memgineering 0.25.0 → 0.25.1

package/CHANGELOG.md

@@ -11,6 +11,55 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.25.1] — 2026-10-05
+
+A security release. Upgrade if you use `setup --web`, or a hosted brain with a
+chat-app connector.
+
+### Security
+
+- **`setup --web` no longer switches a machine to another account.** If the
+  setup screen is confirmed by a different account from the one this machine is
+  signed in to, nothing is written and the terminal says why. The setup screen
+  is only told "different account", never who is signed in here.
+- **Notes chosen for upload on the setup screen wait for a check on this
+  machine.** A setup left running in the background uploads nothing. The next
+  command names the folder, the account that would receive it, and the `push`
+  that sends it. That command is quoted, so neither a folder name nor a brain
+  name can run as shell code. A setup in the foreground asks first. A `push` of
+  that folder, or `logout`, clears the notice.
+- **The setup screen can link or upload only a folder this machine offered.**
+  It can create a new local brain only inside the home folder. A relative or
+  `~/` path is read against the home folder and created exactly where it was
+  checked, and symlinks are followed.
+- **`setup --web --json` prints `setup_url` only when no browser opened**, with
+  a hint to use `--print-url` if the browser never appeared. A machine signing
+  in for the first time is told once which account it was connected to.
+- **`login` tells the approval screen when and from what the sign-in came**
+  (`platform`, `client`). Its wording now says that screen asks the person to
+  type the code.
+- **Rules first written through a chat-app connector say so.** `memgineering
+  rules` and the before-edit hook print `(written by the ChatGPT connector)`
+  next to such a rule, and `--json` carries `written_by`. A rule asked for from
+  a chat app is now held as a note until the person promotes it at a terminal.
+  The hold is enforced by the server.
+
+### Fixed
+
+- `revise --rule` with the claim a note already holds makes it a rule. It used
+  to be refused as "already says this", and nothing bound.
+
+### Agent guidance
+
+- `memgineering-setup` explains what the setup link gives whoever holds it, and
+  what happens to an upload chosen on the screen.
+- `memgineering-rules` explains rules held from chat apps. Promoting one binds
+  the note's own text, so read it first with `memgineering open <id> --detail
+  full`; to word it differently, write a new rule with `remember --rule`. It
+  also explains the `written by` label.
+
+Restart the agent session after upgrading so it reads the new guidance.
+
 ## [0.25.0] — 2026-10-04
 
 ### Added

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.25.0
+version: 0.25.1
 ---
 
 # memgineering

package/assets/memgineering-rules/SKILL.md

@@ -69,6 +69,20 @@ A hosted brain answers this too, and `--rule` writes to one land marked. The
 marking lives in the note's own frontmatter either way, so a brain that was
 pushed from a folder keeps every rule it had.
 
+**A rule saved from a chat app waits for the user.** ChatGPT, Claude.ai and
+other connectors can write notes, but not rules: a rule asked for there is
+kept as an ordinary note, and binds only once the user promotes it at a
+terminal. Promoting binds the note's own text as the chat wrote it — `--claim`
+changes the summary, not the words that bind — so they read it first with
+`memgineering open <id> --detail full` (the card alone shows only the title and
+summary, which a chat app may have rewritten), then `memgineering revise <id> --rule --claim "<what
+the note says>"`. Worded differently, it is a new rule: `memgineering remember
+"<the rule>" --rule`. A connector also cannot change or unmark an existing rule. Once
+promoted, the rule says where its words came from — `(written by the ChatGPT
+connector)` beside it in `memgineering rules` and in the before-edit hook, and
+`written_by` in `--json`. Treat it as their rule; the label says which surface
+it was first said on.
+
 **A rule also wins a tie in `recall` now.** Where an ordinary memory and a
 standing decision matched a query equally well, the decision is ranked first —
 the asymmetry being that a missed fact costs the reader some context, while a

package/assets/memgineering-setup/SKILL.md

@@ -66,6 +66,17 @@ Three things to do after running it:
    picks it up on its own when they do. There is nothing to poll and nothing
    to wait for.
 
+The link is the key to that screen, not the code: whoever holds the whole link
+can drive it. Give it only to them, never paste it anywhere else — with
+`--json`, `setup_url` is printed only when no browser opened.
+
+If they chose to upload existing notes on the screen, this machine does NOT
+upload them on its own: the next `memgineering` command shows which folder and
+which account would receive them, with the `push` that sends them. Check with
+them that the account is theirs before running it. And a machine already
+signed in to a different account is never switched by `setup --web` — the
+terminal says so; `logout` first if they really mean to switch.
+
 The screen asks everything `--agent` takes from flags — sign in, where the
 memory lives, which brain, which tools, auto-update, the session hook — with
 the recommended answer pre-selected. A person who is already signed in to

