memorix 1.2.1 → 1.2.2

package/src/cli/commands/message.ts

@@ -1,121 +1,126 @@
-import { defineCommand } from 'citty';
-import { emitError, emitResult, getCliProjectContext, shortId } from './operator-shared.js';
-
-export default defineCommand({
-  meta: {
-    name: 'message',
-    description: 'Send, broadcast, and read team messages from the CLI',
-  },
-  args: {
-    from: { type: 'string', description: 'Sender agent ID' },
-    to: { type: 'string', description: 'Recipient agent ID' },
-    type: { type: 'string', description: 'Message type (request, response, info, handoff, etc.)' },
-    content: { type: 'string', description: 'Message content' },
-    agentId: { type: 'string', description: 'Agent ID for inbox reads' },
-    markRead: { type: 'boolean', description: 'Mark inbox messages as read after listing them' },
-    toRole: { type: 'string', description: 'Optional role target for the message' },
-    handoffStatus: { type: 'string', description: 'Optional handoff status when type=handoff' },
-    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
-  },
-  run: async ({ args }) => {
-    const action = (args._ as string[])?.[0] || '';
-    const asJson = !!args.json;
-
-    try {
-      const { project, teamStore } = await getCliProjectContext();
-
-      switch (action) {
-        case 'send': {
-          if (!args.from || !args.type || !args.content) {
-            emitError('from, type, and content are required for "memorix message send"', asJson);
+import { defineCommand } from 'citty';
+import { emitError, emitResult, getCliProjectContext, resolveCliActorId, shortId } from './operator-shared.js';
+
+export default defineCommand({
+  meta: {
+    name: 'message',
+    description: 'Send, broadcast, and read team messages from the CLI',
+  },
+  args: {
+    from: { type: 'string', description: 'Sender agent ID' },
+    to: { type: 'string', description: 'Recipient agent ID' },
+    type: { type: 'string', description: 'Message type (request, response, info, handoff, etc.)' },
+    content: { type: 'string', description: 'Message content' },
+    agentId: { type: 'string', description: 'Agent ID for inbox reads' },
+    markRead: { type: 'boolean', description: 'Mark inbox messages as read after listing them' },
+    toRole: { type: 'string', description: 'Optional role target for the message' },
+    handoffStatus: { type: 'string', description: 'Optional handoff status when type=handoff' },
+    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
+  },
+  run: async ({ args }) => {
+    const action = (args._ as string[])?.[0] || '';
+    const asJson = !!args.json;
+
+    try {
+      const { project, teamStore, identity } = await getCliProjectContext();
+      const senderAgentId = resolveCliActorId(args.from, identity, 'from');
+      const inboxAgentId = resolveCliActorId(
+        (args.agentId as string | undefined) ?? (args.from as string | undefined),
+        identity,
+        'agentId',
+      );
+
+      switch (action) {
+        case 'send': {
+          if (!senderAgentId || !args.type || !args.content) {
+            emitError('type, content, and an active CLI identity or from agentId are required for "memorix message send"', asJson);
+            return;
+          }
+          if (!args.to && !args.toRole) {
+            emitError('Either --to or --toRole is required for "memorix message send"', asJson);
+            return;
+          }
+          const message = teamStore.sendMessage({
+            projectId: project.id,
+            senderAgentId,
+            recipientAgentId: (args.to as string | undefined) ?? null,
+            type: args.type as string,
+            content: args.content as string,
+            toRole: (args.toRole as string | undefined) ?? null,
+            handoffStatus:
+              (args.handoffStatus as string | undefined) ??
+              ((args.type as string) === 'handoff' ? 'open' : null),
+          });
+          if ('error' in message) {
+            emitError(message.error, asJson);
+            return;
+          }
+          emitResult(
+            { project, message },
+            `Message sent: ${shortId(message.id)} to ${args.to ? shortId(args.to as string) : `role ${args.toRole}`}`,
+            asJson,
+          );
+          return;
+        }
+
+        case 'broadcast': {
+          if (!senderAgentId || !args.type || !args.content) {
+            emitError('type, content, and an active CLI identity or from agentId are required for "memorix message broadcast"', asJson);
+            return;
+          }
+          const message = teamStore.sendMessage({
+            projectId: project.id,
+            senderAgentId,
+            recipientAgentId: null,
+            type: args.type as string,
+            content: args.content as string,
+          });
+          if ('error' in message) {
+            emitError(message.error, asJson);
+            return;
+          }
+          emitResult(
+            { project, message },
+            `Broadcast sent: ${shortId(message.id)}`,
+            asJson,
+          );
+          return;
+        }
+
+        case 'inbox': {
+          if (!inboxAgentId) {
