memorix 1.2.0 → 1.2.2

package/src/cli/commands/serve-http.ts

@@ -23,6 +23,8 @@ import { defineCommand } from 'citty';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ObservationStore } from '../../store/obs-store.js';
 import { resolveToolProfile } from '../../server/tool-profile.js';
+import { scopeKnowledgeGraphToProject } from '../../memory/graph-scope.js';
+import { canManageObservation, filterReadableObservations } from '../../memory/visibility.js';
 
 export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 
@@ -557,7 +559,7 @@ export default defineCommand({
 
     async function loadDashboardObservations(dataDir: string) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadAll();
+      return filterReadableObservations(await store.loadAll(), {});
     }
 
     async function loadDashboardProjectObservations(
@@ -566,7 +568,10 @@ export default defineCommand({
       status?: string,
     ) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadByProject(projectId, status ? { status } : undefined);
+      return filterReadableObservations(
+        await store.loadByProject(projectId, status ? { status } : undefined),
+        { projectId },
+      );
     }
 
     // Resolve static directory (dist/dashboard/static)
@@ -764,6 +769,7 @@ export default defineCommand({
             source?: string;
             commitHash?: string;
             filesModified?: string[];
+            relatedEntities?: string[];
             status?: string;
             importance?: number;
             accessCount?: number;
@@ -860,12 +866,7 @@ export default defineCommand({
           } catch { /* best effort */ }
 
           // Project-scoped graph counts (must match /graph and /export)
-          const projectEntityNames = new Set(
-            observations.filter(o => o.entityName).map(o => o.entityName!)
-          );
-          const projectEntities = graph.entities.filter((e: any) => projectEntityNames.has(e.name));
-          const projectEntitySet = new Set(projectEntities.map((e: any) => e.name));
-          const projectRelations = graph.relations.filter((r: any) => projectEntitySet.has(r.from) && projectEntitySet.has(r.to));
+          const projectGraph = scopeKnowledgeGraphToProject(graph, observations);
 
           let maintenance = { total: 0, pending: 0, running: 0, retrying: 0, completed: 0, failed: 0 };
           let lifecycle: unknown;
@@ -877,8 +878,8 @@ export default defineCommand({
           } catch { /* optional maintenance diagnostics */ }
 
           sendJson({
-            entities: projectEntities.length,
-            relations: projectRelations.length,
+            entities: projectGraph.entities.length,
+            relations: projectGraph.relations.length,
             observations: observations.length,
             nextId,
             typeCounts,
@@ -930,19 +931,9 @@ export default defineCommand({
           await initGraphStore(graphDataDir);
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
 
-          // Project-scope the graph: only include entities that have observations in this project
-          const allObs = await loadDashboardProjectObservations(graphDataDir, graphProjectId, 'active') as Array<{ entityName?: string }>;
-          const projectEntityNames = new Set(
-            allObs
-              .filter(o => o.entityName)
-              .map(o => o.entityName!)
-          );
-
-          const entities = fullGraph.entities.filter(e => projectEntityNames.has(e.name));
-          const entityNameSet = new Set(entities.map(e => e.name));
-          const relations = fullGraph.relations.filter(r => entityNameSet.has(r.from) && entityNameSet.has(r.to));
-
-          sendJson({ entities, relations });
+          const allObs = await loadDashboardProjectObservations(graphDataDir, graphProjectId, 'active');
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
+          sendJson({ entities: scoped.entities, relations: scoped.relations });
           return;
         }
 
@@ -1012,24 +1003,15 @@ export default defineCommand({
           const allObs = await loadDashboardProjectObservations(kgDataDir, kgProjectId, 'active');
           const skills = await getMiniSkillStore().loadByProject(kgProjectId);
 
