memoir-cli 3.11.3 → 3.14.0

package/src/session/state.js

@@ -1,3 +1,4 @@
+import { repositoryState } from '../memory/repository.js';
 // Session state: the canonical source of truth for "what are we working on"
 // across sessions and machines. Rendered into CLAUDE.md (and other tools) as a
 // pinned block at the top, guaranteed to load.
@@ -9,6 +10,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import crypto from 'crypto';
+import { projectIdentity, visibleMemory } from '../memory/scope.js';
 import { withSessionLock } from './lock.js';
 import { SCHEMA_VERSION, migrateSessionData, emptySession } from './migrations.js';
 // NOTE: events/log.js imports getMachineId FROM this module — this is a
@@ -33,12 +35,56 @@ export { SCHEMA_VERSION, emptySession };
 // Prevents unbounded growth of the live pinned block.
 const MAX_GOALS = 3;
 const MAX_NEXT = 8;
+// Overflow from next_actions goes here instead of vanishing. `slice(-MAX_NEXT)`
+// used to drop the oldest item with no warning, no event and no render hint:
+// three of the author's live next-actions disappeared in one week (2026-09-03
+// → 09-04) while the store sat at exactly 8. Parked items stay rendered and
+// completable; only when THIS list overflows is anything dropped, and that
+// emits an event.
+const MAX_PARKED = Infinity;
 // Completion tombstones kept so merges can't resurrect finished actions.
 // Must outlive every stale copy that might still carry the item.
-const MAX_COMPLETED_TOMBSTONES = 50;
+const MAX_COMPLETED_TOMBSTONES = Infinity;
 const MAX_QUESTIONS = 5;
 const MAX_DECISIONS_RECENT = 10;
-const MAX_HISTORY = 30;
+const MAX_HISTORY = Infinity;
+
+// ── Decision identity ────────────────────────────────────────────
+//
+// SPEC.md 5.1: a decision's identity is its normalized text. A PURGED
+// tombstone (memoir forget --purge) has had that text redacted, so it
+// carries `text_hash` = sha256(identity) instead and matches by hash.
+// Both forms resolve to the same key here so unionByText/capDecisions
+// treat "the original" and "the purged tombstone of the original" as one
+// identity — that is what lets the tombstone keep suppressing copies of
+// the un-purged text on replicas that never saw the purge.
+export const PURGED_TEXT = '[purged]';
+
+export function decisionIdentity(text) {
+  return String(text || '').trim().toLowerCase();
+}
+
+export function decisionHash(text) {
+  return crypto.createHash('sha256').update(decisionIdentity(text)).digest('hex');
+}
+
+function decisionKey(item) {
+  if (!item) return null;
+  if (item.text_hash) return 'sha256:' + item.text_hash + (item.project ? ':' + item.project : '');
+  if (!item.text) return null;
+  return 'sha256:' + decisionHash(item.text) + (item.project ? ':' + item.project : '');
+}
+
+// Cap decisions WITHOUT evicting tombstones. A plain `slice(0, cap)` after
+// an unshift meant the 11th note pushed the oldest hidden decision off the
+// list — and a dropped tombstone is a resurrection waiting for the next
+// merge with any replica still holding the un-hidden copy. Tombstones and
+// visible entries get separate budgets, same as unionByText below.
+function capDecisions(list = [], cap = MAX_DECISIONS_RECENT) {
+  const visible = list.filter((d) => d && !d.hidden).slice(0, cap);
+  const tombstones = list.filter((d) => d && d.hidden);
+  return [...visible, ...tombstones];
+}
 
