memoir-cli 3.12.0 → 3.14.0

package/src/commands/restore.js

@@ -6,13 +6,14 @@ import ora from 'ora';
 import boxen from 'boxen';
 import gradient from 'gradient-string';
 import inquirer from 'inquirer';
+import { readSafeFile, writeSafeFile, relativeFile } from '../security/files.js';
 import { getConfig, autoSetup } from '../config.js';
 import { fetchFromLocal, fetchFromGit } from '../providers/restore.js';
 import { decryptDirectory, verifyPassphrase } from '../security/encryption.js';
 import { detectLocalHomeKey } from '../adapters/restore.js';
 import { restoreWorkspace } from '../workspace/tracker.js';
 import { getSession } from '../cloud/auth.js';
-import { unbundleToDir } from '../cloud/storage.js';
+import { unbundleToDir, readBoundedResponse } from '../cloud/storage.js';
 import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from '../cloud/constants.js';
 import { readSession, writeSession, mergeSessions, paths as sessionPaths } from '../session/state.js';
 import { withSessionLock } from '../session/lock.js';
@@ -34,7 +35,7 @@ export async function restoreCommand(options = {}) {
     const setupSpinner = ora({ text: chalk.gray('Setting up memoir automatically...'), spinner: 'dots' }).start();
     config = await autoSetup();
     if (config) {
-      setupSpinner.succeed(chalk.green('Auto-configured') + chalk.gray(` → ${config.gitRepo}`));
+      setupSpinner.succeed(chalk.green('Auto-configured') + chalk.gray(` → ${config.gitRepo || config.localPath}`));
     } else {
       setupSpinner.fail(chalk.red('Could not detect GitHub username'));
       console.log('\n' + boxen(
@@ -75,8 +76,9 @@ export async function restoreCommand(options = {}) {
 
       // Verify passphrase first
       const verifyPath = path.join(stagingDir, 'verify.enc');
-      let passphrase;
-      for (let attempt = 0; attempt < 3; attempt++) {
+      let passphrase = process.env.MEMOIR_PASSPHRASE;
+      if (!passphrase && !process.stdin.isTTY) throw new Error('Set MEMOIR_PASSPHRASE to restore this encrypted backup.');
+      for (let attempt = 0; !passphrase && attempt < 3; attempt++) {
         const { pass } = await inquirer.prompt([{
           type: 'password',
           name: 'pass',
@@ -97,8 +99,7 @@ export async function restoreCommand(options = {}) {
       }
 
       if (!passphrase) {
-        console.log(chalk.red('\n  Too many failed attempts.'));
-        return;
+        throw new Error('Too many failed passphrase attempts');
       }
 
       spinner.start(chalk.gray('Decrypting...'));
@@ -116,7 +117,7 @@ export async function restoreCommand(options = {}) {
         await fs.copy(decryptedDir, stagingDir, { overwrite: true });
       } catch (err) {
         spinner.fail(chalk.red('Decryption failed: ') + err.message);
-        return;
+        throw err;
       } finally {
         await fs.remove(decryptedDir);
       }
@@ -135,8 +136,9 @@ export async function restoreCommand(options = {}) {
         // raw JSON.parse, so an old-schema file from a lagging machine gets
         // migrated up (or a too-new one safely degraded) BEFORE mergeSessions
         // ever touches it. Symmetric with the push-side fix in push.js.
-        const rawRemote = JSON.parse(await fs.readFile(remoteSessionPath, 'utf8'));
-        const { state: remote } = migrateSessionData(rawRemote);
+        const rawRemote = JSON.parse((await readSafeFile(stagingDir, 'session.json')).toString('utf8'));
+        const { state: remote, future } = migrateSessionData(rawRemote);
+        if (future) throw new Error('Backup uses a newer session schema. Upgrade Memoir first.');
         // Read+merge+write inside ONE lock, like every state.js mutator.
         // Reading outside the lock and locking only the write is a
         // check-then-act: a concurrent MCP memoir_note landing in the window
@@ -159,8 +161,8 @@ export async function restoreCommand(options = {}) {
         sessionMerged = true;
         sessionNewMachine = Object.keys(merged.machines || {}).length > beforeMachines;
       }
-    } catch {
-      // Best-effort — don't fail the restore over this
+    } catch (err) {
+      throw new Error('Session restore failed: ' + err.message);
     }
 
