memoir-cli 3.16.0 → 3.16.2

package/README.md

@@ -144,7 +144,7 @@ Common secret filenames and detected patterns are omitted and listed in the mani
 | Surface | Capability | Verification boundary |
 |---|---|---|
 | Claude Code | Project MCP setup, Memoir tools, instruction import/export | JSON preservation and real server startup tested |
-| Codex | Project TOML MCP setup, Memoir tools, AGENTS.md import/export | TOML round trip and server startup tested |
+| Codex | Project TOML MCP setup, Memoir tools, AGENTS.md import/export, pinned session block in `~/.codex/AGENTS.md` | TOML round trip and server startup tested |
 | Cursor | Project MCP setup, Memoir tools, rule import/export | JSON preservation and server startup tested |
 | Other existing adapters | Selected memory/config import/export | Adapter fixtures, not full native session continuity |
 | Generic MCP client | Memoir tool contract | Real stdio tests |

package/bin/memoir.js

@@ -45,6 +45,7 @@ import { whyCommand } from '../src/commands/why.js';
 import { forgetCommand } from '../src/commands/forget.js';
 import { recallCommand } from '../src/commands/recall.js';
 import { autoRefreshCommand } from '../src/commands/auto-refresh.js';
+import { updateCommand } from '../src/commands/update.js';
 import { validateCommand } from '../src/commands/validate.js';
 import { hooksInstallCommand, hooksUninstallCommand, hooksStatusCommand } from '../src/commands/hooks.js';
 import { capture as track, telemetryCommand } from '../src/telemetry.js';
@@ -395,43 +396,16 @@ program
 
 program
   .command('update')
-  .description('Update memoir to the latest version')
-  .action(async () => {
+  .description('Update the copy of memoir that is running (npm global, bun global, or a project-local install)')
+  .option('--dry-run', 'Show which install would be updated and the exact command, without running it')
+  .action(async (options) => {
     try {
-      const res = await fetch('https://registry.npmjs.org/memoir-cli/latest');
-      const data = await res.json();
-      const latest = data.version;
-
-      const currentParts = VERSION.split('.').map(Number);
-      const latestParts = String(latest).split('.').map(Number);
-      const newer = latestParts.some((n, i) => n > currentParts[i] && latestParts.slice(0, i).every((v, j) => v === currentParts[j]));
-      if (!newer) {
-        console.log('\n' + boxen(
-          chalk.green('✔ Already up to date!') + '\n' +
-          chalk.gray(`v${VERSION}`),
-          { padding: { top: 0, bottom: 0, left: 1, right: 1 }, borderStyle: 'round', borderColor: 'green', dimBorder: true }
-        ) + '\n');
-        return;
-      }
-
-      console.log('\n' + chalk.cyan(`Updating memoir ${VERSION} → ${chalk.green.bold(latest)}...`) + '\n');
-
-      const { execSync } = await import('child_process');
-      // Always use npm — bun installs to a different location and can cause PATH conflicts
-      const cmd = 'npm install -g memoir-cli';
-
-      execSync(cmd, { stdio: 'inherit' });
-
-      console.log('\n' + boxen(
-        gradient.pastel('  Updated!  ') + '\n\n' +
-        chalk.white(`memoir ${VERSION} → ${chalk.green.bold(latest)}`),
-        { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
-      ) + '\n');
-      process.exit(0); // Exit immediately — old process still has old VERSION
+      await updateCommand({ dryRun: options.dryRun }, { currentVersion: VERSION });
+      process.exit(0); // Exit immediately — this process still holds the old VERSION
     } catch (err) {
       console.error(chalk.red('\n✖ Update failed:'), err.message);
-      console.log(chalk.gray('Try manually: ') + chalk.cyan('npm install -g memoir-cli'));
-      process.exit(1);
+      console.log(chalk.gray('See which copy is running: ') + chalk.cyan('memoir update --dry-run'));
+      process.exit(err.exitCode || 1);
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.16.0",
+  "version": "3.16.2",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Portable, project-scoped memory and session handoffs for coding agents. Readable files, MCP recall, and optional user-passphrase encrypted backups.",
   "main": "src/index.js",