+            emitError('an active CLI identity or agentId is required for "memorix message inbox"', asJson);
             return;
           }
-          if (!args.to && !args.toRole) {
-            emitError('Either --to or --toRole is required for "memorix message send"', asJson);
-            return;
-          }
-          const message = teamStore.sendMessage({
-            projectId: project.id,
-            senderAgentId: args.from as string,
-            recipientAgentId: (args.to as string | undefined) ?? null,
-            type: args.type as string,
-            content: args.content as string,
-            toRole: (args.toRole as string | undefined) ?? null,
-            handoffStatus:
-              (args.handoffStatus as string | undefined) ??
-              ((args.type as string) === 'handoff' ? 'open' : null),
-          });
-          if ('error' in message) {
-            emitError(message.error, asJson);
-            return;
-          }
-          emitResult(
-            { project, message },
-            `Message sent: ${shortId(message.id)} to ${args.to ? shortId(args.to as string) : `role ${args.toRole}`}`,
-            asJson,
-          );
-          return;
-        }
-
-        case 'broadcast': {
-          if (!args.from || !args.type || !args.content) {
-            emitError('from, type, and content are required for "memorix message broadcast"', asJson);
-            return;
-          }
-          const message = teamStore.sendMessage({
-            projectId: project.id,
-            senderAgentId: args.from as string,
-            recipientAgentId: null,
-            type: args.type as string,
-            content: args.content as string,
-          });
-          if ('error' in message) {
-            emitError(message.error, asJson);
-            return;
-          }
-          emitResult(
-            { project, message },
-            `Broadcast sent: ${shortId(message.id)}`,
-            asJson,
-          );
-          return;
-        }
-
-        case 'inbox': {
-          const agentId = (args.agentId as string | undefined) || (args.from as string | undefined);
-          if (!agentId) {
-            emitError('agentId is required for "memorix message inbox"', asJson);
-            return;
-          }
-          const messages = teamStore.getInbox(project.id, agentId);
-          const unreadCount = teamStore.getUnreadCount(project.id, agentId);
+          const messages = teamStore.getInbox(project.id, inboxAgentId);
+          const unreadCount = teamStore.getUnreadCount(project.id, inboxAgentId);
           if (args.markRead) {
-            teamStore.markAllRead(project.id, agentId);
-          }
-          emitResult(
-            { project, unreadCount, messages },
-            messages.length === 0
-              ? 'Inbox empty.'
-              : [`Inbox: ${unreadCount} unread / ${messages.length} total`, '', ...messages.map((message) => {
-                  const sender = teamStore.getAgent(message.sender_agent_id);
-                  return `- ${message.read_at ? ' ' : '*'} [${message.type}] from ${sender?.name ?? shortId(message.sender_agent_id)}: ${message.content}`;
-                })].join('\n'),
-            asJson,
-          );
-          return;
-        }
-
-        default:
-          console.log('Memorix Message Commands');
-          console.log('');
-          console.log('Usage:');
-          console.log('  memorix message send --from <agentId> --to <agentId> --type info --content "..."');
-          console.log('  memorix message send --from <agentId> --toRole reviewer --type handoff --content "..."');
-          console.log('  memorix message broadcast --from <agentId> --type announcement --content "..."');
-          console.log('  memorix message inbox --agentId <id> [--markRead]');
-      }
-    } catch (error) {
-      emitError(error instanceof Error ? error.message : String(error), asJson);
-    }
-  },
-});
+            teamStore.markAllRead(project.id, inboxAgentId);
+          }
+          emitResult(
+            { project, unreadCount, messages },
+            messages.length === 0
+              ? 'Inbox empty.'
+              : [`Inbox: ${unreadCount} unread / ${messages.length} total`, '', ...messages.map((message) => {
+                  const sender = teamStore.getAgent(message.sender_agent_id);
+                  return `- ${message.read_at ? ' ' : '*'} [${message.type}] from ${sender?.name ?? shortId(message.sender_agent_id)}: ${message.content}`;
+                })].join('\n'),
+            asJson,
+          );
+          return;
+        }
+
+        default:
+          console.log('Memorix Message Commands');
+          console.log('');
+          console.log('Usage:');
+          console.log('  memorix message send --from <agentId> --to <agentId> --type info --content "..."');
+          console.log('  memorix message send --from <agentId> --toRole reviewer --type handoff --content "..."');
+          console.log('  memorix message broadcast --from <agentId> --type announcement --content "..."');
+          console.log('  memorix message inbox --agentId <id> [--markRead]');
+      }
+    } catch (error) {
+      emitError(error instanceof Error ? error.message : String(error), asJson);
+    }
+  },
+});

