memgineering 0.7.4 → 0.8.0

package/CHANGELOG.md

@@ -11,6 +11,232 @@ language the reader wants. The bilingual rule the monorepo applies to
 
 ## [Unreleased]
 
+## [0.8.0] — 2026-08-23
+
+### Added
+
+- **`memgineering unlink --brain` stops reading the hosted brain.** There was no
+  way to clear that pointer — `use --brain ""` is refused and `logout` leaves it
+  in place on purpose — so a machine-wide setting had no way back to the state it
+  started in. Nothing on the server is touched, and it says so.
+- **`memgineering brains` names whose account it is and which server**, so
+  "what is this computer connected to" takes one command instead of three.
+- **`memgineering brains` lists the hosted brains on your account**, with a note
+  count and a creation date, and marks the one this machine reads. There was no
+  listing at all: the only way to learn the names was to pass one you knew was
+  wrong and read the refusal — and the sub-skill documented that as the
+  technique, so the docs taught guessing. `--json` carries `current` at the top
+  level. An absent count is `null` rather than `0`, because zero notes is an
+  empty brain and no count is a server that does not send one.
+
+- **`memgineering use --brain <name>` points this machine at a hosted brain.**
+  `push --brain` and `pull --brain` already took one by name and nothing could
+  point at one, so switching which brain you read meant pushing a folder into it
+  — an upload as the price of changing a setting. Takes a name or an id, says
+  which brain it stopped reading, and `--json` carries `changed` so "already
+  there" and "switched" are told apart. It does NOT create: pointing at a brain
+  that does not exist would leave every recall answering from an empty one, which
+  from the outside looks exactly like having lost the notes, so an unknown name is
+  refused with the account's list. A folder path, `--default` and `--here` are
+  refused alongside it rather than ignored — they bind a folder, and this is one
+  setting for the whole machine.
+
+### Fixed
+
+- **A note's own words can no longer start a line of memgineering's output.**
+  A title, a summary, a brain name — anything the tool prints inside a line —
+  is now folded onto one line first. It was not, and a value carrying a line
+  break ended the tool's sentence and began one of its own. In `recall` that
+  looked like an extra result card; whatever it said appeared to come from
+  memgineering rather than from the note. The tools reading this output are
+  agents, so that distinction is the whole point. Roughly 120 places across
+  every command, plus a test that fails if a new one is added. `--json` is
+  unchanged and still carries the full value, line breaks included.
+- **A hosted brain's name is stored as one line.** The server accepted a line
+  break in a name, so the same forged line reached every client, not just this
+  one. Names are folded rather than refused — a slash is still refused, because
+  a synced brain becomes a folder and a slash would make it two.
+
+- **`logout` now says your notes are untouched**, and that this machine keeps
+  which brain it was reading so a later `login` resumes. It said only that a
+  token was revoked, which is not the sentence somebody signing out is waiting
+  for.
+- **An unknown command is answered with commands.** `memgineering disconnect`
+  used to get "memgineering takes `--version` `--json`" — true, useless, and it
+  reads as though the tool has two features.
+- **`logout`'s description says it signs out of your account**, not "of a hosted
+  brain". That wording made three disconnect-shaped verbs indistinguishable.
+- **Unlinking the last brain no longer leaves a default naming it.**
+- **`MEMGINEERING_AGENT_HOME` is listed in `--help`.** It is what keeps `setup`
+  off a real machine, and it was the only one of five missing.
+
+- **A signed-out machine, and one whose token was rejected, are both told to sign
+  in rather than to make a new brain.** The refusal that names the account's
+  brains treated any failure the same way and fell back to "link a folder · or
+  start a new brain" — including for a 401, where the server has just confirmed
+  the account exists and the notes are on it. Only a server that cannot be
+  reached falls back now.
+- **That refusal cannot stall a command any more.** It makes one request with no
+  retry. It had inherited the ordinary 429 ladder — three retries sleeping the
+  server's `retry-after`, capped at a minute each — which on a rate-limited
+  server turned an instant offline answer into minutes and, past an agent's
+  command timeout, into a killed command rather than a refusal.
+- **`use --brain` on a machine with no account no longer points at `--local`,**
+  which it does not accept. It names `memgineering login --emit-only` instead.
+- **`use --brain <name>` refuses a flag written where the name goes.**
+  `use --brain --default` bound `--default` as the value, so the
+  cannot-combine check never ran, the command asked the server for a brain by