package/dist/index.js

@@ -1341,8 +1341,8 @@ var init_exclude = __esm({
       [...ALWAYS_SKIP_DIRS].map((d) => fold(d))
     );
     ALWAYS_SKIP_SEGMENTS_FOLDED = ALWAYS_SKIP_SEGMENTS.map((s) => fold(s));
-    ALWAYS_SKIP_FILE = (basename3) => {
-      const b = fold(basename3);
+    ALWAYS_SKIP_FILE = (basename4) => {
+      const b = fold(basename4);
       return b.startsWith(".env") || b === ".ds_store" || b === ".memgdeny" || b === ".memgallow" || b === ".memgignore";
     };
     EMPTY_IGNORE_SET = { rules: [], unsupported: [] };
@@ -4030,6 +4030,7 @@ function saysNothingNew(entry, input, normalize) {
   if (norm(claim.text) !== norm(previousClaim(entry))) return false;
   if (claim.summary != null && norm(claim.summary) !== norm(entry.memory.summary)) return false;
   if (claim.title != null && norm(claim.title) !== norm(entry.memory.title)) return false;
+  if (claim.binding != null && claim.binding !== (entry.memory.binding === true)) return false;
   const declared = new Set(
     entry.relations.filter((r) => r.type === "contradicts").map((r) => r.to)
   );
@@ -5137,7 +5138,7 @@ async function apiRequest(args) {
     if (cause.retryable && attempts < MAX_CONNECT_RETRIES) {
       const backoff = args.backoffMs ?? CONNECT_BACKOFF_MS;
       const wait = backoff[Math.min(attempts, backoff.length - 1)] ?? 0;
-      await new Promise((resolve16) => setTimeout(resolve16, wait));
+      await new Promise((resolve17) => setTimeout(resolve17, wait));
       return apiRequest({ ...args, connectRetries: attempts + 1 });
     }
     throw memgError(
@@ -5161,7 +5162,7 @@ async function apiRequest(args) {
   if (res.status === 429 && (args.retries ?? MAX_RATE_LIMIT_RETRIES) > 0) {
     const wait = retryAfterMs(res.headers.get("retry-after"));
     args.onWait?.(wait);
-    await new Promise((resolve16) => setTimeout(resolve16, wait));
+    await new Promise((resolve17) => setTimeout(resolve17, wait));
     return apiRequest({ ...args, retries: (args.retries ?? MAX_RATE_LIMIT_RETRIES) - 1 });
   }
   const envelope = parsed?.error;
@@ -5348,6 +5349,25 @@ function findBrain(cfg, root) {
   const target = resolve(root);
   return cfg.brain.brains.find((b) => resolve(b.root) === target);
 }
+async function clearSetupFollowUps(onlyPath) {
+  try {
+    const cfg = await loadConfig();
+    const pending = cfg.system.pendingUpload;
+    const dropUpload = pending !== void 0 && (onlyPath === void 0 || resolve(pending.path) === resolve(onlyPath));
+    const dropConnected = onlyPath === void 0 && cfg.system.setupConnected !== void 0;
+    if (!dropUpload && !dropConnected) return;
+    const { pendingUpload, setupConnected, ...rest } = cfg.system;
+    await saveConfig({
+      ...cfg,
+      system: {
+        ...rest,
+        ...dropUpload ? {} : pendingUpload ? { pendingUpload } : {},
+        ...dropConnected ? {} : setupConnected ? { setupConnected } : {}
+      }
+    });
+  } catch {
+  }
+}
 var BrainSchema, ConfigSchema, EMPTY_CONFIG;
 var init_config = __esm({
   "src/lib/config.ts"() {
@@ -5486,7 +5506,31 @@ var init_config = __esm({
          * Absent means "written before this field existed", which is the same
          * answer as "older than this CLI" and wants the same one command.
          */
-        guidanceVersion: z8.string().optional()
+        guidanceVersion: z8.string().optional(),
+        /**
+         * Notes `setup --web` was asked to upload, not yet sent.
+         *
+         * The detached half of the setup never uploads on its own (security
+         * audit H-3): whoever confirmed the setup decided which account receives
+         * the notes, and that is checked by somebody on THIS machine first. The
+         * next command's notice names the path and the receiving account; a
+         * `push` of that path, or `logout`, clears it.
+         */
+        pendingUpload: z8.object({
+          path: z8.string().min(1),
+          brain: z8.string().nullable(),
+          /** The notice names the brain by id only: its name came from the screen. */
+          brain_id: z8.string().nullable().optional(),
+          account_id: z8.string().min(1),
+          account_email: z8.string().nullable(),
+          at: z8.string().min(1)
+        }).optional().catch(void 0),
+        /**
+         * The account a `setup --web` signed this machine into, when it had no
+         * sign-in before — shown once by the next command, because there was no
+         * earlier account to compare it with (H-3).
+         */
+        setupConnected: z8.object({ account_id: z8.string().min(1), email: z8.string().nullable(), at: z8.string().min(1) }).optional().catch(void 0)