     if (sessionMerged) {
@@ -182,7 +184,7 @@ export async function restoreCommand(options = {}) {
         if (await fs.pathExists(handoffDir)) {
           const latestPath = path.join(handoffDir, 'latest.md');
           if (await fs.pathExists(latestPath)) {
-            handoffContent = await fs.readFile(latestPath, 'utf8');
+            handoffContent = (await readSafeFile(handoffDir, 'latest.md')).toString('utf8');
           } else {
             // Find newest handoff
             const files = (await fs.readdir(handoffDir))
@@ -190,7 +192,7 @@ export async function restoreCommand(options = {}) {
               .sort()
               .reverse();
             if (files.length > 0) {
-              handoffContent = await fs.readFile(path.join(handoffDir, files[0]), 'utf8');
+              handoffContent = (await readSafeFile(handoffDir, files[0])).toString('utf8');
             }
           }
         }
@@ -199,26 +201,10 @@ export async function restoreCommand(options = {}) {
           // Save locally
           const localHandoffDir = path.join(home, '.config', 'memoir', 'handoffs');
           await fs.ensureDir(localHandoffDir);
-          await fs.writeFile(path.join(localHandoffDir, 'latest.md'), handoffContent);
-
-          // Inject into Claude's home-level memory so it's always loaded
-          // Use detection (reads what Claude actually created) with corrected fallback
-          const claudeDir = path.join(home, '.claude');
-          if (await fs.pathExists(claudeDir)) {
-            let homeKey = detectLocalHomeKey(claudeDir);
-            if (!homeKey) {
-              // Fallback: compute key matching Claude's actual encoding
-              if (process.platform === 'win32') {
-                homeKey = home.replace(/\\/g, '-').replace(/:/g, '-');
-              } else {
-                homeKey = '-' + home.replace(/^\//, '').replace(/\//g, '-');
-              }
-            }
-            const claudeMemDir = path.join(claudeDir, 'projects', homeKey, 'memory');
-            await fs.ensureDir(claudeMemDir);
-            await fs.writeFile(path.join(claudeMemDir, 'handoff.md'), handoffContent);
-            handoffInjected = true;
-          }
+          await writeSafeFile(localHandoffDir, 'latest.md', handoffContent);
+
+          // Historical handoffs stay in the local archive. Project resume uses
+          // scoped session records; never inject an unscoped transcript globally.
 
           // Extract info for display — handles both old and new handoff formats
           const fromMatch = handoffContent.match(/\*\*From:\*\*\s*(.+)/) || handoffContent.match(/from \*\*(.+?)\*\*/);
@@ -239,7 +225,7 @@ export async function restoreCommand(options = {}) {
     let workspaceResults = null;
     try {
       spinner.start(chalk.gray('Checking workspace...'));
-      workspaceResults = await restoreWorkspace(stagingDir, spinner, autoYes);
+      if (options.workspace === true) workspaceResults = await restoreWorkspace(stagingDir, spinner, autoYes);
       spinner.stop();
 
       if (workspaceResults) {
@@ -264,8 +250,8 @@ export async function restoreCommand(options = {}) {
           restored = true;
         }
       }
-    } catch {
-      // Workspace restore is best-effort
+    } catch (err) {
+      throw new Error('Workspace restore failed: ' + err.message);
     }
 
     if (restored) {
@@ -305,13 +291,14 @@ export async function restoreCommand(options = {}) {
 
   } catch (error) {
     spinner.fail(chalk.red('Restore failed: ') + error.message);
+    throw error;
   } finally {
     await fs.remove(stagingDir);
   }
 }
 
 async function restoreFromShare(options) {
-  const shareToken = options.from;
+  const shareToken = encodeURIComponent(options.from);
 
   console.log();
   const spinner = ora({ text: chalk.gray('Fetching share link...'), spinner: 'dots' }).start();
@@ -389,7 +376,7 @@ async function restoreFromShare(options) {
       ? { 'Authorization': `Bearer ${session.access_token}`, 'apikey': SUPABASE_ANON_KEY }
       : { 'apikey': SUPABASE_ANON_KEY };
 
-    const dlRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${shareLink.backup_id}`, {
+    const dlRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${relativeFile(shareLink.backup_id).split('/').map(encodeURIComponent).join('/')}`, {
       headers: authHeaders,
     });
 
@@ -397,7 +384,7 @@ async function restoreFromShare(options) {
       throw new Error(`Download failed: ${await dlRes.text()}`);
     }
 
