engineering-memory 1.11.3 → 1.11.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.3",
+  "version": "1.11.4",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/mcp/tool-definitions.js

@@ -542,7 +542,7 @@ export function registerEngineeringMemoryTools(server, service) {
         }),
     }, async (input) => toolResult(await service.organizationCreate(input)));
     server.registerTool('organization.member_list', {
-        description: "List an organization's members and roles so a member who cannot perform an owner-only recovery can coordinate with an owner.",
+        description: 'List opaque member identifiers and roles. Contact details are omitted; explain required authority by role without identifying a person.',
         inputSchema: z.object({ organizationId: z.string().uuid() }),
     }, async (input) => toolResult(await service.organizationMemberList(input)));
     server.registerTool('organization.member_upsert', {
@@ -683,7 +683,7 @@ export function registerEngineeringMemoryTools(server, service) {
         }),
     }, async (input) => toolResult(await service.projectMemberAdd(input)));
     server.registerTool('project.member_list', {
-        description: 'List the members and roles of a project, including an archived project, so an action that requires an owner can be coordinated with the right person.',
+        description: 'List stored project member identifiers and roles without contact details. Organization administrators inherit contributor access without a stored grant. Explain access recovery by role, not by personal identity.',
         inputSchema: z.object({ projectId: z.string().uuid() }),
     }, async (input) => toolResult(await service.projectMemberList(input)));
     const workItemLocator = { projectId: z.string().uuid(), workItemId: z.string().uuid() };

package/runtime/dist/src/runtime/bridge-service.js

@@ -1866,13 +1866,15 @@ export class BridgeService {
                     ...(input.discipline !== undefined ? { discipline: input.discipline } : {}),
                 }),
             });
-            return asJsonValue({ membership: response.data });
+            return asJsonValue({ membership: publicMembership(response.data) });
         });
     }
     async projectMemberList(input) {
         return await this.execute(async () => {
             const response = await this.dependencies.client.request(endpoints.projectMemberList(input.projectId));
-            return asJsonValue({ members: response.data });
+            return asJsonValue({
+                members: Array.isArray(response.data) ? response.data.map(publicMembership) : [],
+            });
         });
     }
     async auditList(input) {
@@ -1904,13 +1906,15 @@ export class BridgeService {
                     discipline: input.discipline,
                 }),
             });
-            return asJsonValue({ membership: response.data });
+            return asJsonValue({ membership: publicMembership(response.data) });
         });
     }
     async organizationMemberList(input) {
         return await this.execute(async () => {
             const response = await this.dependencies.client.request(endpoints.organizationMemberList(input.organizationId));
-            return asJsonValue({ members: response.data });
+            return asJsonValue({
+                members: Array.isArray(response.data) ? response.data.map(publicMembership) : [],
+            });
         });
     }
     async organizationList() {
@@ -3737,4 +3741,26 @@ function sourceFromContext(value) {
         ...(linked ? { linked } : {}),
     };
 }
+function publicMembership(value) {
+    const membership = objectValue(value);
+    if (!membership)
+        return {};
+    const result = {};
+    for (const key of [
+        'id',
+        'organizationId',
+        'projectId',
+        'userId',
+        'role',
+        'discipline',
+        'administrativeRole',
+        'createdAt',
+        'updatedAt',
+    ]) {
+        const field = membership[key];
+        if (typeof field === 'string' || field === null)
+            result[key] = field;
+    }
+    return result;
+}
 //# sourceMappingURL=bridge-service.js.map

package/skill/references/lifecycle.md

@@ -6,7 +6,7 @@ Sign-in decides nothing beyond who the user is. The organization and the project
 
 Use the binding returned by `session.entry` as the authority. The bridge stores the selected project and repository identity under `~/.engineering-memory/origins/<api-hash>/project-bindings/`, outside the installed runtime and working tree. It imports a legacy `.engineering-memory/project.json` once, preserving its schema and exact backend fingerprint for existing tasks and receipts. It leaves that file unchanged; after migration the file is optional and may be removed through the repository's normal Git workflow. New bindings never create it. A checkout that never imported the marker still finds a project bound under the older identity: the bridge presents that identity alongside the current one and stores whichever the backend confirms. Never infer a selection from a directory or remote, and never edit binding records by hand. Separate clones or a changed remote require a new explicit selection; worktrees of the same checkout share the local binding.
 
-An archived project is recoverable state, not a missing or conflicting binding. When an owner receives `project.restore`, use the `projectId` and `expectedVersion` in its data and call that operation before retrying. A non-owner receives `project.member_list` instead: list the members, identify a project owner and explain that the owner must restore the exact project before this session can retry. Use `project.list` with `includeArchived: true` when an owner must first select the archived project. Never create or bind a replacement project to escape archive state.
+An archived project is recoverable state, not a missing or conflicting binding. When an owner receives `project.restore`, use the `projectId` and `expectedVersion` in its data and call that operation before retrying. A non-owner receives `project.member_list` instead: check the available roles and explain that project-owner authority is required to restore this exact project before retrying. Do not name a person or disclose contact details. Use `project.list` with `includeArchived: true` when an owner must first select the archived project. Never create or bind a replacement project to escape archive state.
 
