memoir-cli 3.11.3 → 3.14.0

package/src/commands/consolidate.js

@@ -1,3 +1,5 @@
+import crypto from 'crypto';
+import { readSafeFile, writeSafeFile, safePath } from '../security/files.js';
 import chalk from 'chalk';
 import fs from 'fs-extra';
 import path from 'path';
@@ -21,7 +23,7 @@ async function readMemoryFiles(adapter) {
       const filePath = path.join(adapter.source, file);
       if (await fs.pathExists(filePath)) {
         try {
-          const content = await fs.readFile(filePath, 'utf8');
+          const content = (await readSafeFile(adapter.source, file)).toString('utf8');
           const stat = await fs.stat(filePath);
           files.push({ path: file, fullPath: filePath, content, tool: adapter.name, icon: adapter.icon, mtime: stat.mtimeMs, size: content.length });
         } catch {}
@@ -44,10 +46,10 @@ async function readMemoryFiles(adapter) {
         if (adapter.filter(fullPath)) {
           await walk(fullPath, relPath);
         }
-      } else if (/\.(md|json|yml|yaml)$/.test(entry.name)) {
+      } else if (entry.isFile() && /\.(md|json|yml|yaml)$/.test(entry.name)) {
         if (adapter.filter(fullPath)) {
           try {
-            const content = await fs.readFile(fullPath, 'utf8');
+            const content = (await readSafeFile(adapter.source, relPath)).toString('utf8');
             const stat = await fs.stat(fullPath);
             files.push({ path: relPath, fullPath, content, tool: adapter.name, icon: adapter.icon, mtime: stat.mtimeMs, size: content.length });
           } catch {}
@@ -148,7 +150,7 @@ async function llmConsolidate(allFiles, apiKey) {
   const memoryDigest = allFiles
     .filter(f => f.content.trim().length > 10)
     .map(f => `[${f.tool} / ${f.path}] (${daysAgo(f.mtime)}d old, ${f.size}B)\n${f.content.slice(0, 500)}${f.content.length > 500 ? '...' : ''}`)
-    .join('\n\n---\n\n');
+    .join('\n\n---\n\n').slice(0, 64000);
 
   const prompt = `You are a memory consolidation engine. Analyze these AI tool memory files and produce a consolidation report.
 
@@ -176,8 +178,11 @@ Rules:
 - Be conservative — when in doubt, keep the memory
 - Return valid JSON only, no markdown fences`;
 
-  const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${apiKey}`, {
+  const model = process.env.MEMOIR_CONSOLIDATE_MODEL || 'gemini-2.0-flash';
+  if (!/^[a-z0-9.-]+$/i.test(model)) throw new Error('Invalid consolidation model');
+  const response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${apiKey}`, {
     method: 'POST',
+    signal: AbortSignal.timeout(30000),
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
       contents: [{ parts: [{ text: prompt }] }],
@@ -316,7 +321,7 @@ async function applyPrune(files, allFiles) {
   const { toDelete } = await inquirer.prompt([{
     type: 'checkbox',
     name: 'toDelete',
-    message: 'Select memories to delete:',
+    message: 'Select memories to archive:',
     choices
   }]);
 
@@ -328,7 +333,7 @@ async function applyPrune(files, allFiles) {
   const { confirm } = await inquirer.prompt([{
     type: 'confirm',
     name: 'confirm',
-    message: `Delete ${toDelete.length} file(s)? This cannot be undone.`,
+    message: `Delete ${toDelete.length} file(s)? A recovery copy will be saved locally.`,
     default: false
   }]);
 
@@ -340,7 +345,7 @@ async function applyPrune(files, allFiles) {
   let deleted = 0;
   for (const file of toDelete) {
     try {
-      await fs.remove(file.fullPath);
+      await archiveFile(file);
       console.log(chalk.red(`  ✖ Deleted: ${file.tool}/${file.path}`));
       deleted++;
     } catch (err) {
@@ -355,6 +360,10 @@ async function applyMerge(duplicateGroups, allFiles) {
   let merged = 0;
 
   for (const group of duplicateGroups) {
+    if (!group.every(file => file.content === group[0].content && file.tool === group[0].tool)) {
+      console.log(chalk.gray('  Similar or cross-tool files need a reviewed merge; no files removed.'));
+      continue;
+    }
     console.log(chalk.gray('\n  ┌ Duplicate group:'));
     for (const f of group) {
       console.log(`  │ ${f.icon} ${chalk.cyan(f.tool)}/${chalk.white(f.path)} ${chalk.gray(`(${daysAgo(f.mtime)}d old)`)}`);
@@ -375,13 +384,13 @@ async function applyMerge(duplicateGroups, allFiles) {
       type: 'confirm',
       name: 'confirm',
       message: `Remove ${remove.length} duplicate(s), keep the newest?`,
-      default: true
+      default: false
     }]);
 