-    const gzipped = Buffer.from(await dlRes.arrayBuffer());
+    const gzipped = await readBoundedResponse(dlRes);
     await unbundleToDir(gzipped, stagingDir);
 
     // Decrypt — backup is always encrypted for shares
@@ -411,8 +398,9 @@ async function restoreFromShare(options) {
 
     // Verify passphrase
     const verifyPath = path.join(stagingDir, 'verify.enc');
-    let passphrase;
-    for (let attempt = 0; attempt < 3; attempt++) {
+    let passphrase = process.env.MEMOIR_PASSPHRASE;
+    if (!passphrase && !process.stdin.isTTY) throw new Error('Set MEMOIR_PASSPHRASE to restore this share');
+    for (let attempt = 0; !passphrase && attempt < 3; attempt++) {
       const { pass } = await inquirer.prompt([{
         type: 'password',
         name: 'pass',
@@ -433,8 +421,7 @@ async function restoreFromShare(options) {
     }
 
     if (!passphrase) {
-      console.log(chalk.red('\n  Too many failed attempts.'));
-      return;
+      throw new Error('Too many failed passphrase attempts');
     }
 
     spinner.start(chalk.gray('Decrypting...'));
@@ -453,7 +440,7 @@ async function restoreFromShare(options) {
       restored = await restoreMemories(decryptedDir, spinner, onlyFilter, autoYes);
     } catch (err) {
       spinner.fail(chalk.red('Decryption failed: ') + err.message);
-      return;
+      throw err;
     } finally {
       await fs.remove(decryptedDir);
     }
@@ -491,6 +478,7 @@ async function restoreFromShare(options) {
 
   } catch (error) {
     spinner.fail(chalk.red('Restore from share failed: ') + error.message);
+    throw error;
   } finally {
     await fs.remove(stagingDir);
   }

package/src/commands/resume.js

@@ -1,172 +1,23 @@
-import chalk from 'chalk';
 import fs from 'fs-extra';
 import path from 'path';
-import os from 'os';
-import ora from 'ora';
-import boxen from 'boxen';
-import gradient from 'gradient-string';
-import { getConfig } from '../config.js';
-import { execFileSync } from 'child_process';
-
-const home = os.homedir();
-
-// Fetch latest handoff from git backup
-async function fetchLatestHandoff(config, spinner) {
-  const tmpDir = path.join(os.tmpdir(), `memoir-resume-${Date.now()}`);
-  await fs.ensureDir(tmpDir);
-
-  try {
-    if (config.provider === 'git' || config.provider.includes('git')) {
-      spinner.text = chalk.gray('Pulling latest handoff from GitHub...');
-      execFileSync('git', ['clone', '--depth', '1', config.gitRepo, '.'], { cwd: tmpDir, stdio: 'ignore' });
-    } else if (config.provider === 'local' || config.provider.includes('local')) {
-      const resolvedSource = config.localPath.replace(/^~/, home);
-      spinner.text = chalk.gray('Fetching handoff from local backup...');
-      await fs.copy(resolvedSource, tmpDir);
-    }
-
-    const handoffDir = path.join(tmpDir, 'handoffs');
-    if (!await fs.pathExists(handoffDir)) {
-      return null;
-    }
-
-    // Find the newest handoff file
-    const files = (await fs.readdir(handoffDir))
-      .filter(f => f.endsWith('.md') && f !== 'latest.md')
-      .sort()
-      .reverse();
-
-    if (files.length === 0) return null;
-
-    const content = await fs.readFile(path.join(handoffDir, files[0]), 'utf8');
-    return { filename: files[0], content };
-  } finally {
-    await fs.remove(tmpDir);
-  }
-}
-
-// Inject handoff into a tool's context location
-async function injectHandoff(content, tool) {
-  const targets = {
-    claude: () => {
-      // Write to Claude's project memory dir so it's auto-loaded
-      const cwd = process.cwd();
-      // Match Claude's actual path encoding: each separator → dash
-      let cwdKey;
-      if (process.platform === 'win32') {
-        cwdKey = cwd.replace(/\\/g, '-').replace(/:/g, '-');
-      } else {
-        cwdKey = '-' + cwd.replace(/^\//, '').replace(/\//g, '-');
-      }
-      const memDir = path.join(home, '.claude', 'projects', cwdKey, 'memory');
-      return path.join(memDir, 'handoff.md');
-    },
-    gemini: () => {
-      return path.join(process.cwd(), 'GEMINI.md');
-    },
-    cursor: () => {
-      return path.join(process.cwd(), '.cursor', 'rules', 'handoff.mdc');
-    },
-    codex: () => {
-      return path.join(process.cwd(), 'AGENTS.md');
-    }
-  };
-
-  const getTarget = targets[tool];
-  if (!getTarget) {
-    throw new Error(`Unknown tool: ${tool}. Supported: claude, gemini, cursor, codex`);
-  }
-
-  const targetPath = getTarget();
-  await fs.ensureDir(path.dirname(targetPath));
-
-  if (tool === 'gemini' && await fs.pathExists(targetPath)) {
-    // Append to existing GEMINI.md
-    const existing = await fs.readFile(targetPath, 'utf8');
-    if (!existing.includes('# Session Handoff')) {
-      await fs.writeFile(targetPath, existing + '\n\n' + content);
-    } else {
-      // Replace existing handoff section
-      const before = existing.split('# Session Handoff')[0];
-      await fs.writeFile(targetPath, before + content);
-    }
-  } else {
-    await fs.writeFile(targetPath, content);
-  }
-
-  return targetPath;
-}
+import { buildResumeBrief, formatResumeBrief } from '../session/brief.js';
+import { BLOCK_START, BLOCK_END } from '../session/render.js';
+import { injectInto } from '../session/inject.js';
+import { safePath, writeSafeFile } from '../security/files.js';
 