       }).default({ autoUpdate: "on" })
     });
     EMPTY_CONFIG = ConfigSchema.parse({});
@@ -5503,6 +5547,10 @@ async function openCloudBrain(target) {
     apiUrl: target.apiUrl
   };
 }
+function connectorLabel(writtenBy) {
+  const app = writtenBy.replace(/^mcp:/, "").replace(/[^A-Za-z0-9 ._-]/g, "").replace(/\s+/g, " ").trim().slice(0, 32).trim();
+  return app === "" || app.toLowerCase() === "connector" ? "written by a chat connector" : `written by the ${app} connector`;
+}
 function findCloudBrain(brains, named) {
   return brains.find((brain) => brain.id === named) ?? brains.find((brain) => brain.name === named);
 }
@@ -7054,12 +7102,12 @@ var init_deadline = __esm({
 import { spawn } from "child_process";
 async function openBrowser(url) {
   const { file, args } = browserOpener(url);
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     let settled = false;
     const finish = (opened) => {
       if (settled) return;
       settled = true;
-      resolve16(opened);
+      resolve17(opened);
     };
     const child = spawn(file, args, { detached: true, stdio: "ignore" });
     child.on("error", () => finish(false));
@@ -7089,7 +7137,7 @@ function loginCommand() {
     "start the sign-in, open the browser, and return immediately \u2014 THE path an agent should use on a user\u2019s behalf; the next command claims the token automatically. Prefer this over the plain form, whose wait for a human click will outlast an agent\u2019s command timeout"
   ).option("--no-browser", "do not try to open a browser \u2014 just print the link").option("--print-url", "print the approval link even when a browser opened").addHelpText(
     "after",
-    "\nAgents: run `login --emit-only`, then SHOW the code in your reply. The\napproval page asks the user to check it against what you showed them,\nand they cannot if you never showed it. Do not ask the user to run a\nlogin command themselves."
+    "\nAgents: run `login --emit-only`, then SHOW the code in your reply. The\napproval page asks the user to type it, and they cannot if you never\nshowed it. Do not ask the user to run a login command themselves."
   ).action(async (opts) => {
     const base2 = apiUrl();
     const already = await currentCredentials(base2);
@@ -7140,7 +7188,11 @@ async function startPairing(base2) {
   const res = await apiRequest({
     method: "POST",
     path: "/v1/auth/device/code",
-    baseUrl: base2
+    baseUrl: base2,
+    // Display text for the approval screen — "requested from memgineering on
+    // darwin" — so a person can tell their own terminal's request from a link
+    // somebody sent them (security audit H-2). Nothing identifying.
+    body: { platform: process.platform, client: `memgineering/${VERSION}` }
   });
   const { device_code, user_code, verification_url, expires_in } = res.body ?? {};
   if (!device_code || !user_code || !verification_url) {
@@ -7171,10 +7223,10 @@ function emit(pending, ctx) {
       browser_opened: ctx.opened,
       api_url: ctx.base,
       waiting: ctx.blocking,
-      next: ctx.blocking ? "Waiting for approval in the browser." : "SHOW user_code to the user in your reply, then run any memgineering command \u2014 the token is claimed automatically once they approve. The approval screen asks THEM to agree to the terms and the privacy policy and to confirm they are 14 or older; you cannot answer that for them, and an account is not created until they do."
+      next: ctx.blocking ? "Waiting for approval in the browser." : "SHOW user_code to the user in your reply \u2014 the approval screen asks them to type it \u2014 then run any memgineering command; the token is claimed automatically once they approve. The approval screen also asks THEM to agree to the terms and the privacy policy and to confirm they are 14 or older; you cannot answer that for them, and an account is not created until they do."
     },
     human: () => {
-      printHuman("Show this code to whoever is signing in:\n");
+      printHuman("Show this code to whoever is signing in \u2014 the approval page asks them to type it:\n");
       printHuman(`  ${c.bold().yellow(oneLine(pending.user_code, WIDTH.handle))}
 `);
       if (ctx.opened) {
@@ -7267,9 +7319,10 @@ var init_login = __esm({
     init_open_browser();
     init_pending_login();
     init_ui();
+    init_version();
     BLOCKING_TIMEOUT_MS = 10 * 60 * 1e3;
-    sleep = (ms) => new Promise((resolve16) => {
-      setTimeout(resolve16, ms).unref?.();
+    sleep = (ms) => new Promise((resolve17) => {
+      setTimeout(resolve17, ms).unref?.();
     });
   }
 });
@@ -7380,6 +7433,7 @@ If your notes are in one of those, that rule is why \u2014 nothing here can see