 // ── Machine identity ─────────────────────────────────────────────
 
@@ -153,6 +199,7 @@ export async function readSession() {
 // critical section (see the mutators below and lock.js).
 export async function writeSession(state) {
   await fs.ensureDir(CONFIG_DIR);
+  partitionWorkingState(state);
   state.version = SCHEMA_VERSION;
   state.updated_at = new Date().toISOString();
   const tmp = `${SESSION_PATH}.tmp-${process.pid}`;
@@ -183,14 +230,23 @@ export async function addGoal(text) {
   return withSessionLock(SESSION_LOCK_PATH, async () => {
     const state = await readSession();
     const machineId = await touchMachine(state);
+    const key = decisionIdentity(text);
+    // Re-setting an existing goal moves it to the front; it is not a duplicate.
+    state.current.goals = (state.current.goals || []).filter((g) => decisionIdentity(g?.text) !== key || !visibleMemory(g));
     state.current.goals.unshift({
       text,
+      id: crypto.randomUUID(),
+      project: projectIdentity(),
       machine_id: machineId,
       set_on: new Date().toISOString(),
     });
-    state.current.goals = state.current.goals.slice(0, MAX_GOALS);
+    // The cap still applies (a pinned block with ten goals is no focus at
+    // all) but a replaced goal is reported, never silently dropped.
+    const replaced = state.current.goals.slice(MAX_GOALS);
+
     await writeSession(state);
-    await appendEvent('goal_set', {}); // no PII/content — count-and-type only
+    await appendEvent('goal_set', { replaced: replaced.length }); // no PII/content — count-and-type only
+    Object.defineProperty(state, 'replacedGoals', { value: replaced, enumerable: false });
     return state;
   });
 }
@@ -201,16 +257,73 @@ export async function addNext(text) {
     const machineId = await touchMachine(state);
     // Dedupe by text (case-insensitive)
     const normalized = text.trim().toLowerCase();
-    const exists = state.current.next_actions.some(a => a.text.trim().toLowerCase() === normalized);
+    const exists = state.current.next_actions.some(a => a.text.trim().toLowerCase() === normalized && visibleMemory(a));
+    let parked = [];
     if (!exists) {
+      // Re-adding a parked item is "bring it back", not a duplicate.
+      state.current.parked_actions = (state.current.parked_actions || [])
+        .filter((a) => a?.text?.trim().toLowerCase() !== normalized || !visibleMemory(a));
       state.current.next_actions.push({
         text,
-        machine_id: machineId,
+        id: crypto.randomUUID(),
+      project: projectIdentity(),
+      machine_id: machineId,
         added: new Date().toISOString(),
       });
-      state.current.next_actions = state.current.next_actions.slice(-MAX_NEXT);
+      ({ live: state.current.next_actions, parked } = parkOverflow(state.current.next_actions));
+      if (parked.length) {
+        const merged = [...parked, ...(state.current.parked_actions || [])];
+        const dropped = merged.slice(MAX_PARKED);
+        state.current.parked_actions = merged.slice(0, MAX_PARKED);
+        await appendEvent('next_parked', { count: parked.length, dropped: dropped.length });
+      }
     }
     await writeSession(state);
+    // Non-enumerable: callers can tell the user what was parked, nothing
+    // serialises it.
+    Object.defineProperty(state, 'justParked', { value: parked, enumerable: false });
+    return state;
+  });
+}
+
+// Split a next_actions list into the MAX_NEXT newest (live) and the overflow
+// (oldest first), stamping parked_at on the overflow. Pure; shared by
+// addNext and mergeSessions so both agree on what "full" means.
+function parkOverflow(list, cap = MAX_NEXT, now = new Date().toISOString()) {
+  if (list.length <= cap) return { live: list, parked: [] };
+  const overflow = list.slice(0, list.length - cap);
+  return {
+    live: list.slice(list.length - cap),
+    parked: overflow.map((a) => ({ ...a, parked_at: a.parked_at || now })),
+  };
+}
+
+/**
+ * Retire a goal. Same shape as completeNext: remove it AND record a
+ * temporal tombstone, because a plain removal comes straight back on the
+ * next union-merge with any copy that still carries it (the push-side
+ * backup, another machine). A goal re-set after its done_at survives.
+ */
+export async function completeGoal(match) {
+  return withSessionLock(SESSION_LOCK_PATH, async () => {
+    const state = await readSession();
+    await touchMachine(state);
+    const normalized = String(match).trim().toLowerCase();
+    state.current.goals = [...(state.current.goals || []), ...(state.current.archived_goals || [])];
+    state.current.archived_goals = [];
+    const idx = state.current.goals.findIndex(g => visibleMemory(g) && g?.text?.trim().toLowerCase().includes(normalized));
+    const completed = idx >= 0;
+    if (completed) {
+      const [removed] = state.current.goals.splice(idx, 1);
+      const key = removed.text.trim().toLowerCase();
+      state.current.completed_goals = [
+        { text: removed.text, project: removed.project, done_at: new Date().toISOString() },
+        ...(state.current.completed_goals || []).filter((c) => c && c.text && decisionKey(c) !== decisionKey(removed)),
+      ].slice(0, MAX_COMPLETED_TOMBSTONES);
+    }
+    await writeSession(state);
+    if (completed) await appendEvent('goal_completed', {});
+    Object.defineProperty(state, 'completed', { value: completed, enumerable: false });
     return state;
   });
 }
@@ -220,11 +333,17 @@ export async function completeNext(textOrIndex) {
     const state = await readSession();
     await touchMachine(state);
     let idx = -1;
+    let list = state.current.next_actions;
     if (typeof textOrIndex === 'number') {
-      idx = textOrIndex;
+      idx = list.map((item, index) => ({ item, index })).filter(x => visibleMemory(x.item))[textOrIndex]?.index ?? -1;
     } else {
       const normalized = String(textOrIndex).trim().toLowerCase();
-      idx = state.current.next_actions.findIndex(a => a.text.trim().toLowerCase().includes(normalized));
+      idx = list.findIndex(a => visibleMemory(a) && a.text.trim().toLowerCase().includes(normalized));
+      if (idx < 0) {
+        // Parked items are still real next-actions — finishing one must work.
+        list = state.current.parked_actions || [];
+        idx = list.findIndex(a => visibleMemory(a) && a?.text?.trim().toLowerCase().includes(normalized));
+      }
     }
     const completed = idx >= 0;
     if (completed) {
@@ -234,12 +353,12 @@ export async function completeNext(textOrIndex) {
       // bug. So completion also records a tombstone that merges consult.
       // Temporal, not absolute like decisions' `hidden`: a re-add whose
       // `added` postdates `done_at` is a deliberate revival and survives.
-      const [removed] = state.current.next_actions.splice(idx, 1);
+      const [removed] = list.splice(idx, 1);
       const key = removed.text.trim().toLowerCase();
       state.current.completed_actions = [
-        { text: removed.text, done_at: new Date().toISOString() },
+        { text: removed.text, project: removed.project, done_at: new Date().toISOString() },
         ...(state.current.completed_actions || []).filter(
-          c => c && c.text && c.text.trim().toLowerCase() !== key
+          c => c && c.text && decisionKey(c) !== decisionKey(removed)
         ),
       ].slice(0, MAX_COMPLETED_TOMBSTONES);
     }
@@ -256,6 +375,8 @@ export async function addNote(text, opts = {}) {
     const state = await readSession();
     const machineId = await touchMachine(state);
     const decision = {
+      id: crypto.randomUUID(),
+      project: projectIdentity(opts.project),
       text,
       machine_id: machineId,
       date: new Date().toISOString(),
@@ -263,7 +384,6 @@ export async function addNote(text, opts = {}) {
     if (opts.why) decision.why = opts.why;
     if (opts.rejected) decision.rejected = opts.rejected;
     state.current.decisions.unshift(decision);
-    state.current.decisions = state.current.decisions.slice(0, MAX_DECISIONS_RECENT);
     await writeSession(state);
     // Count/booleans only — never the decision text itself.
     await appendEvent('decision_captured', { has_why: !!opts.why, has_rejected: !!opts.rejected });
@@ -271,16 +391,76 @@ export async function addNote(text, opts = {}) {
   });
 }
 