-          // Project-scope graph store (same logic as /api/graph)
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-          const graphObs = await loadDashboardProjectObservations(kgDataDir, kgProjectId, 'active') as Array<{ entityName?: string }>;
-          const projectEntityNames = new Set(
-            graphObs
-              .filter(o => o.entityName)
-              .map(o => o.entityName!)
-          );
-          const scopedEntities = fullGraph.entities.filter(e => projectEntityNames.has(e.name));
-          const scopedEntityNameSet = new Set(scopedEntities.map(e => e.name));
-          const scopedRelations = fullGraph.relations.filter(r => scopedEntityNameSet.has(r.from) && scopedEntityNameSet.has(r.to));
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
 
           const graph = generateKnowledgeGraph({
             projectId: kgProjectId,
             observations: allObs,
             miniSkills: skills,
-            graphEntities: scopedEntities,
-            graphRelations: scopedRelations,
+            graphEntities: scoped.entities,
+            graphRelations: scoped.relations,
           });
 
           sendJson(graph);
@@ -1343,6 +1325,8 @@ export default defineCommand({
             sendJson({ error: 'Observation not found' }, 404);
           } else if ((matchObs as any).projectId !== delProjectId) {
             sendJson({ error: `Observation #${obsId} belongs to project "${(matchObs as any).projectId}", not "${delProjectId}"` }, 403);
+          } else if (!canManageObservation(matchObs, { projectId: delProjectId })) {
+            sendJson({ error: `Observation #${obsId} is not manageable from the unbound dashboard.` }, 403);
           } else {
             await store.remove(obsId);
             // Sync: clean up graph entity references
@@ -1369,19 +1353,14 @@ export default defineCommand({
           const { initGraphStore, getGraphStore } = await import('../../store/graph-store.js');
           await initGraphStore(expDataDir);
           const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
-          const observations = await loadDashboardProjectObservations(expDataDir, expProjectId, 'active') as Array<{ entityName?: string }>;
+          const observations = await loadDashboardProjectObservations(expDataDir, expProjectId, 'active');
           const expStore = await getDashboardObservationStore(expDataDir);
           const nextId = await expStore.loadIdCounter();
-          const exportEntityNames = new Set(
-            observations.filter(o => o.entityName).map(o => o.entityName!),
-          );
-          const exportEntities = fullGraph.entities.filter((e: any) => exportEntityNames.has(e.name));
-          const exportEntitySet = new Set(exportEntities.map((e: any) => e.name));
-          const exportRelations = fullGraph.relations.filter((r: any) => exportEntitySet.has(r.from) && exportEntitySet.has(r.to));
+          const scoped = scopeKnowledgeGraphToProject(fullGraph, observations);
           const exportData = {
             project: { id: expProjectId, name: expProjectName },
             exportedAt: new Date().toISOString(),
-            graph: { entities: exportEntities, relations: exportRelations },
+            graph: { entities: scoped.entities, relations: scoped.relations },
             observations,
             nextId,
           };