 export async function resumeCommand(options = {}) {
-  const config = await getConfig(options.profile);
-
-  if (!config) {
-    console.log('\n' + boxen(
-      chalk.red('Not configured yet\n\n') +
-      chalk.white('Run ') + chalk.cyan.bold('memoir init') + chalk.white(' to get started.'),
-      { padding: 1, borderStyle: 'round', borderColor: 'red' }
-    ) + '\n');
-    return;
-  }
-
-  console.log();
-  const spinner = ora({ text: chalk.gray('Fetching latest handoff...'), spinner: 'dots' }).start();
-
-  // First check local cache
-  const localLatest = path.join(home, '.config', 'memoir', 'handoffs', 'latest.md');
-  let handoff;
-
-  // Try remote first
-  try {
-    handoff = await fetchLatestHandoff(config, spinner);
-  } catch (err) {
-    spinner.warn(chalk.yellow(`Remote fetch failed: ${err.message}`));
-    spinner.start();
-  }
-
-  // Fallback to local cache
-  if (!handoff && await fs.pathExists(localLatest)) {
-    handoff = { filename: 'latest.md', content: await fs.readFile(localLatest, 'utf8') };
-  }
-
-  if (!handoff) {
-    spinner.fail(chalk.red('No handoffs found.'));
-    console.log(chalk.gray('\n  Run ') + chalk.cyan('memoir snapshot') + chalk.gray(' on another machine first.\n'));
-    return;
-  }
-
-  // Save locally
-  const localHandoffDir = path.join(home, '.config', 'memoir', 'handoffs');
-  await fs.ensureDir(localHandoffDir);
-  await fs.writeFile(path.join(localHandoffDir, 'latest.md'), handoff.content);
-
-  spinner.stop();
-
-  // Display the handoff
-  console.log(boxen(
-    gradient.pastel('  Session Handoff  ') + '\n\n' +
-    handoff.content
-      .replace(/^---[\s\S]*?---\n/, '') // Strip YAML frontmatter for display
-      .trim(),
-    { padding: 1, borderStyle: 'round', borderColor: 'cyan', dimBorder: true }
-  ));
-
-  // Inject if requested
+  const project = options.project || process.env.MEMOIR_PROJECT_ROOT || process.cwd();
+  const brief = await buildResumeBrief(project);
+  const content = formatResumeBrief(brief);
+  console.log(content);
   if (options.inject) {
+    const targets = { claude: 'CLAUDE.md', codex: 'AGENTS.md', gemini: 'GEMINI.md', cursor: '.cursor/rules/memoir-resume.mdc' };
     const tool = options.to || 'claude';
-    spinner.start(chalk.gray(`Injecting handoff for ${tool}...`));
-    try {
-      const targetPath = await injectHandoff(handoff.content, tool);
-      spinner.stop();
-      console.log('\n' + chalk.green(`  Injected handoff → ${targetPath}`));
-      console.log(chalk.gray(`  ${tool.charAt(0).toUpperCase() + tool.slice(1)} will read this on next session.\n`));
-    } catch (err) {
-      spinner.fail(chalk.red(`Inject failed: ${err.message}`));
-    }
-  } else {
-    console.log('\n' + chalk.gray('  To inject into your AI tool:'));
-    console.log(chalk.cyan('    memoir resume --inject') + chalk.gray(' (Claude)'));
-    console.log(chalk.cyan('    memoir resume --inject --to gemini'));
-    console.log(chalk.cyan('    memoir resume --inject --to cursor') + '\n');
+    if (!targets[tool]) throw new Error('Supported injection targets: claude, codex, gemini, cursor');
+    const target = await safePath(path.resolve(project), targets[tool], { createParents: true });
+    if (tool === 'cursor' && !await fs.pathExists(target)) await writeSafeFile(path.resolve(project), targets[tool], '---\ndescription: Memoir project handoff\nalwaysApply: true\n---\n');
+    await injectInto(target, [BLOCK_START, content, BLOCK_END].join('\n'));
+    console.log('\nUpdated the managed handoff in ' + target);
   }
+  return brief;
 }