package/src/cli/commands/operator-shared.ts

@@ -3,16 +3,33 @@ import { getProjectDataDir } from '../../store/persistence.js';
 import { initObservations, prepareSearchIndex } from '../../memory/observations.js';
 import { initSessionStore } from '../../store/session-store.js';
 import { initTeamStore, type TeamStore } from '../../team/team-store.js';
-import type { ProjectInfo, ObservationType, ObservationStatus } from '../../types.js';
+import type {
+  ProjectInfo,
+  ObservationReader,
+  ObservationStatus,
+  ObservationType,
+  ObservationVisibility,
+} from '../../types.js';
+import { getCliInvocation } from '../invocation.js';
+import { resolveCliIdentity, type CliIdentity } from '../identity.js';
 
 export interface CliProjectContext {
   project: ProjectInfo;
   dataDir: string;
   teamStore: TeamStore;
+  reader: ObservationReader;
+  identity: CliIdentity | null;
+  identityWarning?: string;
 }
 
 export async function getCliProjectContext(options?: { searchIndex?: boolean; projectRoot?: string }): Promise<CliProjectContext> {
-  const detection = detectProjectWithDiagnostics(options?.projectRoot ?? process.cwd());
+  const invocation = getCliInvocation();
+  const detection = detectProjectWithDiagnostics(
+    options?.projectRoot
+      ?? invocation.projectRoot
+      ?? process.env.MEMORIX_PROJECT_ROOT
+      ?? process.cwd(),
+  );
   if (!detection.project) {
     const detail = detection.failure?.detail ?? 'No git repository found in the current directory.';
     throw new Error(detail);
@@ -20,6 +37,16 @@ export async function getCliProjectContext(options?: { searchIndex?: boolean; pr
 
   const project = detection.project;
   const dataDir = await getProjectDataDir(project.id);
+  try {
+    const { MaintenanceTargetStore } = await import('../../runtime/maintenance-targets.js');
+    new MaintenanceTargetStore(dataDir).register({
+      projectId: project.id,
+      projectRoot: project.rootPath,
+      dataDir,
+    });
+  } catch {
+    // CLI reads remain available even if optional background maintenance metadata fails.
+  }
   await initObservations(dataDir);
   await initSessionStore(dataDir);
   const teamStore = await initTeamStore(dataDir);
@@ -28,7 +55,21 @@ export async function getCliProjectContext(options?: { searchIndex?: boolean; pr
     await prepareSearchIndex();
   }
 
