memgineering 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -9,7 +9,105 @@ upgrade and by agents summarising a release, and both re-render it in whatever
 language the reader wants. The bilingual rule the monorepo applies to
 `@rayul/kordis` does not extend here.
 
-## [Unreleased]
+## [0.28.0] — 2026-11-01
+
+### Added
+
+- **`memgineering delete-account` deletes your account — the hosted brain
+  account and the registry account the same Google sign-in made — in one
+  command.** Brain first (every brain on it, every note, every token), then
+  the registry account (profile, stars, follows, comment text, sign-ins;
+  the account is renamed `deleted-…`, and its published packages and versions
+  stay at their existing addresses), then this machine is signed out. It is confirmed with the sentence `delete my account`: typed at
+  the prompt, or passed as `--confirm "delete my account"`. Without either and
+  with no terminal to ask in, it refuses; there is no dry run. Folders on this
+  disk are never touched.
+- **Before deleting anything it checks both sign-ins work and are one
+  person's** — the two accounts' emails, or, when either account has no email
+  on record, this machine's registry sign-in, which the brain sign-in issued. `--json` reports which as `matched` (`email`, `federation`, or
+  `earlier-run`). Two different people answer `account_mismatch`; a machine
+  signed in to a brain with no registry half answers `not_linked`; a machine
+  signed in to nothing answers `not_signed_in` (a brain kept in a folder has
+  no account). Each refusal says nothing was deleted and how to go on,
+  including mailing support@memgineering.com.
+- **A run that stops halfway can be finished.** If the registry fails after
+  the brain account is gone, the command answers `account_partly_deleted`
+  and keeps a progress file (`delete-account.json` in the memgineering home,
+  mode 600); running it again skips the brain and deletes only the registry
+  account, and the file is removed when both are done. An answer lost on the
+  way back is checked with the server rather than guessed. `--json` on success:
+  `{deleted, brain: {status, account_id, api_url}, registry: {status, user_id,
+  username, api_url}, matched, credentials_cleared, pointer_cleared,
+  local_folders, hint}`, where each `status` is `deleted` or `deleted-earlier`.
+- **`memgineering logout --all` reports what it ended in the registry.** On a
+  server with "disconnect everything", `--all` also ends every registry sign-in
+  of the same Google account, and anything approved before that moment can no
+  longer finish. `--json` passes the server's `registry_sessions` (`revoked`
+  with a count, `not_linked`, or `unreachable` with a `hint`) and
+  `revoked_before` on unchanged, and the human output gives the registry result
+  its own line (none when there were no live registry sign-ins to end). The existing `registry` field keeps its meaning: this machine's
+  registry session.
+- **`memgineering logout --all` with nothing signed in says how to do it** —
+  the website's "disconnect everything" button, or `memgineering login` and
+  then `logout --all` — in a `hint`, instead of only "nothing to do".
+
+### Changed
+
+- **`logout --all` no longer ends this machine's registry session separately
+  when the server already ended every registry session.** An older server, an
+  unreachable registry, or an account the server found no registry link for
+  still gets this machine's session ended as before.
+
+### Fixed
+
+- **`registry search` with nothing searchable in the query finds nothing**
+  (registry-side, every version). A query of only emoji or punctuation used to
+  return every package as a match; it now returns no results.
+
+### Known issue
+
+- **An older CLI can report `registry: revoke-failed-expires-on-its-own` after
+  `logout --all` against an updated server.** The server has already ended the
+  registry session, so the old CLI's own attempt finds it gone and reports a
+  failure that did not happen. Upgrading fixes the report; nothing is left
+  signed in.
+
+### Agent guidance
+
+- `memgineering-setup` describes `delete-account`: when to run it (only on an
+  explicit request), what it deletes and keeps, the refusals, and what to tell
+  the user after `account_partly_deleted`. Restart the agent session after
+  upgrading to pick it up.
+- `memgineering-setup` also points a person with no terminal to the "Delete my
+  account" section at the bottom of memgineering.com/brain (one tick), which
+  deletes the same two accounts. Restart the agent session after upgrading to
+  pick it up.
+- `memgineering-setup` now says a Google account that never opened a brain can
+  delete its registry account from the same page: the consent screen shows a
+  "Delete my account" section below the terms. Only an account that never
+  signed in with Google, and a brain account whose terms were never accepted,
+  are deleted by mail to support@memgineering.com. Restart the agent session
+  after upgrading to pick it up.
+- `memgineering-setup` describes `logout --all` as "disconnect everything" and
+  what to tell the user for each `registry_sessions` answer. Restart the agent
+  session after upgrading to pick it up.
+- `memgineering-setup` no longer says consent is asked only once. The terms
+  are agreed once per account; connecting a chat app asks on every connection
+  for two consents — to giving what it reads and writes to the company that
+  runs it, and to that company being in the United States — and without both
+  ticks the app is not connected. It says what the connect screen tells the
+  person (what is sent, automatically at the start of every conversation and
+  without asking each time it records; the company's purpose, model training
+  included; how long it keeps it), that a program on their own computer asks
+  for no tick, that a refused unknown app (`unknown_connector_recipient`) is
+  answered by suggesting Claude or Gemini, and that a "notice changed" screen
+  is reloaded and approved again. Restart the agent session after upgrading to
+  pick it up.
+- `memgineering-setup` says **connecting ChatGPT is paused** for now
+  (`connector_recipient_paused`, while the notice about OpenAI is verified):
+  agents offer Claude or Gemini instead of walking the user through ChatGPT's
+  Developer mode. The hub and `memgineering setup --help` say the same beside
+  ChatGPT's route, which works again once the pause ends.
 