+  that name, and the refusal recommended `push --brain <name>` — which creates.
+  Following it produced a hosted brain literally called `--default`.
+- **`use --brain` moves the pointer when only the SERVER differs**, and prefers
+  an id over a name that merely looks like one. Both were silent wrong answers:
+  the first left the machine on the old host reporting "Already using", the
+  second resolved a different brain through the handle this command advertises
+  as unambiguous.
+- **`use --brain` says when the brain it just pointed at is empty.** The count
+  was in the response already. Pointing at an existing-but-empty brain produced
+  the same experience as pointing at one that does not exist — which is the thing
+  the no-create refusal exists to prevent.
+- **`push` no longer tells you there is no way to point back without uploading.**
+  0.8.0 added exactly that verb; the sentence now names it.
+- **The "not set up yet" notice stays quiet only for a pointer this machine can
+  actually read.** It checked that a hosted brain was named, not that it was on
+  the server currently configured — so a pointer left behind by a different host
+  silenced the notice on a machine that could answer nothing.
+- **"No brain is linked" no longer sends somebody whose notes are on their
+  account to create an empty one.** Signed in, holding hosted brains, and pointed
+  at none of them, the refusal offered `link` and `init` — and an agent that
+  follows `init` makes a third empty notebook and reports that the notes are
+  still gone. It now names the account's brains and `use --brain`, and says in as
+  many words not to run `init` for this. Found by fresh-context agents: three of
+  ten hit it, one on the ask "i think my notes are gone", which is exactly when
+  it fired. The offline refusal still stands unchanged when the account cannot be
+  reached, holds nothing, or `--local` was asked for.
+- **The "not set up yet" notice stops firing on a machine that is working.**
+  It reads `system.installed`, which records whether `setup` ran and says nothing
+  about whether this machine can read and write — so it printed above successful
+  output on every command. Worse, it tells the reading agent to run
+  `setup --agent`, which re-points the brain: the one action it demands would
+  undo a `use --brain` the user had just asked for. Ten of ten fresh agents saw
+  it over working output; four named running it as the trap they nearly walked
+  into. It now stands down whenever a hosted brain is pointed at.
+
+### Fixed
+
+- **Your standing rules now reach an agent before it edits a file on a machine
+  that reads a hosted brain.** `--rule` exists so a decision arrives before the
+  work rather than after somebody asks, and the hook that delivers it read only a
+  brain in a folder — so on a signed-in machine it delivered nothing. Measured on
+  a real account: `rules` answered seven and the hook answered none.
+- **A rule can no longer put its own line into an agent's instructions.** Rule
+  text lands there verbatim, and a newline in one produced a second line with no
+  bullet in front of it — from inside that context, indistinguishable from
+  something the tool wrote.
+- **Unlinking a folder no longer stops this machine reading its hosted brain.**
+  The config write rebuilt one object and dropped every key it did not name, and
+  the account pointer was one of them — so `unlink <folder>` sent every later
+  recall somewhere else with nothing on screen to explain it.
+- **`unlink` no longer says "no brain is linked yet" while `use` names a hosted
+  brain.** It asked only the resolver that knows about folders, so the two
+  commands answered a single state two opposite ways — and its advice was to
+  create a brain, which for somebody whose notes are already in one ends in a
+  third empty brain.
+- **`setup --dry-run` tells "nothing to change" apart from "no tools found".**
+  Both printed `Would change 0 file(s):` over an empty list. The second is what
+  an ordinary re-run looks like, so the common case read as the alarming one.
+
+### Agent guidance
+
+`memgineering-setup` documents the new verb. Restart your agent session after
+upgrading so it picks it up.
+
+## [0.7.5] — 2026-08-23
+
+### Fixed
+
+- **The approval list now shows the claim — what the note would say — above the
+  reason it is being changed.** `proposals approve` has no confirmation step: it
+  applies the change and shows the diff afterwards, so the list is the only
+  place a decision is made, and it was carrying the argument for a change while
+  withholding the change itself. Cut to one line on screen; whole under
+  `--json`. Null for `retire`, `unretire` and `reclassify`, which assert no
+  conclusion. Showing it for a **hosted** brain needs the brain server deployed
+  as well; against an older server the row says the claim is unavailable rather
+  than rendering as though the action had none. Brains in a folder need nothing.
+- **`consolidate` candidates name their notes.** A row gave an id and a path,