-  return { project, dataDir, teamStore };
+  const identity = await resolveCliIdentity({
+    project,
+    dataDir,
+    teamStore,
+    explicitActorId: invocation.actorId,
+  });
+
+  return {
+    project,
+    dataDir,
+    teamStore,
+    reader: identity.reader,
+    identity: identity.identity,
+    ...(identity.warning ? { identityWarning: identity.warning } : {}),
+  };
 }
 
 export function emitResult<T>(data: T, text: string, asJson?: boolean): void {
@@ -108,3 +149,57 @@ export function coerceObservationStatus(input?: string): ObservationStatus {
   }
   return normalized;
 }
+
+export function coerceObservationVisibility(input?: string): ObservationVisibility {
+  const normalized = (input ?? 'project').trim().toLowerCase();
+  if (normalized === 'personal' || normalized === 'project' || normalized === 'team') {
+    return normalized;
+  }
+  throw new Error('visibility must be personal, project, or team');
+}
+
+/**
+ * Project scope is deliberately the default. Private and team-scoped records
+ * require an identity selected by the operator, so a plain shell does not
+ * accidentally gain access to another agent's work.
+ */
+export function resolveCliWriteScope(
+  context: Pick<CliProjectContext, 'identity' | 'reader'>,
+  visibilityInput?: string,
+): {
+  visibility: ObservationVisibility;
+  createdByAgentId?: string;
+  visibilityReader: ObservationReader;
+} {
+  const visibility = coerceObservationVisibility(visibilityInput);
+  if (visibility !== 'project' && !context.identity) {
+    throw new Error(
+      `visibility=${visibility} requires an active CLI identity. Run "memorix identity join --agent-type <agent>" or "memorix identity use --agent-id <id>" first.`,
+    );
+  }
+  if (visibility === 'team' && context.reader.isTeamMember !== true) {
+    throw new Error('team visibility requires an active coordination identity for this project.');
+  }
+
+  return {
+    visibility,
+    ...(context.identity ? { createdByAgentId: context.identity.agentId } : {}),
+    visibilityReader: context.reader,
+  };
+}
+
+/**
+ * Coordination commands can use the current CLI identity implicitly, while
+ * retaining explicit IDs for scripts and backwards-compatible invocations.
+ */
+export function resolveCliActorId(
+  explicitValue: unknown,
+  identity: CliIdentity | null,
+  field = 'agentId',
+): string | undefined {
+  const explicit = typeof explicitValue === 'string' ? explicitValue.trim() : '';
+  if (identity && explicit && explicit !== identity.agentId) {
+    throw new Error(`${field} does not match the active CLI identity. Use "memorix identity clear" before acting as a different agent.`);
+  }
+  return explicit || identity?.agentId;
+}

