memoir-cli 3.7.1 → 3.8.0

package/README.md

@@ -15,7 +15,7 @@
 npx memoir-cli
 ```
 
-One command. No install, no config, no API keys. Your AI now has persistent memory across sessions, tools, and machines. Works with Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot, and 8 more tools.
+One command. No install, no config, no API keys. Your AI now has persistent memory across sessions, tools, and machines. Works with Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot, and 6 more tools.
 
 ---
 
@@ -44,7 +44,7 @@ npx memoir-cli
 
 That's it. memoir detects your AI tools, configures MCP, and activates memory. No global install needed.
 
-Your AI gets 7 memory tools:
+Your AI gets 14 memory tools:
 
 | MCP Tool | What it does |
 |----------|-------------|
@@ -55,6 +55,13 @@ Your AI gets 7 memory tools:
 | `memoir_consolidate` | Analyze memories for duplicates, staleness, and bloat |
 | `memoir_status` | See which AI tools are detected |
 | `memoir_profiles` | Switch between work/personal |
+| `memoir_set_goal` | Set the current session goal (pinned into CLAUDE.md) |
+| `memoir_add_next` | Add a next action to the current session |
+| `memoir_complete_next` | Mark a next action as done |
+| `memoir_note` | Record a decision with its rationale |
+| `memoir_ask` | Capture an open question for later |
+| `memoir_session` | Show goals, next actions, decisions, and recent sessions |
+| `memoir_why` | Look up why a past decision was made |
 
 ## Why memoir
 
@@ -62,7 +69,7 @@ Your AI forgets everything between sessions. You re-explain your codebase, your
 
 memoir fixes this by giving your AI a shared memory layer that works across **every tool you use**. Tell Claude something once. Cursor knows it too. Sync AI memory between tools, back it up to the cloud, restore it on any machine. And when your memories pile up, `memoir consolidate` cleans house — finds duplicates, flags stale context, and optionally uses AI to merge and prune.
 
-**13 tools supported:** Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot, OpenAI Codex, ChatGPT, Aider, Zed, Cline, Continue.dev, Augment, Trae.
+**11 tools supported:** Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot, OpenAI Codex, ChatGPT, Aider, Zed, Cline, Continue.dev.
 
 ## Sync across machines
 

package/bin/memoir.js

@@ -112,6 +112,7 @@ program
   .description('Back up your AI memory to the cloud')
   .option('--only <tools>', 'Only sync specific tools (comma-separated)')
   .option('-p, --profile <name>', 'Use a specific profile')
+  .option('--redact', 'Strip detected secrets from synced files before they are backed up')
   .action(async (options) => {
     try {
       await pushCommand(options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "mcpName": "io.github.camgitt/memoir",
   "description": "MCP server that gives Claude, Cursor, and Gemini long-term memory across sessions. Your AI remembers your codebase, decisions, and preferences — across tools and machines.",
   "main": "src/index.js",
@@ -20,7 +20,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/camgitt/memoir.git"
+    "url": "git+https://github.com/camgitt/memoir.git"
   },
   "homepage": "https://memoir.sh",
   "bugs": {

package/src/commands/doctor.js

@@ -8,15 +8,7 @@ import os from 'os';
 import { execSync } from 'child_process';
 import { getConfig } from '../config.js';
 import { adapters } from '../adapters/index.js';
-
-const SECRET_PATTERNS = [
-  { pattern: /sk-[a-zA-Z0-9]{20,}/, label: 'OpenAI/Stripe secret key' },
-  { pattern: /key-[a-zA-Z0-9]{20,}/, label: 'API key' },
-  { pattern: /ghp_[a-zA-Z0-9]{36,}/, label: 'GitHub personal access token' },
-  { pattern: /gho_[a-zA-Z0-9]{36,}/, label: 'GitHub OAuth token' },
-  { pattern: /AKIA[0-9A-Z]{16}/, label: 'AWS access key' },
-  { pattern: /Bearer\s+[a-zA-Z0-9._\-]{20,}/, label: 'Bearer token' },
-];
+import { scanForSecrets as scanTextForSecrets } from '../security/scanner.js';
 
 const SENSITIVE_FILENAMES = ['.env', 'credentials', 'token.json'];
 
@@ -61,11 +53,9 @@ async function scanForSecrets(files) {
       // Skip files larger than 1MB
       if (stat.size > 1024 * 1024) continue;
       const content = await fs.readFile(filePath, 'utf-8');
-      for (const { pattern, label } of SECRET_PATTERNS) {
-        if (pattern.test(content)) {
-          warnings.push({ file: filePath, reason: label });
-          break;
-        }
+      const { found } = scanTextForSecrets(content);
+      if (found.length > 0) {
+        warnings.push({ file: filePath, reason: found[0].label });
       }
     } catch {
       // Skip unreadable files

package/src/commands/push.js

@@ -19,6 +19,52 @@ import { paths as sessionPaths, readSession, addNote, recordSessionEnd } from '.