package/src/commands/update.js

@@ -0,0 +1,228 @@
+// memoir update — upgrade the copy of memoir that is actually running.
+//
+// Before this module, `memoir update` ran `npm install -g memoir-cli`
+// unconditionally and printed "Updated!" from the registry version. On a
+// machine with more than one install (a project-local copy first on PATH, a
+// Homebrew/npm global second, a bun global) that upgraded a copy the shell
+// never runs, the running copy kept showing the update banner, and the
+// Claude Code hooks kept executing the old version.
+//
+// Now: resolve the running install from the executing script, classify it,
+// upgrade that install with the matching package manager, verify the version
+// on disk afterwards, and say plainly when another copy on PATH shadows it.
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { execFileSync } from 'child_process';
+import chalk from 'chalk';
+import boxen from 'boxen';
+
+export const PACKAGE_NAME = 'memoir-cli';
+
+// Numeric semver compare. Non-numeric parts (tags, garbage) compare as 0 so a
+// malformed registry answer never triggers an "update".
+export function isNewer(candidate, current) {
+  const parse = v => String(v || '').split('.').slice(0, 3).map(n => { const x = parseInt(n, 10); return Number.isFinite(x) ? x : 0; });
+  const [a1, a2, a3] = parse(candidate);
+  const [b1, b2, b3] = parse(current);
+  return a1 > b1 || (a1 === b1 && a2 > b2) || (a1 === b1 && a2 === b2 && a3 > b3);
+}
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+export function readInstalledVersion(root) {
+  const pkg = root ? readJson(path.join(root, 'package.json')) : null;
+  return pkg && pkg.name === PACKAGE_NAME ? String(pkg.version || '') : null;
+}
+
+// Walk up from a script (bin/memoir.js, src/mcp.js …) to the memoir-cli
+// package directory. Follows symlinks first so `~/.bun/bin/memoir` resolves
+// to the package it points at, not the shim directory.
+export function findPackageRoot(startPath) {
+  let real;
+  try { real = fs.realpathSync(startPath); } catch { return null; }
+  let dir = fs.existsSync(real) && fs.statSync(real).isDirectory() ? real : path.dirname(real);
+  for (;;) {
+    const pkg = readJson(path.join(dir, 'package.json'));
+    if (pkg && pkg.name === PACKAGE_NAME) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function samePath(a, b) {
+  const norm = p => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+  return norm(a) === norm(b);
+}
+
+// Where is this install, and who owns it?
+//   source      — a git checkout (`.git` present): upgrading means `git pull`
+//   npm-global  — `<npm root -g>/memoir-cli`
+//   bun-global  — under bun's global node_modules
+//   local       — `<project>/node_modules/memoir-cli` (a dependency of <project>)
+//   unknown     — anything else; fall back to npm -g with a warning
+export function classifyInstall(root, { npmGlobalRoot = null, bunGlobalRoot = null } = {}) {
+  if (!root) return { kind: 'unknown', root: null };
+  root = path.resolve(root);
+  if (fs.existsSync(path.join(root, '.git'))) return { kind: 'source', root };
+  if (npmGlobalRoot && samePath(root, path.join(npmGlobalRoot, PACKAGE_NAME))) return { kind: 'npm-global', root };
+  if (bunGlobalRoot && (samePath(root, path.join(bunGlobalRoot, PACKAGE_NAME)) || root.startsWith(path.resolve(bunGlobalRoot) + path.sep))) return { kind: 'bun-global', root };
+  const parent = path.dirname(root);
+  if (path.basename(parent) === 'node_modules') {
+    const project = path.dirname(parent);
+    return { kind: 'local', root, project, hasManifest: fs.existsSync(path.join(project, 'package.json')) };
+  }
+  return { kind: 'unknown', root };
+}
+
+// The exact command that upgrades *this* install. `source` has no command:
+// the right move is a git pull in the checkout, which we never run for the user.
+export function planUpdate(install, latest) {
+  const spec = `${PACKAGE_NAME}@${latest}`;
+  switch (install.kind) {
+    case 'source':
+      return { kind: install.kind, command: null, args: [], cwd: install.root, description: `running from a source checkout at ${install.root}; run \`git pull\` there` };
+    case 'npm-global':
+      return { kind: install.kind, command: 'npm', args: ['install', '-g', spec], cwd: undefined, description: `npm global install at ${install.root}` };
+    case 'bun-global':
+      return { kind: install.kind, command: 'bun', args: ['add', '-g', spec], cwd: undefined, description: `bun global install at ${install.root}` };
+    case 'local': {
+      // A dependency of <project>/package.json: update it there so the
+      // manifest, the lockfile and the copy on disk agree. Without a manifest
+      // there is nothing to record, so do not create one.
+      const args = ['install', spec, '--no-audit', '--no-fund'];
+      if (!install.hasManifest) args.push('--no-save');
+      return { kind: install.kind, command: 'npm', args, cwd: install.project, description: `project-local install at ${install.root} (dependency of ${install.project})` };
+    }
+    default:
+      return { kind: 'unknown', command: 'npm', args: ['install', '-g', spec], cwd: undefined, description: install.root ? `unrecognised install layout at ${install.root}; trying npm -g` : 'could not locate the running install; trying npm -g' };
+  }
+}
+
+// Every `memoir` executable on PATH, in shell resolution order, mapped to the
+// package it runs. The first entry is what the shell executes for `memoir`.
+export function listPathInstalls({ PATH = process.env.PATH || '', bin = 'memoir' } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of PATH.split(path.delimiter).filter(Boolean)) {