       }
     }
     const repointed = await pointConfigAt(destination);
+    await clearSetupFollowUps(local.root);
     printDual({
       json: {
         from: local.root,
@@ -7911,15 +7965,18 @@ var setup_cloud_exports = {};
 __export(setup_cloud_exports, {
   SETUP_CHILD_ENV: () => SETUP_CHILD_ENV,
   applyAnswers: () => applyAnswers,
+  insideFolder: () => insideFolder,
+  newBrainRoot: () => newBrainRoot,
   readChildToken: () => readChildToken,
   runSetupCloud: () => runSetupCloud,
   runSetupCloudChild: () => runSetupCloudChild,
   waitAndApply: () => waitAndApply
 });
 import { spawn as spawn2 } from "child_process";
+import { realpathSync as realpathSync2 } from "fs";
 import { readdir as readdir7, stat as stat6 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { join as join24 } from "path";
+import { basename as basename3, dirname as dirname9, join as join24, resolve as resolve15, sep as sep4 } from "path";
 async function report2(setupToken, state, detail) {
   try {
     await apiRequest({
@@ -7963,7 +8020,7 @@ function toolsFromAnswers(answers, detected) {
   const picked = TOOLS.filter((t) => wanted.has(t.id));
   return picked.length > 0 ? picked : [...detected];
 }
-async function applyAnswers(setupToken, claim, detected) {
+async function applyAnswers(setupToken, claim, detected, guards = { candidates: [], confirmUpload: null }) {
   const answers = claim.answers;
   if (!answers) {
     throw memgError(
@@ -7972,22 +8029,39 @@ async function applyAnswers(setupToken, claim, detected) {
       "Nothing was installed. Run `memgineering setup --web` again; if it repeats, the brain server is answering in a shape this version does not understand."
     );
   }
+  const localRoot = checkLocalPath(answers, guards.candidates);
+  let account = null;
   if (typeof claim.token === "string" && claim.token !== "") {
+    account = claim.account ?? await whoIs(claim.token);
+    const before = await readCredentials();
+    const firstSignIn = before === null || before.api_url !== apiUrl();
+    if (!firstSignIn && (account === null || before.account_id !== account.id)) {
+      throw memgError(
+        "conflict",
+        "this machine is signed in to a different account, so the setup changed nothing",
+        `Signed in here: ${before.display_name ?? before.account_id}. The setup screen was confirmed by: ${account?.email ?? account?.display_name ?? "an unknown account"}. If that second account is yours and you want to switch, run \`memgineering logout\` and then \`memgineering setup --web\` again; if you did not confirm it, someone else did \u2014 nothing was changed.`
+      );
+    }
     const registry = registryFromClaim(claim.registry);
-    const me = await apiRequest({
-      method: "GET",
-      path: "/v1/me",
-      token: claim.token
-    }).catch(() => null);
     const credentials = {
       api_url: apiUrl(),
       token: claim.token,
-      account_id: me?.body?.account?.id ?? "",
-      display_name: me?.body?.account?.display_name ?? null,
+      account_id: account?.id ?? "",
+      display_name: account?.display_name ?? null,
       signed_in_at: (/* @__PURE__ */ new Date()).toISOString(),
       ...registry !== void 0 ? { registry } : {}
     };
     await saveCredentials(credentials);
+    if (firstSignIn && account !== null) {
+      const cfg = await loadConfig();
+      await saveConfig({
+        ...cfg,
+        system: {
+          ...cfg.system,
+          setupConnected: { account_id: account.id, email: account.email, at: (/* @__PURE__ */ new Date()).toISOString() }
+        }
+      });
+    }
   }
   await report2(setupToken, "applying", "\uC124\uC815\uC744 \uC4F0\uB294 \uC911\uC774\uC5D0\uC694.");
   const choice = {
@@ -8005,7 +8079,7 @@ async function applyAnswers(setupToken, claim, detected) {
       await recordLink(target.adapter, DEFAULT_OBSERVATIONS_DIR);
       parts.push(`linked ${answers.local_path}`);
     } else {
-      const made = await createBrain(answers.local_path, "default");
+      const made = await createBrain(localRoot ?? answers.local_path, "default");
       parts.push(`created ${made.root}`);
     }
   }
@@ -8015,16 +8089,77 @@ async function applyAnswers(setupToken, claim, detected) {
     parts.push(`pointed at ${claim.brain.name}`);
   }
   if (answers.location === "cloud" && answers.upload_path) {
-    await report2(setupToken, "applying", "\uB178\uD2B8\uB97C \uC62C\uB9AC\uB294 \uC911\uC774\uC5D0\uC694.");
-    const { pushCommand: pushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
-    await pushCommand2().parseAsync(
-      ["--vault", answers.upload_path, ...claim.brain?.name ? ["--brain", claim.brain.name] : []],