 import { renderSession } from '../session/render.js';
 import { injectInto, detectAvailableTargets } from '../session/inject.js';
 
+// Recursively scan every staged file (the REAL tool memory/config files about
+// to be uploaded — CLAUDE.md, .cursorrules, settings.json, project configs,
+// etc.) for secrets. When `redact` is true, rewrite each offending file in
+// place so the cleaned version is what gets uploaded (and encrypted, if on).
+// Returns { findings, scanned } where findings is a flat list of detections
+// keyed by file. Best-effort: unreadable/binary files are skipped.
+export async function scanStagedFiles(dir, { redact = false } = {}) {
+  const findings = [];
+  let scanned = 0;
+
+  const walk = async (d) => {
+    let entries;
+    try {
+      entries = await fs.readdir(d, { withFileTypes: true });
+    } catch { return; }
+    for (const entry of entries) {
+      const fullPath = path.join(d, entry.name);
+      if (entry.isDirectory()) {
+        await walk(fullPath);
+        continue;
+      }
+      try {
+        const stat = await fs.stat(fullPath);
+        // Skip files larger than 1MB — same threshold as doctor's scan
+        if (stat.size > 1024 * 1024) continue;
+        const content = await fs.readFile(fullPath, 'utf-8');
+        scanned++;
+        const { found, clean } = scanForSecrets(content);
+        if (found.length > 0) {
+          for (const f of found) {
+            findings.push({ file: fullPath, label: f.label, redacted: f.redacted });
+          }
+          if (redact && clean !== content) {
+            await fs.writeFile(fullPath, clean);
+          }
+        }
+      } catch {
+        // Skip unreadable / non-text files
+      }
+    }
+  };
+
+  await walk(dir);
+  return { findings, scanned };
+}
+
 export async function pushCommand(options = {}) {
   let config = await getConfig(options.profile);
 
@@ -205,6 +251,47 @@ export async function pushCommand(options = {}) {
       }
     }
 
+    // Scan the REAL files being synced (the staged tool memory/config files,
+    // not just the handoff blob) for secrets before they leave the machine.
+    //   • --redact            → strip secrets in place, then upload (sanitized)
+    //   • otherwise           → WARN and continue
+    //   • background autopush → stay silent and continue
+    // We deliberately do NOT hard-block. This is a zero-knowledge encrypted
+    // backup of the user's OWN files; silently refusing to back up — which the
+    // detached `autopush` Stop-hook path (stdio:'ignore', MEMOIR_AUTOPUSH=1, no
+    // TTY) would hit on any false-positive match — is a worse failure than
+    // backing up. A future `--strict` flag could fail-closed for the
+    // encrypt-off / shared-destination case. Wrapped so a scanner error can
+    // never break the push.
+    const background = process.env.MEMOIR_AUTOPUSH === '1';
+    try {
+      const { findings } = await scanStagedFiles(stagingDir, { redact: options.redact === true });
+      if (findings.length > 0) {
+        if (options.redact === true) {
+          spinner.stop();
+          console.log(chalk.yellow(`\n  🔒 Redacted ${findings.length} secret(s) from synced files before upload:`));
+          for (const f of findings.slice(0, 5)) {
+            console.log(chalk.gray(`     ${path.basename(f.file)}: ${f.label} (${f.redacted})`));
+          }
+          if (findings.length > 5) console.log(chalk.gray(`     ...and ${findings.length - 5} more`));
+          spinner.start();
+        } else if (!background) {
+          // Warn (interactive or piped) but never block — the backup proceeds.
+          spinner.stop();
+          console.log(chalk.yellow(`\n  ⚠️  ${findings.length} potential secret(s) in synced files (backed up as-is):`));
+          for (const f of findings.slice(0, 5)) {
+            console.log(chalk.gray(`     ${path.basename(f.file)}: ${f.label} (${f.redacted})`));
+          }
+          if (findings.length > 5) console.log(chalk.gray(`     ...and ${findings.length - 5} more`));
+          console.log(chalk.gray('  Re-run with ') + chalk.cyan('--redact') + chalk.gray(' to strip them from the backup.'));
+          spinner.start();
+        }
+        // background autopush: silent, continue — never block the auto-backup
+      }
+    } catch {
+      // Secret scan is best-effort — never let it break the push.
+    }
+
     // Encrypt if enabled (or ask on first push if not configured)
     let uploadDir = stagingDir;
     let encrypted = false;