 ## [0.27.0] — 2026-10-18
 

package/README.md

@@ -185,6 +185,17 @@ automatically when a Claude Code session starts.
 | `brains`                             | list your hosted brains, and which one answers here |
 | `create` · `rename` · `delete-brain` | make, rename, or delete a hosted brain              |
 | `push` · `pull`                      | carry a brain to your account, and back down again  |
+| `delete-account`                     | delete your account — brain and registry — for good |
+
+`delete-account` deletes the hosted brain account (every brain, note and
+token on it) and then the registry account the same Google sign-in made
+(the account is renamed `deleted-…`; its published packages and versions
+stay at their existing addresses), and signs this machine out. It asks for the sentence `delete my account` — typed at the prompt, or
+`--confirm "delete my account"` — and checks first that both sign-ins work and
+belong to one person (their emails match; if either account has no email, the
+registry sign-in this machine got from the brain sign-in is the match). If it stops halfway, run it again: it finishes the side
+that is left. Folders on this disk are never touched. Without a sign-in you
+can use, mail support@memgineering.com from the address on the account.
 
 **System**
 

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.27.0
+version: 0.28.0
 ---
 
 # memgineering
@@ -81,13 +81,13 @@ at six skills, each of which loads on its own when its topic comes up:
 - `memgineering-rules` — decisions that bind, and the before-edit hook
 - `memgineering-setup` — installing, which tools this reaches, accounts, moving a brain
 - `memgineering-registry` — the public layer
-- `memgineering-installing` — putting a package in their project, and updating it
+- `memgineering-installing` — putting a package in a project, updating it
 
-Not shell-only: ChatGPT and Claude.ai reach a hosted brain via connector `https://mcp.memgineering.com/mcp`.
+Not shell-only: Claude.ai reaches a hosted brain via connector `https://mcp.memgineering.com/mcp`; ChatGPT is paused for now.
 
 A host short on room lists a skill by NAME ONLY, no description — measured on
 Claude Code. When you cannot see what it covers, READ
 `<tool-home>/skills/memgineering-<name>/SKILL.md` before deciding it is empty.
 
-If `memgineering: command not found`, install with `npm i -g memgineering`, then
+If `memgineering: command not found`, run `npm i -g memgineering`, then
 `memgineering setup --web`.

package/assets/memgineering-setup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: memgineering-setup
-description: Use when installing or configuring memgineering, when moving a brain between a machine and an account, when renaming or deleting a hosted brain, or whenever the user asks WHICH of their AI tools can see this memory. Triggers include "set up memgineering", "connect my notes", "rename my brain", "delete that brain", "does my other AI see this too", "which of my tools can read this", "will it work in the app on my phone", "can I use this in ChatGPT", "does it work in Claude.ai", "no brain is linked".
+description: Use when installing or configuring memgineering, when moving a brain between a machine and an account, when renaming or deleting a hosted brain, when the user wants their whole account deleted, or whenever the user asks WHICH of their AI tools can see this memory. Triggers include "set up memgineering", "connect my notes", "rename my brain", "delete that brain", "delete my account", "close my account", "does my other AI see this too", "which of my tools can read this", "will it work in the app on my phone", "can I use this in ChatGPT", "does it work in Claude.ai", "no brain is linked".
 type: skill
 allowed-tools: Bash(memgineering:*)
 ---
@@ -25,11 +25,15 @@ guessing from a list.
 So when someone names a tool and asks whether it remembers too, work it out from
 those rows and answer plainly — not a hedge, not a promise:
 