 For a bound repository, call `session.bootstrap` before producing a plan or changing files. Supply the current repository root, project ID, task ID or stable local task slug, objective, task kind, task mode, and current Git diff hash. Use `read_only` for review, diagnosis, planning, or reporting without write authority; use `scaffold` when the task applies organization architecture templates to a new project; use `write` when the request authorizes repository changes. The bridge records the read-only Git diff hash as the immutable task baseline, including a pre-existing dirty worktree. Use the returned task ID, task version, context session ID, pinned revisions, project profile, engineering rules, prior task documents, quality gates, and current deviations.
 
@@ -57,7 +57,7 @@ Open each side with the same workItemId and its own repository binding when work
 
 ### Administration, product management and QA
 
-Administrative authority and work discipline are independent. Organization admins can manage projects, assignments, repository URLs and work items in their organization. A global admin has those rights only in organizations they actively belong to. Ordinary users need a live explicit project assignment. Fullstack/backend/web/mobile/frontend disciplines govern implementation, while project overrides do not grant administration.
+Administrative authority and work discipline are independent. Organization admins can manage projects, assignments, repository URLs and work items in their organization. A global admin has those rights only in organizations they actively belong to. Ordinary users need a live explicit project assignment. Active organization administrators, including a global admin with live membership in that organization, inherit contributor access to its projects without a separate project grant. Fullstack/backend/web/mobile/frontend disciplines still govern implementation, while project overrides do not grant administration.
 
 An assigned product manager can create, edit, assign, archive and restore work items through the work_item tools. Designer work includes design context and requirement participation; it does not grant general application code leases. A tester can create an unassigned bug and record `work_item.record_test` evidence, then track it with `work_item.test_results`. QA evidence must contain no credentials, PII or production payloads and must identify the exact requirement version. A passed result never silently marks the requirement done. Organization administration separately permits backlog management regardless of discipline.
 

package/skill/references/questionnaires.md

@@ -48,7 +48,7 @@ A new organization is not empty. It reads the product engineering core immediate
 
 Once the organization is chosen, call `project.list` and offer that organization's projects, with **create a new project** last. Ignore projects belonging to other organizations; a listing that mixes them is how work lands in the wrong place. Creating one follows the unbound-repository flow below.
 
-The normal list omits archived projects. If repository entry, setup, binding or task open reports `project.restore`, use the project id and expected version returned with that refusal and restore it before continuing. If it reports `project.member_list`, the current member cannot restore the project: call that operation, identify the project owners in its result and tell the user which owner must perform the versioned restore. If an owner does not yet have the project id and expected version, call `project.list` with `includeArchived: true` and let them select the archived project. Archive state never authorizes creating a duplicate project.
+The normal list omits archived projects. If repository entry, setup, binding or task open reports `project.restore`, use the project id and expected version returned with that refusal and restore it before continuing. If it reports `project.member_list`, the current member cannot restore the project: call that operation to check the available roles and explain that the versioned restore requires project-owner authority. Do not identify a person, reconstruct an identity from an account identifier or disclose contact details. If an owner does not yet have the project id and expected version, call `project.list` with `includeArchived: true` and let them select the archived project. Archive state never authorizes creating a duplicate project.
 
 Ask both questions again whenever a chat starts in a repository whose binding you have not confirmed in this session.
 
@@ -99,6 +99,8 @@ fail, and raw secrets, headers, customer payloads and PII are excluded.
 
 ## Project Membership
 
+Member tools expose opaque account identifiers and roles, not names or email addresses. Do not reconstruct a person's identity, search for their contact details, or repeat personal data when explaining an access refusal. Describe the required role and the current caller's available operation. Use a user-supplied account address only for the membership operation they explicitly requested; do not echo it into routine explanations, task memory or questionnaires. Organization administrators already inherit contributor access within their organization; do not offer to add them to every project to fix development access. Work discipline and live organization membership still apply.
+
 Ask for the registered email and intended role. Show owner, maintainer, member, and reader effects. Confirm before calling `project.member_add`. A project grant is valid only while the same account belongs to the parent organization. If the call reports `organization.member_upsert`, do not retry the project write: an organization owner must first confirm the organization role and discipline and call that recovery. When the current account is not an organization owner, explain that coordination requirement instead of pretending the project grant succeeded. Retry `project.member_add` only after the parent grant exists.
 
 ## Branch