package/src/cli/commands/poll.ts

@@ -1,70 +1,80 @@
-import { defineCommand } from 'citty';
-import { computePoll, computeWatermark } from '../../team/poll.js';
-import { getObservationStore } from '../../store/obs-store.js';
+import { defineCommand } from 'citty';
+import { computePoll, computeWatermark } from '../../team/poll.js';
+import { getObservationStore } from '../../store/obs-store.js';
 import { getAllObservations } from '../../memory/observations.js';
 import { withFreshIndex } from '../../memory/freshness.js';
-import { emitError, emitResult, getCliProjectContext, shortId } from './operator-shared.js';
-
-export default defineCommand({
-  meta: {
-    name: 'poll',
-    description: 'Get a full project coordination snapshot for an agent',
-  },
-  args: {
-    agentId: { type: 'string', description: 'Agent ID for personalized situational awareness' },
-    markInboxRead: { type: 'boolean', description: 'Mark all inbox messages as read after returning them' },
-    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
-  },
-  run: async ({ args }) => {
-    const asJson = !!args.json;
-
-    try {
-      const { project, teamStore } = await getCliProjectContext();
-      const agentId = args.agentId as string | undefined;
-
-      let watermark = computeWatermark(0, 0, 0);
-      if (agentId) {
-        const agent = teamStore.getAgent(agentId);
-        if (!agent) {
+import { filterReadableObservations } from '../../memory/visibility.js';
+import { emitError, emitResult, getCliProjectContext, resolveCliActorId, shortId } from './operator-shared.js';
+
+export default defineCommand({
+  meta: {
+    name: 'poll',
+    description: 'Get a full project coordination snapshot for an agent',
+  },
+  args: {
+    agentId: { type: 'string', description: 'Agent ID for personalized situational awareness' },
+    markInboxRead: { type: 'boolean', description: 'Mark all inbox messages as read after returning them' },
+    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
+  },
+  run: async ({ args }) => {
+    const asJson = !!args.json;
+
+    try {
+      const { project, teamStore, identity, reader: activeReader } = await getCliProjectContext();
+      const agentId = resolveCliActorId(args.agentId, identity);
+      let reader = activeReader;
+
+      let watermark = computeWatermark(0, 0, 0);
+      if (agentId) {
+        const agent = teamStore.getAgent(agentId);
+        if (!agent || agent.project_id !== project.id) {
           emitError(`Unknown agent "${agentId}"`, asJson);
           return;
         }
-
-        const lastSeen = agent.last_seen_obs_generation;
-        const currentGen = getObservationStore().getGeneration();
-        const projectObs = await withFreshIndex(() =>
-          getAllObservations().filter(
-            (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+        reader = {
+          projectId: project.id,
+          agentId,
+          isTeamMember: agent.status === 'active',
+        };
+
+        const lastSeen = agent.last_seen_obs_generation;
+        const currentGen = getObservationStore().getGeneration();
+        const projectObs = await withFreshIndex(() =>
+          filterReadableObservations(
+            getAllObservations().filter(
+              (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+            ),
+            reader,
           ),
-        );
-        watermark = computeWatermark(lastSeen, currentGen, projectObs.length);
-        teamStore.updateWatermark(agentId, currentGen);
-        teamStore.heartbeat(agentId);
-      }
-
-      const poll = computePoll(teamStore, project.id, agentId ?? null, watermark);
-      if (args.markInboxRead && agentId) {
-        teamStore.markAllRead(project.id, agentId);
-      }
-
-      const text = [
-        poll.agent ? `You: ${shortId(poll.agent.agentId)} (${poll.agent.status})` : 'Project-level overview',
-        poll.watermark.newObservationCount > 0
-          ? `${poll.watermark.newObservationCount} new observation(s)`
-          : 'No unseen observations',
-        poll.inbox.unreadCount > 0 ? `${poll.inbox.unreadCount} unread message(s)` : 'Inbox clear',
-        poll.tasks.myInProgress.length > 0
-          ? `${poll.tasks.myInProgress.length} in-progress task(s)`
-          : 'No in-progress tasks',
-        poll.tasks.availableToClaim.length > 0
-          ? `${poll.tasks.availableToClaim.length} task(s) available to claim`
-          : 'No claimable tasks',
-        `Team: ${poll.team.activeAgents.length} active / ${poll.team.totalAgents} total`,
-      ].join('\n');
-
-      emitResult({ project, poll }, text, asJson);
-    } catch (error) {
-      emitError(error instanceof Error ? error.message : String(error), asJson);
-    }
-  },
-});
+        );
+        watermark = computeWatermark(lastSeen, currentGen, projectObs.length);
+        teamStore.updateWatermark(agentId, currentGen);
+        teamStore.heartbeat(agentId);
+      }
+
+      const poll = computePoll(teamStore, project.id, agentId ?? null, watermark);
+      if (args.markInboxRead && agentId) {
+        teamStore.markAllRead(project.id, agentId);
+      }
+
+      const text = [
+        poll.agent ? `You: ${shortId(poll.agent.agentId)} (${poll.agent.status})` : 'Project-level overview',
+        poll.watermark.newObservationCount > 0
+          ? `${poll.watermark.newObservationCount} new observation(s)`
+          : 'No unseen observations',
+        poll.inbox.unreadCount > 0 ? `${poll.inbox.unreadCount} unread message(s)` : 'Inbox clear',
+        poll.tasks.myInProgress.length > 0
+          ? `${poll.tasks.myInProgress.length} in-progress task(s)`
+          : 'No in-progress tasks',
+        poll.tasks.availableToClaim.length > 0
+          ? `${poll.tasks.availableToClaim.length} task(s) available to claim`
+          : 'No claimable tasks',
+        `Team: ${poll.team.activeAgents.length} active / ${poll.team.totalAgents} total`,
+      ].join('\n');
+
+      emitResult({ project, poll }, text, asJson);
+    } catch (error) {
+      emitError(error instanceof Error ? error.message : String(error), asJson);
+    }
+  },
+});