     if (confirm) {
       for (const r of remove) {
         try {
-          await fs.remove(r.fullPath);
+          await archiveFile(r);
           console.log(chalk.red(`  ✖ Removed: ${r.tool}/${r.path}`));
           merged++;
         } catch (err) {
@@ -397,6 +406,7 @@ async function applyMerge(duplicateGroups, allFiles) {
 // ── Main Command ─────────────────────────────────────────────────────────────
 
 export async function consolidateCommand(options = {}) {
+  if (options.undo) return undoArchive(options.undo);
   console.log();
   const spinner = ora({ text: chalk.gray('Scanning memories across all tools...'), spinner: 'dots' }).start();
 
@@ -475,3 +485,32 @@ export async function consolidateCommand(options = {}) {
     }
   }
 }
+
+const archiveRoot = path.join(home, '.config', 'memoir', 'consolidation-history');
+
+export async function archiveFile(file) {
+  const adapter = adapters.find(a => a.name === file.tool);
+  if (!adapter) throw new Error('Unknown adapter');
+  const content = await readSafeFile(adapter.source, file.path);
+  if (content.toString('utf8') !== file.content) throw new Error('Memory changed since analysis; run analysis again');
+  const id = crypto.randomUUID();
+  await writeSafeFile(archiveRoot, id + '.json', JSON.stringify({
+    tool: adapter.name, path: file.path, content: content.toString('base64'), date: new Date().toISOString(),
+  }));
+  await fs.unlink(await safePath(adapter.source, file.path));
+  console.log('  Undo with: memoir consolidate --undo ' + id);
+  return id;
+}
+
+export async function undoArchive(id) {
+  if (!/^[a-f0-9-]{36}$/.test(id)) throw new Error('Invalid archive ID');
+  const entry = JSON.parse((await readSafeFile(archiveRoot, id + '.json')).toString());
+  const adapter = adapters.find(a => a.name === entry.tool);
+  if (!adapter || (adapter.customExtract ? !adapter.files.includes(entry.path) : !adapter.filter(path.join(adapter.source, entry.path)))) throw new Error('Archive target is outside the adapter allowlist');
+  try {
+    await readSafeFile(adapter.source, entry.path);
+    throw new Error('The target exists; review it before restoring the archive');
+  } catch (err) { if (err.code !== 'ENOENT') throw err; }
+  await writeSafeFile(adapter.source, entry.path, Buffer.from(entry.content, 'base64'));
+  console.log('Restored archived memory ' + id);
+}

package/src/commands/diff.js

@@ -4,7 +4,7 @@ import path from 'path';
 import os from 'os';
 import ora from 'ora';
 import boxen from 'boxen';
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import { getConfig } from '../config.js';
 import { adapters } from '../adapters/index.js';
 
@@ -63,7 +63,7 @@ export async function diffCommand(options = {}) {
 
   try {
     if (config.provider === 'git') {
-      execSync(`git clone --depth 1 ${config.gitRepo} .`, { cwd: stagingDir, stdio: 'ignore' });
+      execFileSync('git', ['clone', '--depth', '1', '--', config.gitRepo, '.'], { cwd: stagingDir, stdio: 'ignore' });
     } else {
       const resolvedSource = config.localPath.replace(/^~/, os.homedir());
       if (!(await fs.pathExists(resolvedSource))) {

package/src/commands/doctor.js

@@ -5,7 +5,7 @@ import boxen from 'boxen';
 import ora from 'ora';
 import gradient from 'gradient-string';
 import os from 'os';
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import { getConfig } from '../config.js';
 import { adapters } from '../adapters/index.js';
 import { scanForSecrets as scanTextForSecrets } from '../security/scanner.js';
@@ -100,7 +100,7 @@ export async function doctorCommand(options = {}) {
   if (config?.provider === 'git' && gitInstalled && config.gitRepo) {
     spinner.text = 'Testing remote connectivity...';
     try {
-      execSync(`git ls-remote ${config.gitRepo} HEAD`, { stdio: 'pipe', timeout: 10000 });
+      execFileSync('git', ['ls-remote', config.gitRepo, 'HEAD'], { stdio: 'pipe', timeout: 10000 });
       lines.push(pass(`Remote: ${chalk.gray(config.gitRepo)} reachable`));
     } catch {
       lines.push(fail(`Remote: cannot reach ${chalk.gray(config.gitRepo)}`));
@@ -185,7 +185,7 @@ export async function doctorCommand(options = {}) {
     lines.push(chalk.bold.white('  Last Sync'));
     try {
       const tmpDir = path.join(os.tmpdir(), 'memoir-doctor-' + Date.now());
-      execSync(`git clone --depth 1 ${config.gitRepo} ${tmpDir}`, { stdio: 'pipe', timeout: 15000 });
+      execFileSync('git', ['clone', '--depth', '1', '--', config.gitRepo, tmpDir], { stdio: 'pipe', timeout: 15000 });
       const lastCommit = execSync('git log -1 --format=%cr', { cwd: tmpDir, stdio: 'pipe' }).toString().trim();
       const lastMsg = execSync('git log -1 --format=%s', { cwd: tmpDir, stdio: 'pipe' }).toString().trim();
       await fs.remove(tmpDir);