+/**
+ * Find visible decisions matching a query — substring on text/why/rejected,
+ * or an exact identity match. Pure; shared by `memoir forget` and the
+ * memoir_forget MCP tool so both agree on what "matches" means.
+ */
+export function matchDecisions(state, query) {
+  const q = decisionIdentity(query);
+  if (!q) return [];
+  const decisions = allDecisions(state).filter((d) => d && d.text && visibleMemory(d));
+  const exact = decisions.filter((d) => decisionIdentity(d.text) === q);
+  if (exact.length) return exact;
+  return decisions.filter((d) =>
+    [d.text, d.why, d.rejected].filter(Boolean).join(' ').toLowerCase().includes(q)
+  );
+}
+
+/**
+ * Forget a decision: set the SPEC.md 5.3.1 absolute tombstone
+ * (`hidden: true` + `hidden_at`) on the decision whose identity is `text`.
+ *
+ * With `purge`, the text/why/rejected are also redacted in place and the
+ * entry keeps only `text_hash` as its identity — for when the thing to
+ * forget is a leaked secret and hiding it from render is not enough. The
+ * hash still lets the tombstone suppress un-purged copies on other
+ * replicas at merge time (see unionByText).
+ *
+ * Deliberately NOT a delete: removal does not survive union-merge (the
+ * exact bug 3.10.2 fixed for next_actions). And there is no un-forget —
+ * `hidden` is monotonic by spec, which is why the CLI confirms first.
+ */
+export async function hideDecision(text, { purge = false } = {}) {
+  return withSessionLock(SESSION_LOCK_PATH, async () => {
+    const state = await readSession();
+    await touchMachine(state);
+    const key = decisionIdentity(text);
+    state.current.decisions = allDecisions(state);
+    state.current.archived_decisions = [];
+    const idx = (state.current.decisions || []).findIndex(
+      (d) => d && d.text && visibleMemory(d) && decisionIdentity(d.text) === key
+    );
+    if (idx < 0) return { state, hidden: false };
+
+    const now = new Date().toISOString();
+    const d = state.current.decisions[idx];
+    const tomb = { ...d, hidden: true, hidden_at: now };
+    if (purge) {
+      tomb.text_hash = decisionHash(d.text);
+      tomb.text = PURGED_TEXT;
+      delete tomb.why;
+      delete tomb.rejected;
+    }
+    state.current.decisions[idx] = tomb;
+    await writeSession(state);
+    await appendEvent('decision_hidden', { purged: !!purge });
+    return { state, hidden: true, purged: !!purge };
+  });
+}
+
 export async function addQuestion(text) {
   return withSessionLock(SESSION_LOCK_PATH, async () => {
     const state = await readSession();
     const machineId = await touchMachine(state);
     state.current.open_questions.push({
       text,
+      id: crypto.randomUUID(),
+      project: projectIdentity(),
       machine_id: machineId,
       asked: new Date().toISOString(),
     });
-    state.current.open_questions = state.current.open_questions.slice(-MAX_QUESTIONS);
+
     await writeSession(state);
     return state;
   });
@@ -288,17 +468,32 @@ export async function addQuestion(text) {
 