-      { from: "user" }
-    );
-    parts.push(`uploaded ${answers.upload_path}`);
+    const path = answers.upload_path;
+    if (!guards.candidates.includes(path)) {
+      parts.push(`not uploaded: ${path} was not one of the folders this machine offered`);
+    } else {
+      const email = account?.email ?? null;
+      const yes = guards.confirmUpload ? await guards.confirmUpload({ path, email }) : null;
+      if (yes === true) {
+        await report2(setupToken, "applying", "\uB178\uD2B8\uB97C \uC62C\uB9AC\uB294 \uC911\uC774\uC5D0\uC694.");
+        const { pushCommand: pushCommand2 } = await Promise.resolve().then(() => (init_push(), push_exports));
+        await pushCommand2().parseAsync(
+          ["--vault", path, ...claim.brain?.id ? ["--brain", claim.brain.id] : []],
+          { from: "user" }
+        );
+        parts.push(`uploaded ${path}`);
+      } else if (yes === null && account !== null) {
+        const cfg = await loadConfig();
+        await saveConfig({
+          ...cfg,
+          system: {
+            ...cfg.system,
+            pendingUpload: {
+              path,
+              brain: claim.brain?.name ?? null,
+              brain_id: claim.brain?.id ?? null,
+              account_id: account.id,
+              account_email: email,
+              at: (/* @__PURE__ */ new Date()).toISOString()
+            }
+          }
+        });
+        await report2(setupToken, "applying", "\uB178\uD2B8 \uC62C\uB9AC\uAE30\uB294 \uC774 \uCEF4\uD4E8\uD130\uC5D0\uC11C \uD655\uC778\uD55C \uB4A4\uC5D0 \uC2DC\uC791\uB3FC\uC694.");
+        parts.push(`upload of ${path} waits for a check on this machine`);
+      } else {
+        parts.push(`not uploaded: ${path}`);
+      }
+    }
   }
+  if (account?.email) parts.push(`signed in as ${account.email}`);
   return { summary: parts.join(" \xB7 ") };
 }
+async function whoIs(token) {
+  const me = await apiRequest({ method: "GET", path: "/v1/me", token }).catch(() => null);
+  const a = me?.body?.account;
+  return a?.id ? { id: a.id, email: a.email ?? null, display_name: a.display_name ?? null } : null;
+}
+function checkLocalPath(answers, candidates) {
+  if (answers.location !== "local" || !answers.local_path) return null;
+  const path = answers.local_path;
+  if (answers.local_mode === "link") {
+    if (!candidates.includes(path)) {
+      throw memgError(
+        "invalid_input",
+        "the folder the setup screen chose to link was not one this machine offered",
+        "Nothing was changed. To use an existing folder, run `memgineering link <folder>` here."
+      );
+    }
+    return null;
+  }
+  return newBrainRoot(path);
+}
+function newBrainRoot(path, home = homedir5()) {
+  const root = path === "~" ? home : path.startsWith("~/") ? resolve15(home, path.slice(2)) : resolve15(home, path);
+  if (!insideFolder(root, home)) {
+    throw memgError(
+      "invalid_input",
+      "the setup screen chose a place outside the home folder for the new brain",
+      `Nothing was changed. Run \`memgineering init <folder>\` here to make a brain somewhere under ${home}.`
+    );
+  }
+  return root;
+}
 async function pollOnce(setupToken) {
   const res = await apiRequest({
     method: "POST",
@@ -8036,6 +8171,7 @@ async function pollOnce(setupToken) {
 }
 async function waitAndApply(setupToken, opts) {
   let sentFolders = false;
+  let offered = [];
   for (; ; ) {
     if (Date.now() > opts.deadline) return "expired";
     let answer = null;
@@ -8049,7 +8185,10 @@ async function waitAndApply(setupToken, opts) {
     if (answer) {
       await report2(setupToken, "applying");
       try {
-        const done = await applyAnswers(setupToken, answer, opts.detected);
+        const done = await applyAnswers(setupToken, answer, opts.detected, {
+          candidates: offered,
+          confirmUpload: opts.confirmUpload ?? null
+        });
         await report2(setupToken, "done", "\uC124\uCE58\uB97C \uB9C8\uCCE4\uC5B4\uC694.");
         return done;
       } catch (err) {
@@ -8068,6 +8207,7 @@ async function waitAndApply(setupToken, opts) {
         sentFolders = true;
         opts.onProgress?.("\uD3F4\uB354\uB97C \uCC3E\uC544\uBCF4\uB294 \uC911\u2026");
         const candidates = await folderCandidates();
+        offered = candidates.map((c2) => c2.path);
         await apiRequest({
           method: "POST",
           path: "/v1/setup/session/folders",
@@ -8076,7 +8216,7 @@ async function waitAndApply(setupToken, opts) {
         });
       }
     }
-    await new Promise((resolve16) => setTimeout(resolve16, opts.intervalMs));
+    await new Promise((resolve17) => setTimeout(resolve17, opts.intervalMs));