+  which say which FILE a candidate is about and nothing about what it says — so
+  you could not tell which notes a candidate was even about without opening both.
+  The row still does not carry their claims: deciding which of a pair is right
+  means reading them, and the row is what tells you which two to read.
+  Titles are cut at 72 characters with an ellipsis, so a short title and a
+  truncated one are never confusable. (Characters, not columns — a Korean title
+  is about twice as wide on screen.)
+- **`reindex` reports what it left out.** It listed notes refused for their name
+  or their content and said nothing about ones a `.memgignore` rule or a symlink
+  kept out of the index, so "✓ rebuilt 3 note(s)" could not answer "where is my
+  note". It now prints the same four-rule block `push` prints. `--json` gains
+  `not_indexed`, `denied_explicitly`, `excluded_by_rule` and `skipped_symlinks`
+  — the count is `not_indexed` rather than push's `not_sent`, because nothing is
+  sent from here.
+- **A title or claim cut mid-emoji no longer comes out as broken text.** The
+  truncation counted UTF-16 units, so a cut landing between the halves of a
+  surrogate pair emitted a lone surrogate. It counts characters now.
+- **A rule that excludes a FOLDER now names the folder.** `push` and `reindex`
+  both stop walking at an excluded directory, so the notes inside are never
+  enumerated — and both reported a held-back count of zero and printed nothing
+  else, so a brain whose entire archive was excluded looked exactly like a brain
+  that lost nothing. The count is still an honest floor; `excluded_folders` in
+  `--json` and a named line on screen say what it is a floor of.
+- **Note text is stripped of C1 controls and bidi format characters, on both
+  sides.** Only the `ESC`-introduced escape sequences were removed. A terminal in
+  8-bit mode reads U+009B and U+009D as the same two introducers with no `ESC`
+  byte; U+0085 is a line break, which broke the one-line guarantee the new title
+  and claim rows depend on; and a bidi override can make a line display in an
+  order its bytes do not have. U+2028 and U+2029 go too — `quoteBlock` splits on
+  `\n` alone, so a note containing one could resume outside the quote that marks
+  it as the note's words rather than the tool's. Escape sequences are read by
+  ECMA-48's grammar now rather than run to the next plausible-looking byte, so a
+  stray marker costs a few characters instead of the rest of the line. Measured:
+  one character before pure Hangul, two before `launchctl 로 한다`, five before
+  `21 August`, six before `123 abc` — against the whole remainder before. U+0085,
+  U+2028 and U+2029 are translated to a newline rather than dropped, so a break
+  in a stored note stays a break instead of welding the words on either side.
+- **Security: text pasted out of a terminal or a chat window can now be refused,
+  and a hidden character can no longer sneak a password past the check that looks
+  for one.** If a proposal or a `--reason` is rejected for carrying invisible
+  formatting, nothing was saved — retype the words as plain text and run it again.
+  What was wrong: the check read normalised text, and normalising could not
+  win: deleting the marker left its parameters between a label and its value,
+  and consuming the sequence deleted label characters instead — each fix opened
+  the other hole. The screen now refuses a proposal whose prose contains an
+  escape or control introducer at all, which has no such seam. The same rule now
+  guards `--reason` on every write verb: that text goes into the ledger, which is
+  permanent and travels with the brain. Note text itself is still stored rather
+  than refused — blocking a save is the worse trade on the main write path, where
+  the commonest source of a stray control byte is a mis-decoded file — and is
+  protected instead by the credential detector, which now reads the text with
+  control introducers removed as well as with them left in, so a label split by a
+  hidden byte is still seen as a label. That widening cuts both ways and the
+  second half is worth knowing: a note ALREADY on disk whose text hides a label
+  this way is now refused on READ, where 0.7.4 read it fine. Both codes involved
+  are weak ones, so `.memgallow` overrules them. The two copies of the normaliser are
+  hardened and a parity test compares them as source, because they had already
+  drifted once.
+
+### Changed
+
+- `reindex` lists markdown only where it used to list every denied path, on
+  screen and in `denied_by_name` alike, matching `push`. A denied `.env` was
+  never a note anybody expected in a note index.
+- `push`'s nothing-to-upload error no longer tells someone to check their path
+  when the path was right and their own folder rule emptied the brain.
+
+### Agent guidance
+
+`memgineering-writing` and `memgineering-setup` describe the claim row and what
+`reindex` now reports. Restart your agent session after upgrading so it picks
+them up.
+
 ## [0.7.4] — 2026-08-19
 