package/src/commands/session.js

@@ -19,6 +19,7 @@ import {
   addGoal,
   addNext,
   completeNext,
+  completeGoal,
   addNote,
   addQuestion,
   getMachineId,
@@ -46,25 +47,57 @@ async function refreshPinned() {
   return { state, rendered, updated };
 }
 
-export async function goalCommand(text) {
+export async function goalCommand(text, options = {}) {
+  if (options.done) {
+    const state = await completeGoal(String(options.done).trim());
+    if (state.completed) {
+      await refreshPinned();
+      console.log('\n' + chalk.green('  ✓ Goal retired: ') + chalk.white(options.done) + '\n');
+    } else {
+      console.log('\n' + chalk.yellow('  No matching goal found.\n'));
+    }
+    return;
+  }
   if (!text || !String(text).trim()) {
-    console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir goal "your current focus"\n'));
+    console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir goal "your current focus"') + chalk.gray('   or   ') + chalk.cyan('memoir goal --done "substring"\n'));
     return;
   }
-  await addGoal(String(text).trim());
+  const state = await addGoal(String(text).trim());
   const { updated } = await refreshPinned();
   console.log('\n' + chalk.green('  ✓ Goal set: ') + chalk.white(text));
+  for (const g of state.replacedGoals || []) {
+    console.log(chalk.yellow('  ⚠ Goals list is full — replaced: ') + chalk.white(g.text));
+  }
   if (updated.length) console.log(chalk.gray(`    Pinned to: ${updated.join(', ')}\n`));
 }
 
-export async function nextCommand(text) {
+export async function nextCommand(text, options = {}) {
+  if (options.parked) {
+    const state = await readSession();
+    const parked = state.current.parked_actions || [];
+    if (!parked.length) {
+      console.log('\n' + chalk.gray('  Nothing parked.\n'));
+      return;
+    }
+    console.log('\n' + chalk.white.bold(`  Parked next-actions (${parked.length}):`));
+    for (const p of parked) {
+      const when = (p.parked_at || '').slice(0, 10);
+      console.log('  ' + chalk.gray(`[ ] ${when ? when + ' ' : ''}`) + chalk.white(p.text));
+    }
+    console.log(chalk.gray('\n  Re-add one with `memoir next "…"` to bring it back; `memoir done "…"` finishes it.\n'));
+    return;
+  }
   if (!text || !String(text).trim()) {
-    console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir next "the next action"\n'));
+    console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir next "the next action"') + chalk.gray('   or   ') + chalk.cyan('memoir next --parked\n'));
     return;
   }
-  await addNext(String(text).trim());
+  const state = await addNext(String(text).trim());
   await refreshPinned();
-  console.log('\n' + chalk.green('  ✓ Added to next: ') + chalk.white(text) + '\n');
+  console.log('\n' + chalk.green('  ✓ Added to next: ') + chalk.white(text));
+  for (const p of state.justParked || []) {
+    console.log(chalk.yellow('  ⚠ Next list is full — parked (still open): ') + chalk.white(p.text));
+  }
+  console.log('');
 }
 