   }
 }
 async function startSession(detected) {
@@ -8122,7 +8262,11 @@ async function runSetupCloud(opts) {
   printDual({
     json: {
       user_code: session.user_code,
-      setup_url: session.setup_url,
+      // The link drives the setup screen — it carries the browser key (H-3).
+      // Once a browser has it, nobody else needs it, so it is not printed.
+      ...opened ? {
+        hint: "The setup screen was opened in the browser. If none appeared, run `memgineering setup --web --print-url` and open the printed link yourself."
+      } : { setup_url: session.setup_url },
       opened,
       waiting: foreground
     },
@@ -8143,11 +8287,13 @@ async function runSetupCloud(opts) {
     detachChild(session.setup_token);
     return;
   }
+  const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true && !isJsonMode();
   const outcome = await waitAndApply(session.setup_token, {
     intervalMs,
     deadline: Date.now() + CHILD_LIFETIME_MS,
     detected: opts.detected,
-    onProgress: (line) => printHuman(c.gray(`  ${line}`))
+    onProgress: (line) => printHuman(c.gray(`  ${line}`)),
+    confirmUpload: interactive ? askBeforeUpload : null
   });
   if (outcome === "expired") {
     const line = "\uC124\uCE58 \uD654\uBA74\uC774 \uB9CC\uB8CC\uB410\uC5B4\uC694. \uC544\uBB34\uAC83\uB3C4 \uBC14\uB00C\uC9C0 \uC54A\uC558\uC5B4\uC694 \u2014 `memgineering setup --web`\uC744 \uB2E4\uC2DC \uC2E4\uD589\uD558\uBA74 \uC0C8 \uD654\uBA74\uC774 \uC5F4\uB824\uC694.";
@@ -8166,6 +8312,41 @@ ${line}`));
     );
   }
 }
+function insideFolder(target, folder) {
+  const real = (p) => {
+    try {
+      return realpathSync2(p);
+    } catch {
+      return p;
+    }
+  };
+  const root = real(resolve15(folder));
+  let existing = resolve15(target);
+  const rest = [];
+  for (; ; ) {
+    try {
+      realpathSync2(existing);
+      break;
+    } catch {
+      const parent = dirname9(existing);
+      if (parent === existing) break;
+      rest.unshift(basename3(existing));
+      existing = parent;
+    }
+  }
+  const landed = resolve15(real(existing), ...rest);
+  return landed === root || landed.startsWith(root + sep4);
+}
+async function askBeforeUpload(q) {
+  const { default: prompts6 } = await import("prompts");
+  const { yes } = await prompts6({
+    type: "confirm",
+    name: "yes",
+    message: `${q.path} \uC758 \uB178\uD2B8\uB97C ${q.email ?? "\uC774 \uACC4\uC815"} \uBE0C\uB808\uC778\uC73C\uB85C \uC62C\uB9B4\uAE4C\uC694?`,
+    initial: false
+  });
+  return yes === true;
+}
 async function runSetupCloudChild(detected) {
   const setupToken = await readChildToken();
   if (setupToken === "") return;
@@ -8182,6 +8363,7 @@ var init_setup_cloud = __esm({
     "use strict";
     init_api_client();
     init_errors();
+    init_config();
     init_credentials();
     init_open_browser();
     init_ui();
@@ -8196,7 +8378,7 @@ var init_setup_cloud = __esm({
 // src/commands/setup.ts
 import { createHash as createHash9 } from "crypto";
 import { access as access2, mkdir as mkdir15, readFile as readFile24 } from "fs/promises";
-import { dirname as dirname9, join as join25 } from "path";
+import { dirname as dirname10, join as join25 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { Command as Command40 } from "commander";
 import prompts5 from "prompts";
@@ -8780,7 +8962,7 @@ ${BRAND.hubMarkerEnd}`;
   const existing = await readFile24(filePath, "utf8").catch(() => null);
   if (existing === null) {
     if (!dryRun) {
-      await mkdir15(dirname9(filePath), { recursive: true });
+      await mkdir15(dirname10(filePath), { recursive: true });
       await writeThenRename(filePath, `${block}
 `);
     }
@@ -8824,7 +9006,7 @@ async function writeIfDifferent(filePath, content, dryRun) {
   const after = fingerprint(content);
   if (existing === content) return { outcome: "unchanged", before: existing, after };
   if (!dryRun) {
-    await mkdir15(dirname9(filePath), { recursive: true });
+    await mkdir15(dirname10(filePath), { recursive: true });
     await writeThenRename(filePath, content);
   }
   return { outcome: existing === null ? "injected" : "updated", before: existing, after };
@@ -8878,7 +9060,7 @@ async function installHook(spec, tool, dryRun) {
   }
   const next = { ...settings, hooks: { ...hooks, [spec.event]: existingGroups } };
   if (!dryRun) {
-    await mkdir15(dirname9(settingsPath), { recursive: true });
+    await mkdir15(dirname10(settingsPath), { recursive: true });
     await writeThenRename(settingsPath, `${JSON.stringify(next, null, 2)}
 `);
   }
@@ -8918,14 +9100,14 @@ async function loadAsset(relPath) {
   return raw;