+    const candidate = path.join(dir, bin);
+    let stat;
+    try { stat = fs.statSync(candidate); } catch { continue; }
+    if (!stat.isFile()) continue;
+    const root = findPackageRoot(candidate);
+    const key = root || candidate;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ bin: candidate, root, version: readInstalledVersion(root) });
+  }
+  return out;
+}
+
+// Plain-language warnings when the shell would run a different copy than the
+// one we just updated (or when other copies exist and will drift).
+export function shadowWarnings(runningRoot, installs) {
+  const warnings = [];
+  if (!installs.length) return warnings;
+  const first = installs[0];
+  const same = (a, b) => a && b && samePath(a, b);
+  if (first.root && !same(first.root, runningRoot)) {
+    warnings.push(`Your shell runs \`memoir\` from ${first.bin} (v${first.version || '?'}), not the copy just updated. Remove that one or update it too, or the old version keeps running.`);
+  }
+  const others = installs.filter(i => i.root && !same(i.root, runningRoot) && i !== first);
+  for (const other of others) warnings.push(`Another copy is on PATH at ${other.bin} (v${other.version || '?'}); it was not updated.`);
+  return warnings;
+}
+
+function probeNpmGlobalRoot() {
+  try { return execFileSync('npm', ['root', '-g'], { encoding: 'utf8', timeout: 15000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; }
+  catch { return null; }
+}
+
+function defaultBunGlobalRoot() {
+  const bunHome = process.env.BUN_INSTALL || path.join(os.homedir(), '.bun');
+  return path.join(bunHome, 'install', 'global', 'node_modules');
+}
+
+async function fetchLatestFromRegistry() {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 8000);
+  try {
+    const res = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, { signal: controller.signal });
+    const data = await res.json();
+    return String(data.version || '');
+  } finally { clearTimeout(timeout); }
+}
+
+// Resolve the running install once; exported so `doctor`/tests can reuse it.
+export function resolveRunningInstall({ scriptPath = process.argv[1], npmGlobalRoot, bunGlobalRoot } = {}) {
+  const root = findPackageRoot(scriptPath);
+  return classifyInstall(root, {
+    npmGlobalRoot: npmGlobalRoot === undefined ? probeNpmGlobalRoot() : npmGlobalRoot,
+    bunGlobalRoot: bunGlobalRoot === undefined ? defaultBunGlobalRoot() : bunGlobalRoot,
+  });
+}
+
+export async function updateCommand(options = {}, deps = {}) {
+  const { dryRun = false } = options;
+  const {
+    currentVersion,
+    scriptPath = process.argv[1],
+    fetchLatest = fetchLatestFromRegistry,
+    run = (cmd, args, cwd) => execFileSync(cmd, args, { stdio: 'inherit', cwd }),
+    PATH = process.env.PATH,
+    log = console.log,
+  } = deps;
+
+  const latest = process.env.MEMOIR_UPDATE_LATEST || await fetchLatest();
+  if (!latest) throw new Error('could not read the latest version from the npm registry');
+
+  const install = resolveRunningInstall({ scriptPath, npmGlobalRoot: deps.npmGlobalRoot, bunGlobalRoot: deps.bunGlobalRoot });
+  const installs = listPathInstalls({ PATH });
+  const warnings = shadowWarnings(install.root, installs);
+
+  if (!isNewer(latest, currentVersion)) {
+    log('\n' + boxen(chalk.green('✔ Already up to date!') + '\n' + chalk.gray(`v${currentVersion} · ${install.root || 'install location unknown'}`),
+      { padding: { top: 0, bottom: 0, left: 1, right: 1 }, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n');
+    for (const w of warnings) log(chalk.yellow('⚠ ') + w);
+    return { updated: false, install, latest, warnings };
+  }
+
+  const plan = planUpdate(install, latest);
+  log('\n' + chalk.cyan(`Updating memoir ${currentVersion} → ${chalk.green.bold(latest)}`) + chalk.gray(` — ${plan.description}`) + '\n');
+
+  if (plan.kind === 'source') {
+    log(chalk.yellow('This copy is a git checkout; memoir will not pull it for you.') + '\n' + chalk.gray('Run: ') + chalk.cyan(`git -C ${plan.cwd} pull`) + '\n');
+    for (const w of warnings) log(chalk.yellow('⚠ ') + w);
+    return { updated: false, install, latest, plan, warnings };
+  }
+
+  const commandLine = [plan.command, ...plan.args].join(' ') + (plan.cwd ? chalk.gray(`   (in ${plan.cwd})`) : '');
+  if (dryRun) {
+    log(chalk.gray('Would run: ') + chalk.cyan(commandLine) + '\n');
+    for (const w of warnings) log(chalk.yellow('⚠ ') + w);
+    return { updated: false, dryRun: true, install, latest, plan, warnings };
+  }
+  if (plan.kind === 'unknown') log(chalk.yellow('⚠ ') + plan.description);
+
+  await run(plan.command, plan.args, plan.cwd);
+
+  const now = install.root ? readInstalledVersion(install.root) : null;
+  const ok = now === latest || (install.root == null && plan.kind === 'unknown');
+  if (!ok) {
+    log('\n' + chalk.red('✖ The install did not change: ') + chalk.white(`${install.root} still reports v${now || '?'}`) + '\n' +
+      chalk.gray('Try manually: ') + chalk.cyan(commandLine) + '\n');
+    for (const w of warnings) log(chalk.yellow('⚠ ') + w);
+    const err = new Error(`update ran but ${install.root} still reports v${now || '?'}`);
+    err.exitCode = 1;
+    throw err;
+  }
+
+  log('\n' + boxen(chalk.white(`memoir ${currentVersion} → ${chalk.green.bold(latest)}`) + '\n' + chalk.gray(install.root || ''),
+    { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }) + '\n');
+  for (const w of warnings) log(chalk.yellow('⚠ ') + w);
+  return { updated: true, install, latest, plan, warnings };
+}