 ### Changed

package/assets/MEMGINEERING.md

@@ -2,7 +2,7 @@
 name: memgineering
 description: Use whenever the user refers to something they told you before, asks what was decided, tells you something worth keeping, or settles something that should hold next time. The memory lives in their own folder and outlives this session; check it before answering from guesswork, and write to it when you learn something durable.
 type: skill
-version: 0.7.4
+version: 0.8.0
 ---
 
 # memgineering

package/assets/memgineering-setup/SKILL.md

@@ -182,6 +182,31 @@ memgineering use --default ~/brains/work
 Inside a repository `use` writes a relative path, so it can be committed and
 resolves for a teammate who links the same brain.
 
+**An account can hold several hosted brains. `brains` lists them and
+`use --brain <name>` switches.**
+
+```
+memgineering brains                     # what the account holds, and which one this machine reads
+memgineering use --brain work           # name or id; nothing is uploaded
+```
+
+**Run `brains` before you switch, not after a guess.** It carries a note count
+and a creation date, which is what tells two brains apart when their names do
+not — and it marks the one this machine currently reads. `--json` puts that id
+at the top level as `current`, so you do not have to scan the array to answer
+the question you most often have. An absent `note_count` is `null` and not `0`:
+zero notes is an empty brain, and no count is a server too old to send one.
+
+It moves the one hosted brain this machine reads and touches no notes — `push`
+and `pull` are what move those. It does not create: an unknown name is refused
+with the account's list, because pointing at a brain that does not exist would
+have every recall answer from an empty one, and from the outside that looks like
+the notes are gone. Before this, `push --brain <name>` was the only thing that
+could move the pointer, so switching meant uploading a folder first.
+
+It refuses a folder path, `--default` or `--here` in the same call. Those bind a
+folder; this is one setting for the whole machine.
+
 **Do not give up on a write because the choice is ambiguous.** A refused
 `remember` means the thing they asked you to keep was not kept — ask which
 brain, or pass `--vault` for the write and settle the default afterwards.
@@ -282,7 +307,19 @@ and needs no model anywhere; that is a decision, not a gap.
 by hand in the ordinary case — writes keep the index in step on their own.
 `memgineering reindex` reaches either kind of brain: on a hosted one it backfills
 what is missing and clears stored rows for notes the brain has since been told
-not to read, reporting both; `--local` forces the folder brain. `--rebuild`
+not to read, reporting both; `--local` forces the folder brain. On a brain in a
+FOLDER it also names what it left out — notes a deny name, a `.memgignore` rule
+or a symlink kept from the index, and any folder a rule excluded whole — so "3
+notes rebuilt" is never the whole answer when a fourth was dropped. A hosted
+reindex cannot say that: the rules are applied on the machine that pushed, so
+the server only ever saw what arrived.
+
+Under `--json` that is `not_indexed` with `denied_by_name`, `denied_explicitly`,
+`excluded_by_rule`, `skipped_symlinks` and `excluded_folders`. **Read the count
+together with `excluded_folders`**: a rule that names a folder stops the walk at
+the folder, so nothing inside it is ever counted — `not_indexed: 0` beside a
+non-empty `excluded_folders` means the count is a floor, not the answer. `push`
+reports the same set with its total under `not_sent`. `--rebuild`
 exists for one situation only, where an embedding model changed the shape of its
 answers without changing its name and the index has to be laid down again.
 

package/assets/memgineering-writing/SKILL.md

@@ -140,8 +140,11 @@ only the last of them touches a note.
 memgineering consolidate        # what looks worth merging or reclassifying — reads only
 ```
 
-It returns pairs with the evidence that caught them and the action it would
-suggest, under four rules: `similar_title`; `shared_context`, one scope naming
+Each candidate names its notes — id, title, path — so you can tell WHICH notes
+it is about without opening them. It does not carry their claims, so deciding
+which of a pair is right still means reading them: two notes can share a title
+and hold opposite conclusions, which is exactly the case a proposal exists for. It returns them with the evidence that caught them and the action it
+would suggest, under four rules: `similar_title`; `shared_context`, one scope naming
 the same thing; `contradiction`, a disagreement nobody settled; and
 `kind_promotion`, a note marked as binding but filed as something other than a
 decision.
@@ -179,6 +182,14 @@ memgineering proposals reject <id>
 memgineering proposals rebase <id>
 ```
 
+**Read the list before you approve.** A row carries the claim — what the note
+would say — above the reason it is being changed. Three actions assert no
+conclusion and so have none: `retire`, `unretire` and `reclassify`. A row with no
+claim line is one of those, not a row that lost something. There is no confirmation step:
+`approve` applies the change and shows you the diff afterwards, so the list is
+where the decision is actually made. The claim is cut to one line on screen and
+whole under `--json`.
+
 `approve` is the only command in this flow that writes to a note, and it goes
 through the ledger like every other write — one `undo` away from not having
 happened. `approve` and `reject` each take `--reason`, and it is kept.