 export async function doneCommand(text) {
@@ -72,10 +105,11 @@ export async function doneCommand(text) {
     console.log(chalk.yellow('\nUsage: ') + chalk.cyan('memoir done "substring of the action"\n'));
     return;
   }
+  const count = (st) => st.current.next_actions.length + (st.current.parked_actions || []).length;
   const before = await readSession();
   await completeNext(String(text).trim());
   const after = await readSession();
-  const removed = before.current.next_actions.length - after.current.next_actions.length;
+  const removed = count(before) - count(after);
   if (removed > 0) {
     await refreshPinned();
     console.log('\n' + chalk.green(`  ✓ Completed ${removed} action${removed !== 1 ? 's' : ''}\n`));
@@ -140,6 +174,14 @@ export async function sessionShowCommand() {
     body.push('');
   }
 
+  const parked = state.current.parked_actions || [];
+  if (parked.length) {
+    body.push(chalk.white.bold(`  Parked (${parked.length}):`));
+    for (const p of parked.slice(0, 4)) body.push('  ' + chalk.gray('[ ] ') + chalk.gray(p.text.length > 100 ? p.text.slice(0, 100) + '…' : p.text));
+    if (parked.length > 4) body.push(chalk.gray(`  …and ${parked.length - 4} more — memoir next --parked`));
+    body.push('');
+  }
+
   if (questions.length) {
     body.push(chalk.white.bold('  Open questions:'));
     for (const q of questions) body.push('  ' + chalk.yellow('? ') + chalk.white(q.text));
@@ -185,7 +227,7 @@ export async function sessionClearCommand() {
   // write was silently lost, and worse, could resurrect what was cleared.
   await withSessionLock(paths.sessionLock, async () => {
     const state = await readSession();
-    state.current = { goals: [], next_actions: [], open_questions: [], decisions: [] };
+    state.current = { goals: [], next_actions: [], parked_actions: [], open_questions: [], decisions: [], completed_actions: [], completed_goals: [] };
     await writeSession(state);
   });
   await refreshPinned();

package/src/commands/snapshot.js

@@ -7,6 +7,7 @@ import boxen from 'boxen';
 import gradient from 'gradient-string';
 import { getConfig, getGeminiApiKey } from '../config.js';
 import { syncToLocal, syncToGit } from '../providers/index.js';
+import { saveHandoff } from '../context/handoffs.js';
 
 const home = os.homedir();
 
@@ -337,7 +338,9 @@ export async function snapshotCommand(options = {}) {
       if (config.provider === 'local' || config.provider.includes('local')) {
         await syncToLocal(config, stagingDir, spinner);
       } else if (config.provider === 'git' || config.provider.includes('git')) {
-        await syncToGit(config, stagingDir, spinner);
+        // additive: the staging dir holds ONE handoff file. A mirror push
+        // here would have deleted every other file in the backup.
+        await syncToGit(config, stagingDir, spinner, { additive: true });
       }
     } catch (err) {
       spinner.warn(chalk.yellow(`Push failed: ${err.message}. Saved locally.`));
@@ -346,13 +349,9 @@ export async function snapshotCommand(options = {}) {
     await fs.remove(stagingDir);
   }
 
-  // Also save locally for immediate access
+  // Also save locally for immediate access (+ latest.md; dir is pruned)
   const localHandoffDir = path.join(home, '.config', 'memoir', 'handoffs');
-  await fs.ensureDir(localHandoffDir);
-  await fs.writeFile(path.join(localHandoffDir, filename), handoff);
-
-  // Also save as "latest" for easy access
-  await fs.writeFile(path.join(localHandoffDir, 'latest.md'), handoff);
+  await saveHandoff(handoff, { dirs: [localHandoffDir], filename });
 
   spinner.stop();
 

package/src/commands/status.js

@@ -5,6 +5,23 @@ import boxen from 'boxen';
 import gradient from 'gradient-string';
 import { getConfig } from '../config.js';
 import { adapters } from '../adapters/index.js';
+import { paths as eventPaths } from '../events/log.js';
+import { summarizeEvents, formatSummaryLines } from '../events/summary.js';
+
+const WINDOW_DAYS = 7;
+
+// Best-effort usage block from events.jsonl (names and counts only — the
+// log never holds content). Absent or unreadable log → no block.
+async function usageLines() {
+  try {
+    if (!(await fs.pathExists(eventPaths.events))) return [];
+    const raw = await fs.readFile(eventPaths.events, 'utf8');
+    const s = summarizeEvents(raw, { sinceMs: WINDOW_DAYS * 24 * 60 * 60 * 1000 });
+    return formatSummaryLines(s, { days: WINDOW_DAYS });
+  } catch {
+    return [];
+  }
+}
 
 export async function statusCommand(options = {}) {
   const config = await getConfig(options.profile);
@@ -59,11 +76,16 @@ export async function statusCommand(options = {}) {
     ? '\n' + chalk.gray(`  Also supports: ${notFound.join(', ')}`)
     : '';
 