package/src/cli/commands/serve-shared.ts

@@ -1,118 +1,118 @@
-import type { ProjectInfo } from '../../types.js';
-
-export interface ResolveServeProjectOptions {
-  cwdArg?: string;
-  envProjectRoot?: string;
-  initCwd?: string;
-  processCwd: string;
-  homeDir: string;
-  lastKnownProjectRoot?: string;
-}
-
-export interface ResolveServeProjectDeps {
-  detectProject: (cwd: string) => ProjectInfo | null;
-  findGitInSubdirs: (dir: string) => string | null;
-  isSystemDirectory: (dir: string) => boolean;
-}
-
-export interface ServeProjectResolution {
-  projectRoot: string;
-  detectedProject: ProjectInfo | null;
-  source: 'direct' | 'subdir' | 'last-known' | 'home' | 'home-subdir' | 'unresolved';
-  messages: string[];
-  error?: string;
-}
-
-export function resolveServeProject(
-  options: ResolveServeProjectOptions,
-  deps: ResolveServeProjectDeps,
-): ServeProjectResolution {
-  let projectRoot =
-    options.cwdArg ||
-    options.envProjectRoot ||
-    options.initCwd ||
-    options.processCwd;
-
-  const messages: string[] = [`[memorix] Starting with cwd: ${projectRoot}`];
-
-  let detected = deps.detectProject(projectRoot);
-  if (detected) {
-    return {
-      projectRoot,
-      detectedProject: detected,
-      source: 'direct',
-      messages,
-    };
-  }
-
-  const subGit = deps.findGitInSubdirs(projectRoot);
-  if (subGit) {
-    projectRoot = subGit;
-    detected = deps.detectProject(subGit);
-    if (detected) {
-      messages.push(`[memorix] Found .git in subdirectory: ${subGit}`);
-      return {
-        projectRoot,
-        detectedProject: detected,
-        source: 'subdir',
-        messages,
-      };
-    }
-  }
-
-  if (deps.isSystemDirectory(projectRoot)) {
-    messages.push(`[memorix] System directory detected: ${projectRoot}`);
-    messages.push('[memorix] Your IDE launched memorix from a non-workspace directory.');
-    messages.push('[memorix] Fix: add --cwd to your MCP config, or use an IDE/client that exposes workspace roots.');
-
-    if (options.lastKnownProjectRoot) {
-      detected = deps.detectProject(options.lastKnownProjectRoot);
-      if (detected) {
-        messages.push(`[memorix] Restored last known project: ${options.lastKnownProjectRoot}`);
-        return {
-          projectRoot: options.lastKnownProjectRoot,
-          detectedProject: detected,
-          source: 'last-known',
-          messages,
-        };
-      }
-    }
-
-    detected = deps.detectProject(options.homeDir);
-    if (detected) {
-      messages.push(`[memorix] Restored project from home directory: ${options.homeDir}`);
-      return {
-        projectRoot: options.homeDir,
-        detectedProject: detected,
-        source: 'home',
-        messages,
-      };
-    }
-
-    const homeSubGit = deps.findGitInSubdirs(options.homeDir);
-    if (homeSubGit) {
-      detected = deps.detectProject(homeSubGit);
-      if (detected) {
-        messages.push(`[memorix] Found .git in home subdirectory: ${homeSubGit}`);
-        return {
-          projectRoot: homeSubGit,
-          detectedProject: detected,
-          source: 'home-subdir',
-          messages,
-        };
-      }
-    }
-  }
-
-  messages.push('[memorix] Unable to establish a reliable git-backed project context.');
-  messages.push('[memorix] Memorix now refuses to silently fall back to untracked/* in stdio mode.');
-
-  return {
-    projectRoot,
-    detectedProject: null,
-    source: 'unresolved',
-    messages,
-    error:
-      'No git project could be resolved from the current workspace. Open the repo root, pass --cwd, or use an MCP client that sends workspace roots.',
-  };
-}
+import type { ProjectInfo } from '../../types.js';
+
+export interface ResolveServeProjectOptions {
+  cwdArg?: string;
+  envProjectRoot?: string;
+  initCwd?: string;
+  processCwd: string;
+  homeDir: string;
+  lastKnownProjectRoot?: string;
+}
+
+export interface ResolveServeProjectDeps {
+  detectProject: (cwd: string) => ProjectInfo | null;
+  findGitInSubdirs: (dir: string) => string | null;
+  isSystemDirectory: (dir: string) => boolean;
+}
+
+export interface ServeProjectResolution {
+  projectRoot: string;
+  detectedProject: ProjectInfo | null;
+  source: 'direct' | 'subdir' | 'last-known' | 'home' | 'home-subdir' | 'unresolved';
+  messages: string[];
+  error?: string;
+}
+
+export function resolveServeProject(
+  options: ResolveServeProjectOptions,
+  deps: ResolveServeProjectDeps,
+): ServeProjectResolution {
+  let projectRoot =
+    options.cwdArg ||
+    options.envProjectRoot ||
+    options.initCwd ||
+    options.processCwd;
+
+  const messages: string[] = [`[memorix] Starting with cwd: ${projectRoot}`];
+
+  let detected = deps.detectProject(projectRoot);
+  if (detected) {
+    return {
+      projectRoot,
+      detectedProject: detected,
+      source: 'direct',
+      messages,
+    };
+  }
+
+  const subGit = deps.findGitInSubdirs(projectRoot);
+  if (subGit) {
+    projectRoot = subGit;
+    detected = deps.detectProject(subGit);
+    if (detected) {
+      messages.push(`[memorix] Found .git in subdirectory: ${subGit}`);
+      return {
+        projectRoot,
+        detectedProject: detected,
+        source: 'subdir',
+        messages,
+      };
+    }
+  }
+
+  if (deps.isSystemDirectory(projectRoot)) {
+    messages.push(`[memorix] System directory detected: ${projectRoot}`);
+    messages.push('[memorix] Your IDE launched memorix from a non-workspace directory.');
+    messages.push('[memorix] Fix: add --cwd to your MCP config, or use an IDE/client that exposes workspace roots.');
+
+    if (options.lastKnownProjectRoot) {
+      detected = deps.detectProject(options.lastKnownProjectRoot);
+      if (detected) {
+        messages.push(`[memorix] Restored last known project: ${options.lastKnownProjectRoot}`);
+        return {
+          projectRoot: options.lastKnownProjectRoot,
+          detectedProject: detected,
+          source: 'last-known',
+          messages,
+        };
+      }
+    }
+
+    detected = deps.detectProject(options.homeDir);
+    if (detected) {
+      messages.push(`[memorix] Restored project from home directory: ${options.homeDir}`);
+      return {
+        projectRoot: options.homeDir,
+        detectedProject: detected,
+        source: 'home',
+        messages,
+      };
+    }
+
+    const homeSubGit = deps.findGitInSubdirs(options.homeDir);
+    if (homeSubGit) {
+      detected = deps.detectProject(homeSubGit);
+      if (detected) {
+        messages.push(`[memorix] Found .git in home subdirectory: ${homeSubGit}`);
+        return {
+          projectRoot: homeSubGit,
+          detectedProject: detected,
+          source: 'home-subdir',
+          messages,
+        };
+      }
+    }
+  }
+
+  messages.push('[memorix] Unable to establish a reliable git-backed project context.');
+  messages.push('[memorix] Memorix now refuses to silently fall back to untracked/* in stdio mode.');
+
+  return {
+    projectRoot,
+    detectedProject: null,
+    source: 'unresolved',
+    messages,
+    error:
+      'No git project could be resolved from the current workspace. Open the repo root, pass --cwd, or use an MCP client that sends workspace roots.',
+  };
+}

