memgineering 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -11,6 +11,28 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.17.0] — 2026-08-30
+
+### Added
+
+- **One sign-in, both halves.** `memgineering login` now links your registry
+  account automatically — same Google account, no extra step — and stores a
+  registry session next to the brain token. `memgineering whoami` shows both
+  identities (brain name and registry username); `memgineering logout` ends
+  both. If the registry half is ever unreachable during login, the brain
+  sign-in still completes and whoami says how to link later.
+- **Approving a login is one click now.** The browser approval screen keys off
+  your memgineering.com sign-in: signed in, you see who is asking and press
+  승인 — no separate Google round trip. Signed out, the same page signs you in
+  first (Google in a popup) and then asks. Consent is requested exactly once,
+  when an account is first created.
+
+### Agent guidance
+
+- `memgineering-setup` explains the unified sign-in: one login carries brain
+  and registry credentials together, and `whoami` reports both. Restart agent
+  sessions after upgrading so the refreshed guidance loads.
+
 ## [0.16.0] — 2026-08-30
 
 ### Added

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.16.0
+version: 0.17.0
 ---
 
 # memgineering

package/assets/memgineering-setup/SKILL.md

@@ -45,6 +45,18 @@ opening nothing. Show the user the code — they approve it in their browser whi
 you keep working, and the next command picks the token up. Nothing exists on the
 server until they approve.
 
+**One sign-in covers both halves (0.17.0+).** The approval also links the
+user's registry account (same Google account, automatic), so the claim stores a
+registry session next to the brain token. `memgineering whoami` reports both —
+the brain identity and a `registry:` line with the username. If the registry
+line says "not linked", the link simply did not happen at sign-in time (older
+server, registry briefly down); a fresh `logout` + `login` links it. Never
+treat a missing registry line as a failed brain sign-in — the brain token
+stands on its own. On the approval page itself, a user already signed in to
+memgineering.com approves with one click; a signed-out user signs in right
+there first (Google in a popup). Consent is asked exactly once, when an
+account is first created.
+
 `--no-login` is how someone says "this machine only". Offer it, do not assume it:
 a brain that lives in a folder here cannot follow them to their phone or their
 next laptop, and that is discovered weeks later, by which time the notes are in