 // Roll up the current state into a history entry. Use at session end / push.
 // Does not clear `current` — these are "the working set," not per-session scratch.
-export async function recordSessionEnd({ summary, filesTouched = [], durationMin = null } = {}) {
+export async function recordSessionEnd({ summary, filesTouched = [], durationMin = null, sessionId = null, project } = {}) {
   return withSessionLock(SESSION_LOCK_PATH, async () => {
     const state = await readSession();
     const machineId = await touchMachine(state);
-    state.history.unshift({
+    const entry = {
       date: new Date().toISOString(),
       machine_id: machineId,
+      project: projectIdentity(project),
       summary: summary || '',
       files_touched: filesTouched.slice(0, 20),
       duration_min: durationMin,
-    });
+    };
+    const repo = repositoryState(project || process.env.MEMOIR_PROJECT_ROOT || process.cwd());
+    entry.repo_head = repo.head;
+    entry.branch = repo.branch;
+    entry.working_tree_dirty = repo.dirty;
+    if (sessionId) entry.session_id = sessionId;
+    // Autopush fires after every response, so one long session used to fill
+    // all five "Recent sessions" rows with itself. Same session → update its
+    // row in place (duration and files grow), don't add another.
+    const existing = sessionId ? state.history.findIndex((h) => h?.session_id === sessionId) : -1;
+    if (existing >= 0) {
+      entry.date = state.history[existing].date || entry.date;
+      state.history.splice(existing, 1);
+    }
+    state.history.unshift(entry);
     state.history = state.history.slice(0, MAX_HISTORY);
     await writeSession(state);
     return state;
@@ -320,14 +515,47 @@ export function mergeSessions(local, remote) {
     updated_at: latest(local.updated_at, remote.updated_at),
     machines: { ...remote.machines, ...local.machines }, // local wins for same machine
     current: {
-      goals: unionByText(local.current?.goals, remote.current?.goals, 'set_on', MAX_GOALS),
-      next_actions: unionByText(local.current?.next_actions, remote.current?.next_actions, 'added', MAX_NEXT),
-      open_questions: unionByText(local.current?.open_questions, remote.current?.open_questions, 'asked', MAX_QUESTIONS),
-      decisions: unionByText(local.current?.decisions, remote.current?.decisions, 'date', MAX_DECISIONS_RECENT),
+      goals: unionByText([...(local.current?.goals || []), ...(local.current?.archived_goals || [])], [...(remote.current?.goals || []), ...(remote.current?.archived_goals || [])], 'set_on', Infinity),
+      archived_goals: [],
+      // Live + parked from both sides pooled, then re-split below: the
+      // MAX_NEXT newest are live, the rest parked. A capped union here used
+      // to evict the oldest on merge just as silently as addNext did.
+      next_actions: unionByText(
+        [...(local.current?.next_actions || []), ...(local.current?.parked_actions || [])],
+        [...(remote.current?.next_actions || []), ...(remote.current?.parked_actions || [])],
+        'added', Infinity),
+      parked_actions: [],
+      open_questions: unionByText([...(local.current?.open_questions || []), ...(local.current?.archived_questions || [])], [...(remote.current?.open_questions || []), ...(remote.current?.archived_questions || [])], 'asked', Infinity),
+      archived_questions: [],
+      decisions: unionByText(allDecisions(local), allDecisions(remote), 'date', Infinity),
+      archived_decisions: [],
     },
     history: mergeHistory(local.history, remote.history),
   };
 