package/src/cli/commands/session.ts

@@ -5,6 +5,8 @@ import { computeWatermark } from '../../team/poll.js';
 import { withFreshIndex } from '../../memory/freshness.js';
 import { getAllObservations } from '../../memory/observations.js';
 import { getObservationStore } from '../../store/obs-store.js';
+import { filterReadableObservations } from '../../memory/visibility.js';
+import { saveCliIdentity } from '../identity.js';
 import { emitError, emitResult, getCliProjectContext, parsePositiveInt } from './operator-shared.js';
 
 export default defineCommand({
@@ -18,6 +20,7 @@ export default defineCommand({
     instanceId: { type: 'string', description: 'Stable instance identity across restarts' },
     projectRoot: { type: 'string', description: 'Absolute project root used to bind the session context' },
     joinTeam: { type: 'boolean', description: 'Explicitly join orchestration coordination state for this session' },
+    use: { type: 'boolean', description: 'Make the joined coordination identity active for later CLI commands' },
     role: { type: 'string', description: 'Explicit role override used only when --joinTeam is set' },
     sessionId: { type: 'string', description: 'Custom session ID (optional)' },
     summary: { type: 'string', description: 'Structured session summary for session end' },
@@ -35,6 +38,14 @@ export default defineCommand({
 
       switch (action) {
         case 'start': {
+          if (args.use && !args.joinTeam) {
+            emitError('use requires --joinTeam when starting a session.', asJson);
+            return;
+          }
+          if (args.use && !args.agent && !args.agentType) {
+            emitError('use requires --agent or --agentType so Memorix can activate a coordination identity.', asJson);
+            return;
+          }
           const result = await startSession(dataDir, project.id, {
             sessionId: args.sessionId as string | undefined,
             agent: args.agent as string | undefined,
@@ -61,6 +72,16 @@ export default defineCommand({
             teamJoinNotice = 'Coordination join skipped: provide --agent or --agentType to create a coordination identity.';
           }
 