package/dist/index.js

@@ -4074,6 +4074,11 @@ var init_src = __esm({
 import { mkdir as mkdir3, readFile as readFile3, unlink, writeFile as writeFile2 } from "fs/promises";
 import { join as join5 } from "path";
 import { z as z6 } from "zod";
+function registryFromClaim(raw) {
+  const parsed = RegistryCredentialsSchema.omit({ linked_at: true }).safeParse(raw);
+  if (!parsed.success) return void 0;
+  return { ...parsed.data, linked_at: (/* @__PURE__ */ new Date()).toISOString() };
+}
 function credentialsPath() {
   return join5(brandHome(), "credentials.json");
 }
@@ -4098,18 +4103,33 @@ async function saveCredentials(credentials) {
 async function clearCredentials() {
   await unlink(credentialsPath()).catch(() => void 0);
 }
-var CredentialsSchema;
+var RegistryCredentialsSchema, CredentialsSchema;
 var init_credentials = __esm({
   "src/lib/credentials.ts"() {
     "use strict";
     init_brand();
+    RegistryCredentialsSchema = z6.object({
+      api_url: z6.string().min(1),
+      refresh_token: z6.string().min(1),
+      session_id: z6.string().min(1),
+      username: z6.string().min(1),
+      user_id: z6.string().min(1),
+      linked_at: z6.string().min(1)
+    });
     CredentialsSchema = z6.object({
       /** The server that issued this token. Compared before the token is ever sent. */
       api_url: z6.string().min(1),
       token: z6.string().min(1),
       account_id: z6.string().min(1),
       display_name: z6.string().nullable().default(null),
-      signed_in_at: z6.string().min(1)
+      signed_in_at: z6.string().min(1),
+      /**
+       * Absent on pre-federation files and after an old CLI resaves this file
+       * (strip mode drops keys it does not know). `catch` matters more than
+       * `optional`: a mangled registry block must degrade to "not linked", never
+       * to "not signed in" — the brain token above is still perfectly good.
+       */
+      registry: RegistryCredentialsSchema.optional().catch(void 0)
     });
   }
 });
@@ -4322,12 +4342,14 @@ async function claimOnce(pending, baseUrl = apiUrl()) {
     );
   }
   const me = await apiRequest({ method: "GET", path: "/v1/me", token, baseUrl });
+  const registry = registryFromClaim(res.body?.registry);
   const credentials = {
     api_url: baseUrl,
     token,
     account_id: me.body?.account?.id ?? "",
     display_name: me.body?.account?.display_name ?? null,
-    signed_in_at: (/* @__PURE__ */ new Date()).toISOString()
+    signed_in_at: (/* @__PURE__ */ new Date()).toISOString(),
+    ...registry !== void 0 ? { registry } : {}
   };
   await saveCredentials(credentials);
   await clearPendingLogin();
@@ -6152,7 +6174,8 @@ async function waitForApproval(pending, base) {
         json: {
           signed_in: true,
           account: { id: claimed.account_id, display_name: claimed.display_name },
-          api_url: base
+          api_url: base,
+          registry: claimed.registry ? { username: claimed.registry.username, api_url: claimed.registry.api_url } : null
         },
         human: () => {
           printHuman(
@@ -6160,6 +6183,13 @@ async function waitForApproval(pending, base) {
 Signed in${claimed.display_name ? ` as ${c.bold(oneLine(claimed.display_name, WIDTH.title))}` : ""}.`
           );
           printHuman(c.gray("  The token is stored on this machine only, readable by you alone."));
+          if (claimed.registry) {
+            printHuman(
+              c.gray(
+                `  Registry linked: ${oneLine(claimed.registry.username, WIDTH.handle)} \u2014 one sign-in, both halves.`
+              )
+            );
+          }
         }
       });
       return;
@@ -15702,10 +15732,12 @@ function logoutCommand() {
         }) : err;
       }
     }
+    const registryRevoked = await revokeRegistrySession(credentials.registry);
     await clearCredentials();
     printDual({
       json: {
         signed_out: true,
+        registry: credentials.registry === void 0 ? "not-linked" : registryRevoked ? "revoked" : "revoke-failed-expires-on-its-own",
         revoked_on_server: true,
         revoked,
         all: opts.all === true,
@@ -15727,6 +15759,28 @@ function logoutCommand() {
     });
   });
 }
+async function revokeRegistrySession(reg) {
+  if (!reg) return false;
+  try {
+    const refreshed = await fetch(`${reg.api_url}/auth/sessions/refresh`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: reg.refresh_token }),
+      signal: AbortSignal.timeout(3e3)
+    });
+    if (!refreshed.ok) return false;
+    const pair = await refreshed.json();
+    if (typeof pair.access_token !== "string" || typeof pair.session_id !== "string") return false;
+    const del = await fetch(`${reg.api_url}/auth/sessions/${pair.session_id}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${pair.access_token}` },
+      signal: AbortSignal.timeout(3e3)
+    });
+    return del.ok;
+  } catch {
+    return false;
+  }
+}
 
 // src/commands/onboard.ts
 init_src();
@@ -18092,7 +18146,12 @@ function whoamiCommand() {
         },
         tokens: { live },
         api_url: base,
-        signed_in_at: credentials.signed_in_at
+        signed_in_at: credentials.signed_in_at,
+        registry: credentials.registry ? {
+          username: credentials.registry.username,
+          api_url: credentials.registry.api_url,
+          linked_at: credentials.registry.linked_at
+        } : null
       },
       human: () => {
         printHuman(
@@ -18102,6 +18161,19 @@ function whoamiCommand() {
         );
         if (account.email) printHuman(c.gray(`  ${oneLine(account.email, WIDTH.title)}`));
         printHuman(c.gray(`  on ${base}`));
+        if (credentials.registry) {
+          printHuman(
+            c.gray(
+              `  registry: ${oneLine(credentials.registry.username, WIDTH.handle)} on ${credentials.registry.api_url}`
+            )
+          );
+        } else {
+          printHuman(
+            c.gray(
+              "  registry: not linked \u2014 sign in again (`memgineering logout`, then `login`) to link it."
+            )
+          );
+        }
         if (live !== null) {
           printHuman(
             c.gray(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memgineering",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "private": false,
   "description": "One memory for the AI you connect. Recall, remember, and revise a brain your agents share \u2014 stored in your own folder.",
   "license": "Apache-2.0",