package/src/session/inject.js

@@ -28,6 +28,7 @@ const appData = process.env.APPDATA || path.join(home, 'AppData', 'Roaming');
 // Cursor:   ~/.cursor/rules/memoir-session.mdc (global user rules — auto-loaded)
 // Windsurf: {AppSupport}/Windsurf/User/memoir-session.md (user-global instructions)
 // Gemini:   ~/.gemini/GEMINI.md                (user-global)
+// Codex:    ~/.codex/AGENTS.md                 (user-global; Codex CLI reads it before any repo AGENTS.md)
 export const INJECTION_TARGETS = {
   claude:   path.join(home, '.claude', 'CLAUDE.md'),
   cursor:   path.join(home, '.cursor', 'rules', 'memoir-session.mdc'),
@@ -35,6 +36,7 @@ export const INJECTION_TARGETS = {
     ? path.join(appData, 'Windsurf', 'User', 'memoir-session.md')
     : path.join(home, 'Library', 'Application Support', 'Windsurf', 'User', 'memoir-session.md'),
   gemini:   path.join(home, '.gemini', 'GEMINI.md'),
+  codex:    path.join(home, '.codex', 'AGENTS.md'),
 };
 
 // Returns the target paths whose parent infrastructure exists — i.e. the tool
@@ -48,6 +50,7 @@ export function detectAvailableTargets() {
       ? path.join(appData, 'Windsurf', 'User')
       : path.join(home, 'Library', 'Application Support', 'Windsurf', 'User'),
     gemini:   path.join(home, '.gemini'),
+    codex:    path.join(home, '.codex'),
   };
   const available = {};
   for (const [name, dir] of Object.entries(detectors)) {
@@ -83,13 +86,13 @@ export async function injectInto(targetPath, renderedBlock) {
   await writeSafeFile(path.dirname(targetPath), path.basename(targetPath), updated);
 
   // One event per target (this function is called once per detected tool —
-  // up to ~4x for a single session update). Deliberate: each call here IS a
+  // up to ~5x for a single session update). Deliberate: each call here IS a
   // successful write to one specific target file, and the payload is tiny
   // (just the filename, no content), so per-tool visibility is worth the 4x
   // over collapsing to one event per "session update." injectInto() only
   // receives a raw path (callers loop over detectAvailableTargets() by
   // value, discarding the tool-name key), so the filename itself
-  // (CLAUDE.md / memoir-session.mdc / memoir-session.md / GEMINI.md) is
+  // (CLAUDE.md / memoir-session.mdc / memoir-session.md / GEMINI.md / AGENTS.md) is
   // what's actually available here without a larger refactor.
   await appendEvent('memory_written', { target: path.basename(targetPath) });