package/src/commands/forget.js

@@ -0,0 +1,100 @@
+// `memoir forget <text>` — retract a decision.
+//
+// Sets the SPEC.md 5.3.1 absolute tombstone (hidden + hidden_at). Before
+// 3.12 the ONLY thing that could do this was an unshipped dev script, so a
+// user who auto-captured junk — or a secret — into the pinned block had no
+// way to take it back. Now they do.
+//
+// Two rules that make this safe:
+//   • Ambiguity is refused. Substring matching is convenient (same as
+//     `memoir done`) but hiding is permanent by spec — hidden is monotonic
+//     across every replica — so if more than one visible decision matches
+//     we list them and ask for a more specific string, never guess.
+//   • Interactive runs confirm before hiding. --yes skips that for scripts.
+//
+// --purge additionally redacts the text in place (keeps a sha256 identity
+// so the tombstone still merges). Use it when the text itself must leave
+// the file — a pasted key, a client name — not just leave the render.
+
+import chalk from 'chalk';
+import boxen from 'boxen';
+import readline from 'readline';
+import { readSession, matchDecisions, hideDecision } from '../session/state.js';
+import { renderSession } from '../session/render.js';
+import { injectInto, detectAvailableTargets } from '../session/inject.js';
+
+async function refreshPinned() {
+  const state = await readSession();
+  const rendered = renderSession(state);
+  const targets = detectAvailableTargets();
+  for (const target of Object.values(targets)) {
+    try { await injectInto(target, rendered); } catch {}
+  }
+}
+
+function describe(d) {
+  const lines = [chalk.white.bold(`  ${d.text}`)];
+  if (d.why) lines.push(chalk.gray('    why: ') + chalk.white(d.why));
+  if (d.rejected) lines.push(chalk.gray('    rejected: ') + chalk.white(d.rejected));
+  if (d.date) lines.push(chalk.gray(`    ${String(d.date).slice(0, 10)}`));
+  return lines.join('\n');
+}
+
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => rl.question(question, resolve));
+  rl.close();
+  return /^y(es)?$/i.test(String(answer).trim());
+}
+
+export async function forgetCommand(text, options = {}) {
+  const query = String(text || '').trim();
+  if (!query) {
+    console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir forget "substring of the decision" [--purge] [--yes]\n'));
+    return;
+  }
+
+  const state = await readSession();
+  const matches = matchDecisions(state, query);
+
+  if (matches.length === 0) {
+    console.log('\n' + boxen(
+      chalk.yellow(`No visible decision matches "${query}".`) + '\n\n' +
+      chalk.gray('See what is recorded with: ') + chalk.cyan('memoir why'),
+      { padding: 1, borderStyle: 'round', borderColor: 'yellow' }
+    ) + '\n');
+    return;
+  }
+
+  if (matches.length > 1) {
+    console.log('\n' + chalk.yellow(`  "${query}" matches ${matches.length} decisions — be more specific, forgetting is permanent:`) + '\n');
+    for (const d of matches) console.log(describe(d) + '\n');
+    return;
+  }
+
+  const [target] = matches;
+  console.log('\n' + chalk.cyan.bold(options.purge ? '  About to forget AND purge:' : '  About to forget:') + '\n');
+  console.log(describe(target) + '\n');
+  console.log(chalk.gray(options.purge
+    ? '  The text will be redacted in session.json on this machine and, after sync, on every other machine. This cannot be undone.'
+    : '  It will be hidden from the pinned block, memoir why, and MCP lookups on every machine after sync. This cannot be undone.'
+  ) + '\n');
+
+  if (!options.yes) {
+    const ok = await confirm(chalk.white('  Forget it? [y/N] '));
+    if (!ok) {
+      console.log(chalk.gray('\n  Left as is.\n'));
+      return;
+    }
+  }
+
+  const res = await hideDecision(target.text, { purge: !!options.purge });
+  if (!res.hidden) {
+    console.log(chalk.yellow('\n  Nothing changed — it may have been forgotten by another process meanwhile.\n'));
+    return;
+  }
+  await refreshPinned();
+  console.log('\n' + chalk.green(res.purged ? '  ✓ Forgotten and purged.' : '  ✓ Forgotten.') +
+    chalk.gray(' Run ') + chalk.cyan('memoir push') + chalk.gray(' to propagate the tombstone.\n'));
+}