+  const usage = await usageLines();
+  const usageBlock = usage.length
+    ? '\n\n' + chalk.bold.white(`Last ${WINDOW_DAYS} days`) + '\n' + usage.map((l) => chalk.gray('  ') + chalk.white(l)).join('\n')
+    : '';
+
   console.log(boxen(
     gradient.pastel('  memoir status  ') + '\n\n' +
     configLine + '\n\n' +
     chalk.bold.white('AI Tools') + '\n' +
-    lines.join('\n') + notFoundLine + '\n\n' +
+    lines.join('\n') + notFoundLine + usageBlock + '\n\n' +
     chalk.gray('─'.repeat(30)) + '\n' +
     summary,
     { padding: 1, borderStyle: 'round', borderColor: 'cyan', dimBorder: true }

package/src/commands/upgrade.js

@@ -18,12 +18,18 @@ async function createCheckoutSession(session) {
   return data.url;
 }
 
+// No shell. The URL comes from our own API, but `exec(\`open "${url}"\`)`
+// is still a shell string built from data — flagged (correctly) by the
+// agentscores.xyz scan as command injection, and one bad quote away from
+// being one. execFile passes the URL as a single argument; on Windows
+// rundll32's URL handler avoids cmd.exe parsing `&` inside the query string.
 function openUrl(url) {
-  const { exec } = require('child_process');
+  const { execFile } = require('child_process');
   const platform = process.platform;
-  if (platform === 'darwin') exec(`open "${url}"`);
-  else if (platform === 'win32') exec(`start "" "${url}"`);
-  else exec(`xdg-open "${url}"`);
+  const [cmd, args] = platform === 'darwin' ? ['open', [url]]
+    : platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+    : ['xdg-open', [url]];
+  try { execFile(cmd, args, () => {}); } catch {}
 }
 
 export async function upgradeCommand() {
@@ -105,11 +111,7 @@ export async function upgradeCommand() {
       const url = await createCheckoutSession(session);
       spinner.succeed(chalk.green('  Opening Stripe checkout...'));
 
-      const { exec } = await import('child_process');
-      const platform = process.platform;
-      if (platform === 'darwin') exec(`open "${url}"`);
-      else if (platform === 'win32') exec(`start "" "${url}"`);
-      else exec(`xdg-open "${url}"`);
+      openUrl(url);
 
       console.log(
         '\n' + chalk.gray('  Complete payment in your browser.') + '\n' +

package/src/commands/validate.js

@@ -45,6 +45,9 @@ const DATE_FIELDS = ['created', 'updated', 'date', 'set_on', 'added', 'done_at',
 
 function parseScalar(raw) {
   let v = String(raw).trim();
+  if (v.startsWith('"') && v.endsWith('"')) {
+    try { return JSON.parse(v); } catch {}
+  }
   if (
     (v.startsWith('"') && v.endsWith('"') && v.length >= 2) ||
     (v.startsWith("'") && v.endsWith("'") && v.length >= 2)

package/src/commands/view.js

@@ -5,7 +5,7 @@ import os from 'os';
 import ora from 'ora';
 import boxen from 'boxen';
 import inquirer from 'inquirer';
-import { execSync } from 'child_process';
+import { execSync, execFileSync } from 'child_process';
 import { getConfig } from '../config.js';
 import { adapters } from '../adapters/index.js';
 
@@ -49,7 +49,7 @@ export async function viewCommand(options = {}) {
 
   try {
     if (config.provider === 'git') {
-      execSync(`git clone --depth 1 ${config.gitRepo} .`, { cwd: stagingDir, stdio: 'ignore' });
+      execFileSync('git', ['clone', '--depth', '1', '--', config.gitRepo, '.'], { cwd: stagingDir, stdio: 'ignore' });
     } else {
       const resolvedSource = config.localPath.replace(/^~/, os.homedir());
       await fs.copy(resolvedSource, stagingDir);