnaire with a chat instruction such as 'type this', 'reply yes', or 'write X if you want Y'. Do not open a survey web page. If the required native control is unavailable or prohibited for that kind of question, follow the host's tool restrictions, explain the limitation, and continue only work already authorized; do not fabricate a survey or silently choose an answer. A timeout, dismissed form, empty response or ended turn is not an answer. Keep the decision pending and resume it; do not start dependent work or report it as resolved. Existing answers remain valid through retries and handoffs.
+Use the host's native questionnaire for every question to the user, including implementation choices, names, clarification, branch/worktree decisions and delivery. For a required decision, use \`questionnaire.ask\` to open a durable native MCP form and \`questionnaire.resume\` to return to the same unanswered question. Read the skill's questionnaires reference first. Write every question in the user's language, say in \`context\` why it is asked, give in \`example\` one concrete thing the decision changes, and give every option a \`description\` of what happens next. Show a record by its title, never by an id or a hash. When the user says they did not understand, that is not an answer: explain in chat and show the same question again. Never use request_user_input_async for a required decision: it does not wait for an answer. When the durable form is unavailable, use a blocking native control only where the host permits it: request_user_input in Codex or AskUserQuestion in Claude. Never replace the questionnaire with a chat instruction such as 'type this', 'reply yes', or 'write X if you want Y'. Do not open a survey web page. If the required native control is unavailable or prohibited for that kind of question, follow the host's tool restrictions, explain the limitation, and continue only work already authorized; do not fabricate a survey or silently choose an answer. A timeout, dismissed form, empty response or ended turn is not an answer. Keep the decision pending and resume it; do not start dependent work or report it as resolved. Existing answers remain valid through retries and handoffs.
 
 When a durable MCP form cannot be displayed, read its \`hostFallback\` or call \`questionnaire.resume\` with \`presentation: host_native\` to get the original question without reopening the MCP form. Display the same question, all choices and notices through a blocking native control only if the host permits that control for this decision. After an actual native answer, call \`questionnaire.answer_from_host\` with the unchanged questionnaireId, requestKey and contentHash, the hostTool name and the returned choice/text. This is an agent-reported relay, not MCP transport attestation. Then retry the owning operation; its authority, content and version checks still apply. Never relay prose consent, a default, an asynchronous response or a cancelled/declined/missing answer. Decline alone is not proof that the host cannot display forms. Keep the decision pending if no permitted native control can represent it.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.10",
+  "version": "1.11.12",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/build.json

@@ -1,3 +1,3 @@
 {
-  "gitHead": "875304dd11735e1bf2817ae59e75b54186e5071a"
+  "gitHead": "de721a5d678590e09a9f1085f8f3b976a1791b35"
 }

package/runtime/dist/src/config.js

@@ -67,6 +67,7 @@ export const endpoints = {
     projectList: '/projects',
     projectResolve: '/projects/resolve',
     projectBind: (projectId) => `/projects/${projectId}/bind`,
+    projectRepository: (projectId) => `/projects/${projectId}/repository`,
     projectUpdate: (projectId) => `/projects/${projectId}`,
     workItemRuns: (projectId, workItemId) => `/projects/${projectId}/work-items/${workItemId}/runs`,
     workItemRestore: (projectId, workItemId) => `/projects/${projectId}/work-items/${workItemId}/restore`,

package/runtime/dist/src/git/git-inspector.js

@@ -4,6 +4,7 @@ import { isAbsolute, relative, resolve, sep } from 'node:path';
 import { assertManagedPath, canonicalPath } from '../utilities/files.js';
 import { sha256, stableStringify } from '../utilities/hash.js';
 import { NativeCommandRunner } from '../utilities/process.js';
+import { restrictedValueKind } from '../runtime/privacy-detector.js';
 import { TaskBranchStore } from '../runtime/task-branch-store.js';
 export const temporaryScaffoldingMarker = 'ENGINEERING-MEMORY-TEMPORARY';
 export const temporaryScaffoldingPattern = `${temporaryScaffoldingMarker}:`;
@@ -35,6 +36,18 @@ export class GitInspector {
         }
         return sha256(identity);
     }
+    async remoteIdentity(repoRoot) {
+        const remote = await this.gitValue(repoRoot, ['config', '--get', 'remote.origin.url']);
+        if (!remote)
+            return null;
+        const identity = canonicalRemoteIdentity(remote);
+        return !identity.startsWith('local/') &&
+            identity.length <= 500 &&
+            /^[a-z0-9][a-z0-9.-]*(:\d{1,5})?\/[^\s@\\]+$/.test(identity) &&
+            !restrictedValueKind(identity, 'remoteIdentity')
+            ? identity
+            : null;
+    }
     branchStore(repoRoot) {
         return new TaskBranchStore(repoRoot, this.runner);
     }
@@ -72,11 +85,13 @@ export class GitInspector {
             throw new Error('The worktree directory already belongs to another repository or branch. Choose a different directory');
         }
         const exists = await this.branchExists(repoRoot, name);
+        const lost = (await this.lostRegistration(repoRoot, path, name)) ? ['-f'] : [];
         const args = exists
-            ? ['worktree', 'add', '--', path, name]
+            ? ['worktree', 'add', ...lost, '--', path, name]
             : [
                 'worktree',
                 'add',
+                ...lost,
                 '--no-track',
                 '-b',
                 name,
@@ -89,6 +104,22 @@ export class GitInspector {
             throw new Error(`Git could not create the worktree: ${result.stderr.trim()}`);
         return await this.findRoot(path);
     }
+    async lostRegistration(repoRoot, path, name) {
+        const listed = await this.runner.run('git', ['worktree', 'list', '--porcelain'], {
+            cwd: repoRoot,
+        });
+        if (listed.exitCode !== 0)
+            return false;
+        const registered = listed.stdout.split(/\r?\n\r?\n/).map((block) => ({
+            path: /^worktree (.+)$/m.exec(block)?.[1] ?? '',
+            branch: /^branch refs\/heads\/(.+)$/m.exec(block)?.[1] ?? null,
+        }));
+        const same = (left, right) => process.platform === 'win32'
+            ? resolve(left).toLowerCase() === resolve(right).toLowerCase()
+            : resolve(left) === resolve(right);
+        return (registered.some((entry) => entry.path && same(entry.path, path)) &&
+            !registered.some((entry) => entry.branch === name && !same(entry.path, path)));
+    }
     async fetchBranchCommit(repoRoot, remote, branch) {
         await this.validateBranch(repoRoot, branch);
         if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/.test(remote))