+  // Fields this build does not know about pass through from the local copy
+  // instead of being dropped. `current` is rebuilt from known keys above, so
+  // a merge performed by an OLDER memoir silently erased anything newer —
+  // live proof: minutes after 3.13.0 added parked_actions and
+  // completed_goals, a Stop-hook push still running 3.12 rebuilt `current`
+  // without them and wrote that back locally, undoing two goal retirements
+  // and a parked item. Local wins over remote for unknown keys because an
+  // old build cannot merge what it cannot read.
+  const KNOWN_CURRENT = new Set(['goals', 'next_actions', 'parked_actions', 'open_questions', 'decisions', 'archived_decisions', 'archived_goals', 'archived_questions', 'completed_actions', 'completed_goals']);
+  for (const src of [remote.current || {}, local.current || {}]) {
+    for (const [k, v] of Object.entries(src)) {
+      if (!KNOWN_CURRENT.has(k)) merged.current[k] = v;
+    }
+  }
+
+  // Goal tombstones — same temporal rule as next_actions below.
+  const goalTombstones = unionTombstones(local.current?.completed_goals, remote.current?.completed_goals);
+  merged.current.completed_goals = goalTombstones;
+  merged.current.goals = merged.current.goals.filter((g) => {
+    const t = goalTombstones.find((c) => decisionKey(c) === decisionKey(g));
+    return !t || new Date(g.set_on || 0) > new Date(t.done_at);
+  });
+
   // Completed-action tombstones beat the union above. unionByText can only
   // union; it cannot represent "this used to exist and was finished," so a
   // completed item surviving in ANY stale copy resurrected on every merge —
@@ -342,10 +570,16 @@ export function mergeSessions(local, remote) {
   merged.current.completed_actions = tombstones;
   merged.current.next_actions = merged.current.next_actions.filter(a => {
     const t = tombstones.find(
-      c => c.text.trim().toLowerCase() === a.text.trim().toLowerCase()
+      c => decisionKey(c) === decisionKey(a)
     );
     return !t || new Date(a.added || 0) > new Date(t.done_at);
   });
+  // unionByText returns newest-first; next_actions is stored oldest-first
+  // (render reverses). Re-split into live (newest MAX_NEXT) and parked.
+  const pooled = [...merged.current.next_actions].reverse();
+  const split = parkOverflow(pooled);
+  merged.current.next_actions = split.live.map((a) => { const { parked_at, ...rest } = a; return rest; });
+  merged.current.parked_actions = split.parked.reverse().slice(0, MAX_PARKED);
 