-- **ChatGPT** — Settings → **Developer mode** → add an MCP server with
-  `https://mcp.memgineering.com/mcp`, then sign in with Google when it asks.
 - **Claude.ai, Claude Desktop, Cowork** — **Customize** → **Connectors** →
-  **Add custom connector** → the same URL. One connector covers all three, and
-  custom connectors are on every plan, the free one included.
+  **Add custom connector** → `https://mcp.memgineering.com/mcp`. One connector
+  covers all three, and custom connectors are on every plan, the free one
+  included. Then sign in with Google when it asks and tick both consents on the
+  connect screen (below).
+- **ChatGPT** — **paused for now.** The connect screen refuses it with
+  `connector_recipient_paused` while the notice about OpenAI is verified. Say so
+  plainly, and offer Claude or Gemini instead, or trying again later; do not
+  walk them through Developer mode in the meantime.
 - It reaches the brain **on their account**. A brain that lives only as a folder
   on this machine is out of its reach until it is moved up (see "Moving a brain
   between this machine and their account").
@@ -110,8 +114,35 @@ the brain identity and a `registry:` line with the username. If the registry
 line says "not linked", the link simply did not happen at sign-in time (older
 server, registry briefly down); a fresh `logout` + `login` links it. Never
 treat a missing registry line as a failed brain sign-in — the brain token
-stands on its own. Consent is asked exactly once, when an account is first
-created.
+stands on its own. Consent to the terms is asked once, when an account is
+first created. Two other consents are asked on every chat-app connection
+instead. Connecting Claude or Gemini gives the company that runs it what the app
+reads from the brain — brain names, the questions asked, note titles,
+summaries, claims and sources, the rules in force, opened notes in full — and
+what it writes, automatically at the start of every conversation and without
+asking each time it records; that company is in the United States. So the
+connect screen names who receives it and how to reach them, what it is used for
+(that company's model training included, as the app's own settings allow) and
+how long it is kept, and asks for two ticks: one to the provision to that
+company, one to the transfer abroad. Without both the app is not connected, and
+nothing else changes; to connect, the user starts again from the app and ticks
+both. If the screen says the notice changed, the user reloads it (or starts
+again from the app) and approves again. A program on their own computer (a
+connector redirecting to 127.0.0.1 or localhost) asks for no tick — what it
+sends onward follows that program's own terms. An app whose recipient
+memgineering has no notice for is refused (`unknown_connector_recipient`):
+suggest Claude or Gemini.
+
+**`logout --all` is "disconnect everything".** It ends every brain token on
+the account (every machine, ChatGPT and Claude connections, the website), and
+anything approved before that moment — a sign-in nobody collected yet, a half-
+finished connection — can no longer finish. It also ends every registry
+sign-in of the same Google account. `--json` carries `registry_sessions`:
+`revoked` (with a count), `not_linked`, or `unreachable` with a `hint` — on
+that one, tell the user the brain side is done and relay the hint (it names
+`kordis logout`). Signing in again afterwards works as usual. With nothing
+signed in on this machine, it says how to do it instead: the website's button,
+or `login` first.
 
 **When the setup finishes, say what is true and no more.** Commands work
 immediately — `recall`, `remember`, the session hook. What waits is the
@@ -284,6 +315,45 @@ person to retype the brain's name; with no terminal it refuses rather than
 deciding. `unlink --brain` is the gentle sibling: it only stops this machine
 reading a brain and deletes nothing.
 
+### Deleting the whole account
+
+`memgineering delete-account --confirm "delete my account"` deletes the
+hosted brain account (every brain on it, every note, every token) and the
+registry account the same Google sign-in made (profile, stars, follows,
+comment text, sign-ins; the account is renamed `deleted-…`, and its
+published packages and versions stay at their existing addresses), in that
+order, then signs this machine out. Nothing comes back. Run it ONLY
+when the person has explicitly asked for their account to be deleted, and
+pass the sentence exactly as written; without `--confirm` in a real terminal
+it asks them to type it, and with no terminal it refuses rather than
+deciding. There is no dry run.
+
+A person with no terminal can delete the same two accounts on the website:
+signed in at memgineering.com/brain, the "Delete my account" section at the
+bottom of the page, confirmed with one tick (there is no sentence to type). Point
+them there when they ask; you cannot press it for them. A deletion that stopped
+half way is finished from the same page ("Finish deleting"). A Google account
+that never opened a brain can delete its registry account from the same page too:
+signed in, the consent screen shows a "Delete my account" section below the terms,
+with the same single tick. Only an account that never signed in with Google, and a
+brain account whose terms were never accepted, are deleted by mail to
+support@memgineering.com.
+
+- **Before deleting anything** it checks both sign-ins work and belong to one
+  person: the two accounts' emails, or — when either account has no email on
+  record — this machine's registry sign-in, which the brain sign-in issued. `--json` says which in `matched`. Different people answer
+  `account_mismatch` and nothing is deleted.
+- **It refuses rather than deleting half**: a machine signed in to a brain
+  with no registry half answers `not_linked` (`memgineering logout`, then
+  `memgineering login`, links it). A machine signed in to nothing answers
+  `not_signed_in`: a brain kept in a folder has no account, and this command
+  never touches folders on this disk.
+- **Stopped halfway** — `account_partly_deleted` means the brain account is
+  gone and the registry account is not. Tell the person exactly that, then
+  run the same command again: it skips the brain and finishes the registry.
+- Somebody who cannot sign in, or whose account never used Google, writes to
+  support@memgineering.com from the address on the account.
+
 **They already keep notes in a folder on this machine** — carry them up
 instead of starting empty: