memoir-cli 3.17.5 → 3.17.6

package/README.md

@@ -113,7 +113,7 @@ Local pushes lock the complete read/merge/write operation. Git rejects conflicti
 
 ### Cloud
 
-New cloud writes require a user-held secret of at least 12 characters in `MEMOIR_CLOUD_PASSPHRASE` (or `MEMOIR_PASSPHRASE`). It is not derived from account identity or sent in metadata.
+New cloud writes require a user-held secret of at least 12 characters in `MEMOIR_CLOUD_PASSPHRASE` (or `MEMOIR_PASSPHRASE`). It is not derived from account identity or sent in metadata. Client-side encryption is available on every plan; it is not Pro-only.
 
 ```sh
 memoir cloud push
@@ -163,7 +163,7 @@ Memory is context, not permission to run commands or configure tools. Model-writ
 
 With the SessionStart hook installed (`memoir hooks install`), `memoir auto-refresh` prints a short session brief on stdout, which Claude Code adds to the model's context. Delivery no longer depends on the model choosing to call `memoir_session`. The brief is capped (~300 tokens), silent when there is nothing to say, skipped on compaction, and disabled by `MEMOIR_NO_SESSION_BRIEF`. Preview it with `memoir auto-refresh --show-brief`. It scopes by the hand-written `[project]` text prefix first and the stored project field second; untagged items are shown under their own heading, not presented as facts about the current repository.
 
-`push --redact` heuristically redacts staged text, not originals or historical backups. Without it, ordinary memory backups warn and preserve content. Set `DO_NOT_TRACK=1` to disable remote telemetry. Local events distinguish execution failure from success; they do not measure answer usefulness.
+`push --redact` heuristically redacts staged text, not originals or historical backups. Without it, ordinary memory backups warn and preserve content. Anonymous usage telemetry is **off by default** for new and existing installs. Enable it with `memoir telemetry on`; check with `memoir telemetry status`; turn it off with `memoir telemetry off`. `DO_NOT_TRACK=1` or `MEMOIR_TELEMETRY=0` always disable remote telemetry, even after opting in. No telemetry network calls are made while it is off, including on first run. Local events distinguish execution failure from success; they do not measure answer usefulness.
 
 Forgetting propagates on later sync between updated clients. Old clients, snapshots, and Git history can still contain deleted text. Purging every historical copy is separate. Native configuration restore is not atomic across multiple application directories.
 

package/bin/memoir.js

@@ -161,7 +161,7 @@ program
   .command('share')
   .description('Share your AI memory via a secure link')
   .option('--only <tools>', 'Only share specific tools (comma-separated)')
-  .option('--expires <hours>', 'Link expiry in hours (default: 24)')
+  .option('--expires <hours>', 'Link expiry in hours (default: 24, max: 720 / 30 days)')
   .option('--uses <number>', 'Max number of uses (default: 5)')
   .action(async (options) => {
     try {
@@ -576,7 +576,7 @@ const account = program.command('account').description('Manage your memoir accou
 
 account
   .command('delete')
-  .description('Permanently delete your account and all cloud data')
+  .description('Permanently delete your account, cloud data, and login')
   .option('--confirm', 'Skip interactive prompt (Node 25 workaround)')
   .action(async (options) => {
     try {
@@ -766,7 +766,7 @@ program
 
 program
   .command('telemetry [action]')
-  .description('Anonymous usage telemetry: `on`, `off`, or `status` (default)')
+  .description('Anonymous usage telemetry (off by default): `on`, `off`, or `status`')
   .action(async (action) => {
     try {
       await telemetryCommand(action || 'status');
@@ -778,8 +778,8 @@ program
 
 program.hook('postAction', async (thisCommand, actionCommand) => {
   await checkForUpdate();
-  // Anonymous, opt-out usage event. postAction already awaits a network call
-  // (checkForUpdate), so this adds no perceived latency; no-op without a key.
+  // Anonymous, opt-in usage event. postAction already awaits a network call
+  // (checkForUpdate), so this adds no perceived latency; no-op unless opted in.
   try { await track('cli_command', { command: actionCommand?.name?.() || 'unknown' }); } catch {}
   // Local twin (events.jsonl): command name only, so `memoir recall`/`why`
   // reads are visible next to the writes and syncs already logged there.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.17.5",
+  "version": "3.17.6",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Portable, project-scoped memory and session handoffs for coding agents. Readable files, MCP recall, and optional user-passphrase encrypted backups.",
   "main": "src/index.js",

package/src/cloud/auth.js

@@ -170,9 +170,10 @@ async function verifyNoneRemaining(endpoint, headers, label) {
   }
 }
 
-// Deletes the data the current user is authorized to delete. Auth-user removal
-// itself requires a privileged server-side endpoint and must never be attempted
-// with a service-role key from this CLI.
+// Deletes the data the current user is authorized to delete, then asks the
+// hosted `account-delete` function to remove the Auth login. That function
+// uses the service role on the server to delete only the JWT subject. This
+// CLI never sends a service-role key or a caller-chosen user id.
 export async function deleteAccount(session) {
   const headers = {
     'Authorization': `Bearer ${session.access_token}`,
@@ -279,8 +280,36 @@ export async function deleteAccount(session) {
     );
   }
 
+  const identityRes = await fetch(`${SUPABASE_URL}/functions/v1/account-delete`, {
+    method: 'POST',
+    headers: {
+      ...headers,
+      'Content-Type': 'application/json',
+    },
+    body: '{}',
+  });
+  const identityText = await identityRes.text().catch(() => '');
+  let identityBody = {};
+  try { identityBody = identityText ? JSON.parse(identityText) : {}; } catch { identityBody = {}; }
+  if (!identityRes.ok) {
+    if (identityRes.status === 409 && identityBody.error === 'subscription_active') {
+      throw new Error(identityBody.message || `Your Pro subscription is still active. Email ${SUPPORT_EMAIL} to cancel it, then run this again. Nothing else was reported as deleted; retry account deletion.`);
+    }
+    const detail = identityBody.message || identityText.trim();
+    throw new Error(
+      `Auth identity deletion failed (${identityRes.status})${detail ? ': ' + detail : ''}. ` +
+      'Cloud data for this account was already removed; retry account deletion to finish removing the login.'
+    );
+  }
+  if (identityBody?.deleted !== true) {
+    throw new Error(
+      'Auth identity deletion failed: unexpected response. ' +
+      'Cloud data for this account was already removed; retry account deletion to finish removing the login.'
+    );
+  }
+
   await logout();
-  return { localDataDeleted: true, authUserDeleted: false };
+  return { localDataDeleted: true, authUserDeleted: true };
 }
 
 export { AUTH_FILE, supaFetch };

package/src/commands/login.js

@@ -161,7 +161,7 @@ export async function deleteAccountCommand(options = {}) {
     const answer = await inquirer.prompt([{
       type: 'input',
       name: 'confirmation',
-      message: 'Type DELETE to remove your Memoir cloud data and sign out:',
+      message: 'Type DELETE to remove your Memoir account (cloud data and login):',
     }]);
 
     if (answer.confirmation !== 'DELETE') {
@@ -171,12 +171,14 @@ export async function deleteAccountCommand(options = {}) {
   }
 
   try {
-    await deleteAccount(session);
+    const result = await deleteAccount(session);
+    if (!result?.authUserDeleted) {
+      throw new Error('Account deletion did not confirm that the login was removed.');
+    }
     console.log('\n' + boxen(
       gradient.pastel('  memoir cloud  ') + '\n\n' +
-      chalk.green('✔ Memoir cloud data deleted and this device signed out.') + '\n' +
-      chalk.gray('Backups, shared links, and subscription data accessible to this account were removed.') + '\n\n' +
-      chalk.yellow('Your authentication identity may still exist in Supabase Auth (removing the login record requires server-side admin access).'),
+      chalk.green('✔ Account deleted. Cloud data and this login were removed, and this device was signed out.') + '\n' +
+      chalk.gray('Backups, shared links, subscription data, and the authentication identity for this account were removed.'),
       { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
     ) + '\n');
   } catch (error) {

package/src/commands/share.js

@@ -13,6 +13,16 @@ import { encryptDirectory, createVerifyToken } from '../security/encryption.js';
 import { bundleDir } from '../cloud/storage.js';
 import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from '../cloud/constants.js';
 
+// Privacy §8: shares are purged within 30 days of expiry or exhaustion.
+// Cap lifetime so a single --expires value cannot outrun that window by years.
+export const MAX_SHARE_EXPIRES_HOURS = 24 * 30;
+
+export function normalizeShareExpiresHours(raw) {
+  const n = parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return 24;
+  return Math.min(n, MAX_SHARE_EXPIRES_HOURS);
+}
+
 export async function shareCommand(options = {}) {
   // Must be logged in to share
   const session = await getSession();
@@ -107,7 +117,7 @@ export async function shareCommand(options = {}) {
     }
 
     // Parse options
-    const expiresHours = parseInt(options.expires) || 24;
+    const expiresHours = normalizeShareExpiresHours(options.expires);
     const maxUses = parseInt(options.uses) || 5;
     const expiresAt = new Date(Date.now() + expiresHours * 60 * 60 * 1000).toISOString();
 

package/src/commands/upgrade.js

@@ -4,7 +4,7 @@ import boxen from 'boxen';
 import gradient from 'gradient-string';
 import ora from 'ora';
 import { getSession, getSubscription, supaFetch } from '../cloud/auth.js';
-import { SUPABASE_URL } from '../cloud/constants.js';
+import { SUPABASE_URL, MAX_BACKUPS_FREE, MAX_BACKUPS_PRO } from '../cloud/constants.js';
 
 async function createCheckoutSession(session) {
   const res = await fetch(`${SUPABASE_URL}/functions/v1/stripe-checkout`, {
@@ -57,7 +57,7 @@ export async function upgradeCommand() {
 
   const freeLabel = currentPlan === 'free' ? 'Free (current)' : 'Free';
   const proLabel = currentPlan === 'pro' ? 'Pro (current)' : 'Pro $15/mo';
-  const teamsLabel = 'Teams $29/seat';
+  const teamsLabel = 'Teams (coming soon)';
 
   const header =
     pad(chalk.bold.white(freeLabel), col1) +
@@ -67,12 +67,12 @@ export async function upgradeCommand() {
   const sep = chalk.gray('─'.repeat(col1 + col2 + 18));
 
   const rows = [
-    [chalk.gray('10 cloud backups'),   chalk.white('100 backups'),        chalk.white('100 backups')],
-    [chalk.gray('Local only'),        chalk.white('Unlimited machines'), chalk.white('Shared team context')],
-    [chalk.gray('Manual snapshots'),  chalk.white('Auto snapshots'),     chalk.white('Team dashboard')],
-    [chalk.gray('Community support'), chalk.white('Priority support'),   chalk.white('Audit log')],
-    [chalk.gray('—'),                 chalk.white('E2E encryption'),     chalk.white('SSO & RBAC')],
-    [chalk.gray('—'),                 chalk.white('Version history'),    chalk.white('Priority onboarding')],
+    [chalk.gray(`${MAX_BACKUPS_FREE} retained backups`), chalk.white(`${MAX_BACKUPS_PRO} retained backups`), chalk.white(`${MAX_BACKUPS_PRO} retained backups`)],
+    [chalk.gray('Community support'),  chalk.white('Sync across machines'), chalk.white('Shared team context')],
+    [chalk.white('E2E encryption'),    chalk.white('E2E encryption'),       chalk.white('E2E encryption')],
+    [chalk.gray('—'),                  chalk.gray('—'),                    chalk.white('Team dashboard')],
+    [chalk.gray('—'),                  chalk.gray('—'),                    chalk.white('Audit log')],
+    [chalk.gray('—'),                  chalk.gray('—'),                    chalk.white('SSO & RBAC')],
   ];
 
   const tableRows = rows.map(([a, b, c]) =>

package/src/mcp.js

@@ -81,7 +81,8 @@ const server = new McpServer({
 // Wrap server.tool ONCE so every registered handler emits an anonymous, no-PII
 // "mcp_tool_used" event on call — the only place that proves memory was actually
 // used (the North Star's activation event). Fire-and-forget; can't block or
-// break a tool response. No-op unless a telemetry key is configured.
+// break a tool response. No-op unless the user has opted in and a telemetry
+// key is configured.
 track('mcp_server_start');
 const _registerTool = server.tool.bind(server);
 server.tool = (name, ...rest) => {

package/src/telemetry.js

@@ -1,11 +1,12 @@
-// Anonymous, opt-out usage telemetry.
+// Anonymous, opt-in usage telemetry.
 //
 // Fire-and-forget POST to PostHog's capture endpoint — no SDK, no batching/flush
-// problem for a short-lived CLI, and a HARD NO-OP unless a project key is set.
-// Honors DO_NOT_TRACK, CI, and `memoir telemetry off`. We NEVER send PII or any
-// memory contents — only an anonymous install UUID, the event name, the OS, and
-// the CLI version. All output goes to stderr so it can never corrupt the MCP
-// stdio protocol (which speaks JSON-RPC over stdout).
+// problem for a short-lived CLI, and a HARD NO-OP unless a project key is set
+// AND the user has explicitly opted in. Honors DO_NOT_TRACK, CI,
+// MEMOIR_TELEMETRY=0/off/false, and `memoir telemetry off`. We NEVER send PII
+// or any memory contents — only an anonymous install UUID, the event name, the
+// OS, and the CLI version. All output goes to stderr so it can never corrupt
+// the MCP stdio protocol (which speaks JSON-RPC over stdout).
 import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
@@ -17,35 +18,68 @@ const VERSION = (() => {
   try { return require('../package.json').version; } catch { return 'unknown'; }
 })();
 
-// PostHog PROJECT API key (phc_…). This is a PUBLIC client key — safe to ship in
-// the package, same model as posthog-js in a web app. Set MEMOIR_POSTHOG_KEY or
-// paste the project key here. Empty → telemetry is a silent no-op.
-const POSTHOG_KEY = process.env.MEMOIR_POSTHOG_KEY || 'phc_vS7ZKfmZAcGnaCE7Zt4hvwFioJBs6jr8gutyapDpqFXW';
+// PostHog PROJECT API key (phc_…). PUBLIC client key — same model as posthog-js.
+// Owner: rotating the project is a one-line change of POSTHOG_PROJECT_KEY (and
+// retiring the old PostHog project). MEMOIR_POSTHOG_KEY overrides at runtime.
+// Empty → telemetry is a silent no-op.
+export const POSTHOG_PROJECT_KEY = 'phc_vS7ZKfmZAcGnaCE7Zt4hvwFioJBs6jr8gutyapDpqFXW';
+const POSTHOG_KEY = process.env.MEMOIR_POSTHOG_KEY || POSTHOG_PROJECT_KEY;
 const POSTHOG_HOST = process.env.MEMOIR_POSTHOG_HOST || 'https://us.i.posthog.com';
 
 const CONFIG_DIR = process.platform === 'win32'
   ? path.join(process.env.APPDATA || path.join(os.homedir(), 'AppData', 'Roaming'), 'memoir')
   : path.join(os.homedir(), '.config', 'memoir');
 const ID_FILE = path.join(CONFIG_DIR, 'telemetry-id');
+const OPTIN_FILE = path.join(CONFIG_DIR, 'telemetry-on');
 const OPTOUT_FILE = path.join(CONFIG_DIR, 'telemetry-off');
 const DISCLOSED_FILE = path.join(CONFIG_DIR, 'telemetry-disclosed');
 
+function envFlag() {
+  return String(process.env.MEMOIR_TELEMETRY || '').toLowerCase();
+}
+
+function envForcesOff() {
+  if (['1', 'true'].includes(process.env.DO_NOT_TRACK)) return 'DO_NOT_TRACK is set';
+  if (process.env.CI) return 'running in CI';
+  if (['0', 'off', 'false'].includes(envFlag())) return 'MEMOIR_TELEMETRY is off';
+  return null;
+}
+
+function fileOptedOut() {
+  try { return fs.existsSync(OPTOUT_FILE); } catch { return false; }
+}
+
+function fileOptedIn() {
+  try { return fs.existsSync(OPTIN_FILE); } catch { return false; }
+}
+
+function envForcesOn() {
+  return ['1', 'on', 'true'].includes(envFlag());
+}
+
 export function isEnabled() {
   if (!POSTHOG_KEY) return false;                                   // no key → no-op
-  if (['1', 'true'].includes(process.env.DO_NOT_TRACK)) return false;
-  if (process.env.CI) return false;                                 // never track CI
-  if (['0', 'off', 'false'].includes(process.env.MEMOIR_TELEMETRY)) return false;
-  try { if (fs.existsSync(OPTOUT_FILE)) return false; } catch {}
-  return true;
+  if (envForcesOff()) return false;
+  if (fileOptedOut()) return false;
+  return envForcesOn() || fileOptedIn();                            // default off
+}
+
+function discardStaleIdentity() {
+  try { fs.removeSync(ID_FILE); } catch {}
+  try { fs.removeSync(DISCLOSED_FILE); } catch {}
+}
+
+function mintInstallId() {
+  const id = randomUUID();
+  try { fs.ensureDirSync(CONFIG_DIR); fs.writeFileSync(ID_FILE, id); } catch {}
+  return id;
 }
 
 function getInstallId() {
   try {
     if (fs.existsSync(ID_FILE)) return fs.readFileSync(ID_FILE, 'utf8').trim();
   } catch {}
-  const id = randomUUID();
-  try { fs.ensureDirSync(CONFIG_DIR); fs.writeFileSync(ID_FILE, id); } catch {}
-  return id;
+  return mintInstallId();
 }
 
 function discloseOnce() {
@@ -54,8 +88,8 @@ function discloseOnce() {
     fs.ensureDirSync(CONFIG_DIR);
     fs.writeFileSync(DISCLOSED_FILE, new Date().toISOString());
     process.stderr.write(
-      '\n  memoir collects anonymous, no-PII usage stats to improve the tool.\n' +
-      '  Opt out anytime: `memoir telemetry off` (or set DO_NOT_TRACK=1).\n\n'
+      '\n  memoir sends anonymous, no-PII usage stats because telemetry is opted in.\n' +
+      '  Disable anytime: `memoir telemetry off` (or set DO_NOT_TRACK=1).\n\n'
     );
   } catch {}
 }
@@ -64,7 +98,10 @@ function discloseOnce() {
 // touches stdout. Callers may await (CLI) or not (MCP) — both are safe.
 export async function capture(event, properties = {}) {
   try {
-    if (!isEnabled()) return;
+    if (!isEnabled()) {
+      discardStaleIdentity();
+      return;
+    }
     discloseOnce();
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), 1500);
@@ -90,19 +127,44 @@ export async function capture(event, properties = {}) {
 export async function telemetryCommand(action = 'status') {
   const a = String(action).toLowerCase();
   if (a === 'off') {
-    try { await fs.ensureDir(CONFIG_DIR); await fs.writeFile(OPTOUT_FILE, '1'); } catch {}
+    try {
+      await fs.ensureDir(CONFIG_DIR);
+      await fs.writeFile(OPTOUT_FILE, '1');
+      await fs.remove(OPTIN_FILE);
+    } catch {}
+    discardStaleIdentity();
     console.log('  Telemetry disabled. memoir will not send any usage events.');
     return;
   }
   if (a === 'on') {
-    try { await fs.remove(OPTOUT_FILE); } catch {}
-    console.log('  Telemetry enabled (anonymous, no PII).');
+    try {
+      await fs.ensureDir(CONFIG_DIR);
+      await fs.writeFile(OPTIN_FILE, '1');
+      await fs.remove(OPTOUT_FILE);
+    } catch {}
+    discardStaleIdentity();
+    mintInstallId();
+    const blocked = envForcesOff();
+    if (blocked) {
+      console.log(`  Telemetry opted in, but currently OFF — ${blocked}.`);
+    } else {
+      console.log('  Telemetry enabled (anonymous, no PII). Disable with `memoir telemetry off`.');
+    }
     return;
   }
   // status
   const reason = !POSTHOG_KEY ? 'no project key configured'
-    : ['1', 'true'].includes(process.env.DO_NOT_TRACK) ? 'DO_NOT_TRACK is set'
-    : process.env.CI ? 'running in CI'
-    : (() => { try { return fs.existsSync(OPTOUT_FILE) ? 'opted out (`memoir telemetry off`)' : null; } catch { return null; } })();
-  console.log(reason ? `  Telemetry: OFF — ${reason}.` : '  Telemetry: ON — anonymous usage events (no PII). Disable with `memoir telemetry off`.');
+    : envForcesOff()
+    || (fileOptedOut() ? 'opted out (`memoir telemetry off`)' : null);
+  if (reason) {
+    discardStaleIdentity();
+    console.log(`  Telemetry: OFF — ${reason}.`);
+    return;
+  }
+  if (envForcesOn() || fileOptedIn()) {
+    console.log('  Telemetry: ON — anonymous usage events (no PII). Disable with `memoir telemetry off`.');
+    return;
+  }
+  discardStaleIdentity();
+  console.log('  Telemetry: OFF — off by default. Enable with `memoir telemetry on`.');
 }

package/supabase/migrations/20261027193000_purge_expired_shares.sql

@@ -0,0 +1,19 @@
+-- Expired/exhausted share purge lives in supabase/functions/purge-expired-shares.
+-- It removes objects through the Storage API, then deletes matching rows.
+-- Direct SQL deletes against the Storage catalog orphan files (and current projects reject them).
+--
+-- This migration only drops the unsafe SQL purge if an earlier draft applied it.
+-- There is no pg_cron → SQL delete path.
+--
+-- MANUAL STEPS (owner):
+--   1. Apply this file (no-op drop if the SQL purge was never created).
+--   2. Set MEMOIR_PURGE_SECRET on the purge-expired-shares function.
+--   3. Deploy supabase/functions/purge-expired-shares (verify_jwt = false;
+--      the function requires header x-memoir-purge-secret).
+--   4. Schedule a daily POST to that function with the secret header.
+--      Do not schedule `select memoir_purge_expired_shares()`.
+begin;
+
+drop function if exists public.memoir_purge_expired_shares();
+
+commit;

package/supabase/migrations/20261027200000_shared_links_expires_at_not_null.sql

@@ -0,0 +1,19 @@
+-- shared_links.expires_at must be set so the purge always has an expiry.
+-- Null-expiry rows under their download limit were never selected.
+--
+-- MANUAL STEP (owner): apply by SQL if `supabase db push` still mis-pairs
+-- 12-digit history. Do not skip this; the edge function assumes the column
+-- is present and not null after this lands.
+begin;
+
+update public.shared_links
+   set expires_at = coalesce(created_at, now()) + interval '30 days'
+ where expires_at is null;
+
+alter table public.shared_links
+  alter column expires_at set default (now() + interval '24 hours');
+
+alter table public.shared_links
+  alter column expires_at set not null;
+
+commit;