+          let identityActivated = false;
+          if (args.use && agentRecord) {
+            await saveCliIdentity(dataDir, {
+              agentId: agentRecord.agent_id,
+              projectId: project.id,
+              activatedAt: new Date().toISOString(),
+            });
+            identityActivated = true;
+          }
+
           let watermark = computeWatermark(0, 0, 0);
           let rescuedAgentIds: string[] = [];
           let availableTasks = 0;
@@ -70,8 +91,11 @@ export default defineCommand({
             const store = getObservationStore();
             const currentGen = store.getGeneration();
             const projectObs = await withFreshIndex(() =>
-              getAllObservations().filter(
-                (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+              filterReadableObservations(
+                getAllObservations().filter(
+                  (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+                ),
+                { projectId: project.id, agentId: agentRecord.agent_id, isTeamMember: agentRecord.status === 'active' },
               ),
             );
             watermark = computeWatermark(lastSeen, currentGen, projectObs.length);
@@ -97,6 +121,7 @@ export default defineCommand({
               joined: !!agentRecord,
               notice: teamJoinNotice,
             },
+            identityActivated,
             watermark,
             rescue: {
               staleAgents: rescuedAgentIds,
@@ -113,6 +138,7 @@ export default defineCommand({
             agentRecord
               ? `Agent: ${agentRecord.name} [${agentRecord.agent_type}] as ${agentRecord.role} (${agentRecord.agent_id})`
               : '',
+            identityActivated ? 'CLI identity activated for follow-up memory and coordination commands.' : '',
             !agentRecord ? 'Coordination identity: not joined (memory/session context only)' : '',
             teamJoinNotice ?? '',
             agentRecord && watermark.newObservationCount > 0
@@ -173,7 +199,7 @@ export default defineCommand({
           console.log('Memorix Session Commands');
           console.log('');
           console.log('Usage:');
-          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam]');
+          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam --use]');
           console.log('  memorix session end --sessionId <id> [--summary "..."]');
           console.log('  memorix session context [--limit 3]');
           console.log('');

package/src/cli/commands/setup.ts

@@ -1062,7 +1062,7 @@ function tryInstallOmpPackage(packagePath: string): { ok: boolean; message: stri
   };
 }
 
-async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: boolean): Promise<void> {
+export async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: boolean): Promise<void> {
   const { installAgentGuidance, installHooks } = await import('../../hooks/installers/index.js');
   const targetRoot = global ? homedir() : process.cwd();
   const hasPluginPackage = plan.actions.includes('plugin-package') && PLUGIN_PACKAGE_AGENTS.has(agent);
@@ -1200,13 +1200,19 @@ async function installAgentSetup(agent: AgentName, plan: SetupPlan, global: bool
   } else if (hasOmpPackage) {
     p.log.info(`${agent}: extension command, hook events, and skills are bundled in the Oh-my-Pi package`);
   } else if (hasExtensionPackage) {
-    if (plan.actions.includes('hooks') || plan.actions.includes('project-guidance')) {
+    if (plan.actions.includes('hooks')) {
       const result = await installHooks(agent, targetRoot, global);
       p.log.success(`${agent}: integration files -> ${result.configPath}`);
+    } else if (plan.actions.includes('project-guidance')) {
+      const rulesPath = await installAgentGuidance(agent, targetRoot, global);
+      p.log.success(`${agent}: guidance -> ${rulesPath}`);
     }
-  } else if (agent === 'opencode' || plan.actions.includes('hooks') || plan.actions.includes('project-guidance')) {
+  } else if (plan.actions.includes('hooks')) {
     const result = await installHooks(agent, targetRoot, global);
     p.log.success(`${agent}: integration files -> ${result.configPath}`);
+  } else if (plan.actions.includes('project-guidance')) {
+    const rulesPath = await installAgentGuidance(agent, targetRoot, global);
+    p.log.success(`${agent}: guidance -> ${rulesPath}`);
   }
 
   if (agent === 'pi') {