 }
 async function assetRoot() {
-  const here = dirname9(fileURLToPath3(import.meta.url));
+  const here = dirname10(fileURLToPath3(import.meta.url));
   const bundled = join25(here, "..", "assets");
   if (await exists2(join25(bundled, BRAND.hubFileName))) return bundled;
   let dir = here;
   for (; ; ) {
     const candidate = join25(dir, "packages", "skills");
     if (await exists2(join25(candidate, BRAND.hubFileName))) return candidate;
-    const parent = dirname9(dir);
+    const parent = dirname10(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -9312,7 +9494,7 @@ async function reportError(kind, err) {
         headers: { "content-type": "application/json" },
         body: JSON.stringify(payload)
       }),
-      new Promise((resolve16) => setTimeout(resolve16, REPORT_TIMEOUT_MS))
+      new Promise((resolve17) => setTimeout(resolve17, REPORT_TIMEOUT_MS))
     ]);
   } catch {
   }
@@ -11003,7 +11185,7 @@ var KordisClient = class {
               `[kordis] api: ${method} ${url.pathname}${url.search} \u2192 fetch failed, retrying in 150ms (${err.message})`
             );
           }
-          await new Promise((resolve16) => setTimeout(resolve16, 150));
+          await new Promise((resolve17) => setTimeout(resolve17, 150));
           continue;
         }
       }
@@ -14507,11 +14689,11 @@ function lines(text, marker) {
   return text === "" ? [] : text.split("\n").map((l) => `${marker} ${l}`);
 }
 async function readInput(source) {
-  const raw = source === "-" ? await new Promise((resolve16, reject) => {
+  const raw = source === "-" ? await new Promise((resolve17, reject) => {
     let buf = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (chunk) => buf += chunk);
-    process.stdin.on("end", () => resolve16(buf));
+    process.stdin.on("end", () => resolve17(buf));
     process.stdin.on("error", reject);
   }) : await readFile16(source, "utf8").catch(() => source);
   try {
@@ -17174,8 +17356,14 @@ function groupHostedLines(rules, project) {
   const width = ruleWidthFor(rules.length);
   const line = (r) => {
     const quoted = renderRuleLine(r.text ?? r.summary ?? r.title, width);
-    return r.freshness === "current" || r.freshness === void 0 ? quoted : `${quoted}
-  (${r.freshness === "expired" ? "past its end date" : "superseded"} \u2014 worth checking)`;
+    const labels = [
+      ...r.freshness === "current" || r.freshness === void 0 ? [] : [`(${r.freshness === "expired" ? "past its end date" : "superseded"} \u2014 worth checking)`],
+      // Whose words these are, when a chat app's (security audit M-2). The
+      // person promoted it; the agent is owed knowing where it came from.
+      ...r.written_by === void 0 ? [] : [`(${connectorLabel(r.written_by)})`]
+    ];
+    return labels.length === 0 ? quoted : `${quoted}
+  ${labels.join(" ")}`;
   };
   const globals = rules.filter((r) => r.lane === "global");
   const scoped = rules.filter((r) => r.lane === "project");
@@ -17896,6 +18084,7 @@ init_login();
 init_errors();
 init_api_client();
 init_credentials();
+init_config();
 init_pending_login();
 init_ui();
 import { Command as Command22 } from "commander";
@@ -17907,6 +18096,7 @@ function logoutCommand() {
     const base2 = apiUrl();
     const credentials = await readCredentials();
     await clearPendingLogin();
+    await clearSetupFollowUps();
     if (!credentials) {
       printDual({
         json: { signed_out: true, was_signed_in: false, api_url: base2 },
@@ -22716,7 +22906,7 @@ function rulesCommand() {
             const lane = rule.lane === "project" ? oneLine(project2 ?? "this project", WIDTH.title) : "global";
             printHuman(
               c.gray(
-                `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`${rule.lane ? `  \xB7  ${lane}` : ""}`
+                `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`${rule.lane ? `  \xB7  ${lane}` : ""}${rule.written_by === void 0 ? "" : `  \xB7  ${connectorLabel(rule.written_by)}`}`
               )
             );
           }
@@ -22735,7 +22925,7 @@ ${shownOf - rules2.length} more not shown.`));
               printHuman(`- ${oneLine(rule.summary ?? rule.title, WIDTH.text)}`);
               printHuman(
                 c.gray(
-                  `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`  \xB7  ${oneLine(rule.scope ?? "", WIDTH.title)}`
+                  `  \`open: ${oneLine(rule.handle, WIDTH.handle)}\`  \xB7  ${oneLine(rule.scope ?? "", WIDTH.title)}${rule.written_by === void 0 ? "" : `  \xB7  ${connectorLabel(rule.written_by)}`}`
                 )
               );
             }
@@ -22885,6 +23075,23 @@ move existing notes up.
 