   // machines: union last_seen per id (take the newer)
   for (const [id, entry] of Object.entries(remote.machines || {})) {
@@ -355,20 +589,33 @@ export function mergeSessions(local, remote) {
     }
   }
 
+  partitionWorkingState(merged);
   return merged;
 }
 
 function unionByText(a = [], b = [], dateField, cap) {
   const byText = new Map();
+  // Identity is normalized text (SPEC 5.1). Keyed through decisionKey so a
+  // PURGED decision tombstone — text redacted, `text_hash` kept — lands on
+  // the same key as the un-purged copies it must keep suppressing. For
+  // goals/next_actions/questions (no purge concept) this is just a hash of
+  // the same normalized text and behaves exactly as before.
   for (const item of [...a, ...b]) {
-    if (!item || !item.text) continue;
-    const key = item.text.trim().toLowerCase();
+    const key = decisionKey(item);
+    if (!key) continue;
     const existing = byText.get(key);
     if (!existing || new Date(item[dateField] || 0) > new Date(existing[dateField] || 0)) {
       byText.set(key, item);
     }
   }
 
+  const stones = [...a, ...b].filter(i => i?.hidden);
+  for (const [key, item] of byText) {
+    if (item.project || item.hidden) continue;
+    const hash = item.text_hash || decisionHash(item.text);
+    if (stones.some(t => t.project && (t.text_hash || decisionHash(t.text)) === hash)) byText.delete(key);
+  }
+
   // A tombstone is STICKY: once any machine marks an entry hidden, the merged
   // result stays hidden, whatever the dates say.
   //
@@ -379,12 +626,17 @@ function unionByText(a = [], b = [], dateField, cap) {
   // the tombstoned copy doesn't even win the date comparison.) Suppression has
   // to be monotonic or it isn't suppression — you'd be re-hiding the same junk
   // on every machine forever.
+  //
+  // A PURGED tombstone wins outright — never let a date-winning un-purged
+  // copy carry the redacted text back into the merged result. Purge is
+  // "this text must leave the file"; the merged entry must be the purged one.
   for (const [key, winner] of byText) {
-    if (winner.hidden) continue;
-    const tombstone = [...a, ...b].find(
-      (i) => i && i.text && i.text.trim().toLowerCase() === key && i.hidden
-    );
-    if (tombstone) {
+    const stones = [...a, ...b].filter((i) => i && i.hidden && decisionKey(i) === key);
+    if (!stones.length) continue;
+    const tombstone = stones.find((i) => i.text_hash) || stones[0];
+    if (tombstone.text_hash) {
+      byText.set(key, tombstone);
+    } else if (!winner.hidden) {
       byText.set(key, { ...winner, hidden: true, hidden_at: tombstone.hidden_at });
     }
   }
@@ -396,8 +648,8 @@ function unionByText(a = [], b = [], dateField, cap) {
   // not count against the visible budget.
   const all = Array.from(byText.values())
     .sort((x, y) => new Date(y[dateField] || 0) - new Date(x[dateField] || 0));
-  const visible = all.filter((i) => !i.hidden).slice(0, cap);
-  const tombstones = all.filter((i) => i.hidden).slice(0, cap);
+  const visible = all.filter((i) => !i.hidden).slice(0, cap === Infinity ? undefined : cap);
+  const tombstones = all.filter((i) => i.hidden);
   return [...visible, ...tombstones];
 }
 
@@ -405,7 +657,7 @@ function unionTombstones(a = [], b = []) {
   const byText = new Map();
   for (const item of [...(a || []), ...(b || [])]) {
     if (!item || !item.text || !item.done_at) continue;
-    const key = item.text.trim().toLowerCase();
+    const key = decisionKey(item);
     const existing = byText.get(key);
     if (!existing || new Date(item.done_at) > new Date(existing.done_at)) {
       byText.set(key, item);
@@ -420,8 +672,10 @@ function mergeHistory(a = [], b = []) {
   const seen = new Set();
   const all = [...a, ...b].filter(h => h && h.date);
   // Dedupe by (date + machine_id + summary) — the three keys that make a session unique
-  const unique = all.filter(h => {
-    const key = `${h.date}|${h.machine_id}|${(h.summary || '').slice(0, 50)}`;
+  // Newest copy of a session_id wins (in-place updates change summary/duration).
+  const sorted = all.sort((x, y) => new Date(y.date) - new Date(x.date));
+  const unique = sorted.filter(h => {
+    const key = h.session_id ? `sid:${h.session_id}` : `${h.date}|${h.machine_id}|${(h.summary || '').slice(0, 50)}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -451,3 +705,20 @@ export const paths = {
   machineId: MACHINE_ID_PATH,
   sessionLock: SESSION_LOCK_PATH,
 };
+
+export function allDecisions(state) {
+  return [...(state?.current?.decisions || []), ...(state?.current?.archived_decisions || [])];
+}
+
+function partitionWorkingState(state) {
+  state.current ||= {};
+  for (const [live, archive, date, cap] of [
+    ['decisions', 'archived_decisions', 'date', MAX_DECISIONS_RECENT],
+    ['goals', 'archived_goals', 'set_on', MAX_GOALS],
+    ['open_questions', 'archived_questions', 'asked', MAX_QUESTIONS],
+  ]) {
+    const all = unionByText(state.current[live], state.current[archive], date, Infinity);
+    state.current[live] = capDecisions(all, cap);
+    state.current[archive] = all.filter(item => !item.hidden).slice(cap);
+  }
+}

package/src/work/cli.js

@@ -0,0 +1,64 @@
+import { Command } from 'commander';
+import { recordWork, runWorkCheck, retractWork, refreshWork, formatWork } from './store.js';
+import { setupWork } from './setup.js';
+import { readSafeFile } from '../security/files.js';
+
+export async function workCli(argv) {
+  const program = new Command('memoir work').description('Local project continuity for Codex and Cursor')
+    .option('--project <path>', 'Project directory', process.env.MEMOIR_PROJECT_ROOT || process.cwd());
+  const project = () => program.opts().project;
+  program.command('setup').option('--tools <names>', 'codex,cursor', 'codex,cursor').action(async options => {
+    console.log(JSON.stringify(await setupWork(project(), { tools: options.tools.split(',') }), null, 2));
+  });
+  program.command('resume').option('--json', 'Structured context').action(async options => {
+    const view = await refreshWork(project());
+    console.log(options.json ? JSON.stringify(view, null, 2) : formatWork(view));
+  });
+  program.command('view').description('Review and correct project memory in a local browser')
+    .option('--no-open', 'Print the local link without opening a browser').option('--port <number>', 'Local port; 0 chooses an available port', '0').action(async options => {
+      const { startWorkView } = await import('./view.js');
+      const view = await startWorkView(project(), { port: Number(options.port) });
+      console.log(`Memoir project view: ${view.url}\nOnly this computer. Keep this terminal open; press Ctrl+C to stop.`);
+      if (options.open) {
+        const { spawn } = await import('node:child_process');
+        const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+        const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', view.url] : [view.url];
+        const child = spawn(command, args, { stdio:'ignore', shell:false });
+        child.on('error', () => console.error('Open the local link above in your browser.'));
+      }
+      const stop = async () => { await view.close(); process.exitCode = 0; };
+      process.once('SIGINT', stop); process.once('SIGTERM', stop);
+    });
+  program.command('record').option('--json <record>', 'Project record JSON').option('--file <path>', 'Project-relative JSON file; - reads stdin').action(async options => {
+    if (Boolean(options.json) === Boolean(options.file)) throw new Error('Provide exactly one of --json or --file.');
+    let raw = options.json;
+    if (options.file === '-') {
+      const chunks = []; let bytes = 0;
+      for await (const chunk of process.stdin) {
+        bytes += chunk.length;
+        if (bytes > 16384) throw new Error('Project record input exceeds 16 KiB. Nothing was saved.');
+        chunks.push(chunk);
+      }
+      raw = Buffer.concat(chunks).toString();
+    }
+    else if (options.file) raw = (await readSafeFile(project(), options.file, { maxBytes: 16384 })).toString();
+    if (Buffer.byteLength(raw) > 16384) throw new Error('Project record input exceeds 16 KiB. Nothing was saved.');
+    const record = await recordWork(project(), JSON.parse(raw));
+    await refreshWork(project());
+    console.log(JSON.stringify(record, null, 2));
+  });
+  program.command('check <id> [argv...]').requiredOption('--title <text>', 'What the check proves').requiredOption('--files <paths...>', 'All relevant source/test inputs')
+    .option('--environment <name>', 'local or external', 'local').option('--timeout <ms>', 'Time limit', '30000').action(async (id, command, options) => {
+      const result = await runWorkCheck(project(), { id, title: options.title, files: options.files, command, environment: options.environment, timeout_ms: Number(options.timeout) });
+      await refreshWork(project());
+      console.log(JSON.stringify(result, null, 2));
+      if (result.exit_code !== 0 || result.timed_out || !result.inputs_stable) process.exitCode = 1;
+    });
+  program.command('retract <id>').requiredOption('--revision <number>', 'Current record revision').option('--category <name>', 'record or check', 'record').action(async (id, options) => {
+    const result = await retractWork(project(), { id, expected_revision: Number(options.revision), category: options.category });
+    await refreshWork(project());
+    console.log(JSON.stringify(result));
+  });
+  program.exitOverride();
+  await program.parseAsync(argv, { from: 'user' });
+}