 The \`memgineering-setup\` skill covers what comes after.`;
 var SETUP_NUDGE = "memgineering is installed, but not set up yet. `memgineering setup --web` opens a setup screen in their browser and does NOT wait for them \u2014 ask them first unless they asked you to set it up.\nThe full notes: run `memgineering` on its own.";
+function connectedMarker(at) {
+  return join26(brandHome(), `setup-connected-shown-${at.replace(/[^0-9A-Za-z]/g, "")}`);
+}
+async function connectedNoticeShown(at) {
+  return readFile25(connectedMarker(at), "utf8").then(
+    () => true,
+    () => false
+  );
+}
+async function markConnectedNoticeShown(at) {
+  try {
+    await mkdir16(brandHome(), { recursive: true });
+    await writeFile13(connectedMarker(at), `${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+  } catch {
+  }
+}
 async function claimFullSetupNotice() {
   const marker = join26(brandHome(), "setup-notice-shown");
   try {
@@ -22953,7 +23160,42 @@ var POINT_AT_A_BRAIN = `## Signed in, and this machine reads no brain yet.
 \`memgineering use --brain <name>\` points this machine at one.
 \`memgineering create <name>\` makes one and points here, when the account has none yet.
 `;
-function nextStepFor(cfg, signedIn = false) {
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function confirmUploadNotice(p) {
+  const who = p.account_email ?? "the account `setup --web` connected";
+  const brain = p.brain_id && UUID.test(p.brain_id) ? ` --brain ${p.brain_id}` : "";
+  return `## Notes are waiting to be uploaded \u2014 after a check.
+
+\`memgineering setup --web\` chose to upload \`${p.path}\` to a brain on **${who}**.
+This machine has not sent them: an upload decided on the setup screen waits
+until somebody here has seen which account would receive the notes.
+
+If that is your user's account, this uploads them:
+
+\`\`\`bash
+memgineering push --vault ${shellQuote(p.path)}${brain}
+\`\`\`
+
+If it is not, \`memgineering logout\` disconnects this machine from that account
+and nothing is uploaded. If you are not sure which it is, ask them.`;
+}
+function setupConnectedNotice(c2) {
+  const who = c2.email ?? "an account with no email on record";
+  return `## This machine is signed in as **${who}**.
+
+\`memgineering setup --web\` connected it to that account. If that is not your user's account,
+\`memgineering logout\` disconnects it, and nothing they write reaches that brain.`;
+}
+function nextStepFor(cfg, signedIn = false, seen = {}) {
+  if (cfg.system.pendingUpload) {
+    return { id: "confirm_upload", markdown: confirmUploadNotice(cfg.system.pendingUpload) };
+  }
+  if (cfg.system.setupConnected && !seen.connected) {
+    return { id: "setup_connected", markdown: setupConnectedNotice(cfg.system.setupConnected) };
+  }
   if (signedIn && cfg.brain.cloud === void 0) {
     return { id: "point_at_a_brain", markdown: POINT_AT_A_BRAIN };
   }
@@ -22970,7 +23212,9 @@ function nextStepFor(cfg, signedIn = false) {
 async function currentNextStep() {
   try {
     const stored = await readCredentials().catch(() => null);
-    return nextStepFor(await loadConfig(), stored !== null && stored.api_url === apiUrl());
+    const cfg = await loadConfig();
+    const connected = cfg.system.setupConnected ? await connectedNoticeShown(cfg.system.setupConnected.at) : false;
+    return nextStepFor(cfg, stored !== null && stored.api_url === apiUrl(), { connected });
   } catch {
     return null;
   }
@@ -23663,7 +23907,7 @@ init_api_client();
 init_credentials();
 init_cloud_brain();
 init_config();
-import { isAbsolute as isAbsolute5, relative as relative2, resolve as resolve15 } from "path";
+import { isAbsolute as isAbsolute5, relative as relative2, resolve as resolve16 } from "path";
 import { Command as Command44 } from "commander";
 init_vault();
 init_ui();
@@ -23693,7 +23937,7 @@ function useCommand() {
       await pointAtHosted(opts.brain, opts, brainPath);
       return;
     }
-    const where = await canonicalize(resolve15(opts.here ?? process.cwd()));
+    const where = await canonicalize(resolve16(opts.here ?? process.cwd()));
     if (!brainPath) {
       const pointer = await readPointer(where);
       const resolved = await resolveBrain(void 0, where).catch((err) => err);
@@ -23839,7 +24083,7 @@ ${hint}`));
       });
       return;
     }
-    const root = await canonicalize(resolve15(brainPath));
+    const root = await canonicalize(resolve16(brainPath));
     const cfg = await loadConfig();
     if (!findBrain(cfg, root)) {
       throw memgError(
@@ -23866,7 +24110,7 @@ A pointer to an unlinked folder would fail on every command instead of at this o
       return;
     }
     const value = isInside(root, where) ? relative2(where, root) || "." : root;
-    const file = resolve15(where, BRAND.pointerFileName);
+    const file = resolve16(where, BRAND.pointerFileName);
     await writeThenRename(file, `${value}
 `);
     printDual({
@@ -24056,6 +24300,7 @@ function whoamiCommand() {
 }
 
 // src/program.ts
+init_config();
 init_ui();
 init_brand();
 
@@ -24178,6 +24423,10 @@ async function announceNextStep(commandName, reader) {
   const step = await currentNextStep();
   if (step === null) return;
   announced = true;
+  if (step.id === "setup_connected") {
+    const cfg = await loadConfig().catch(() => null);
+    if (cfg?.system.setupConnected) await markConnectedNoticeShown(cfg.system.setupConnected.at);
+  }
   if (step.id === "finish_setup" && reader !== "full") {
     const text = reader === "person" ? SHORT_SETUP_NOTICE : reader === "verb" && await claimFullSetupNotice() ? step.markdown : SETUP_NUDGE;
     process.stderr.write(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memgineering",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "private": false,
   "description": "One memory for the AI you connect. Recall, remember, and revise a brain your agents share — stored in your own folder.",
   "license": "Apache-2.0",