package/src/work/errors.js

@@ -0,0 +1,8 @@
+// Parser and filesystem messages can contain snippets of damaged secret files.
+// Only our fixed domain errors may pass through to the client.
+export function workErrorMessage(error) {
+  if (error instanceof SyntaxError) return 'Invalid project handoff JSON. Original file was preserved; contents were not returned.';
+  if (error?.name === 'ZodError' || error instanceof TypeError) return 'Invalid project record or evidence. Check the schema; original data was preserved.';
+  if (error?.code && error.code !== 'ELOCKED') return 'Project operation failed. Check file access and command arguments locally; file contents were not returned.';
+  return error?.message || 'Project operation failed.';
+}

package/src/work/server.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// Deliberately exposes only the connected project's continuation records.
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { z } from 'zod';
+import { workRoot, recordSchema, checkSchema, recordWork, retractWork, refreshWork, formatWork } from './store.js';
+import { workErrorMessage } from './errors.js';
+
+const project = await workRoot(process.env.MEMOIR_PROJECT_ROOT || process.cwd());
+const server = new McpServer({ name: 'memoir-work', version: '1.0.0' });
+const respond = handler => async args => {
+  try {
+    const value = await handler(args);
+    const view = await refreshWork(project);
+    return { content: [{ type: 'text', text: value ? JSON.stringify(value) : formatWork(view) }] };
+  } catch (error) {
+    // Never echo rejected input, which might contain credentials.
+    return { isError: true, content: [{ type: 'text', text: workErrorMessage(error) }] };
+  }
+};
+server.tool('memoir_work_resume', 'Read this project and branch: answered questions, decisions, next actions and checks with current input comparisons. Call before asking repeated questions or rerunning saved checks.', {}, respond(async () => null));
+server.tool('memoir_work_record', 'Save a project-only goal, answer, decision or next action. Never save personal preferences or secrets. Read first; corrections require the current expected_revision. Source must identify the actual user statement or project evidence. This cannot claim a test passed.', { record: recordSchema }, respond(async ({ record }) => recordWork(project, record)));
+// An MCP server runs with its own host privileges, not necessarily the coding
+// client's terminal sandbox. Never turn this memory connection into a shell.
+// Keep the old tool name to give existing clients a safe migration response.
+server.tool('memoir_work_check', 'Command execution is disabled over MCP. Run memoir work check through the client’s normal terminal permission/sandbox route to capture execution evidence.', { check: checkSchema }, async () => ({ isError: true, content: [{ type: 'text', text: 'MCP command execution is disabled. Use the memoir work check CLI documented in project AGENTS.md through your normal terminal permissions. This memory connection does not grant shell access.' }] }));
+server.tool('memoir_work_retract', 'Remove a mistaken record from the current handoff; its history remains locally for correction. Read its current revision first.', { id: z.string(), category: z.enum(['record', 'check']).default('record'), expected_revision: z.number().int() }, respond(async input => retractWork(project, input)));
+await server.connect(new StdioServerTransport());