memorix 1.2.1 → 1.2.2

package/src/cli/commands/serve-http.ts

@@ -24,6 +24,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ObservationStore } from '../../store/obs-store.js';
 import { resolveToolProfile } from '../../server/tool-profile.js';
 import { scopeKnowledgeGraphToProject } from '../../memory/graph-scope.js';
+import { canManageObservation, filterReadableObservations } from '../../memory/visibility.js';
 
 export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 
@@ -558,7 +559,7 @@ export default defineCommand({
 
     async function loadDashboardObservations(dataDir: string) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadAll();
+      return filterReadableObservations(await store.loadAll(), {});
     }
 
     async function loadDashboardProjectObservations(
@@ -567,7 +568,10 @@ export default defineCommand({
       status?: string,
     ) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadByProject(projectId, status ? { status } : undefined);
+      return filterReadableObservations(
+        await store.loadByProject(projectId, status ? { status } : undefined),
+        { projectId },
+      );
     }
 
     // Resolve static directory (dist/dashboard/static)
@@ -1321,6 +1325,8 @@ export default defineCommand({
             sendJson({ error: 'Observation not found' }, 404);
           } else if ((matchObs as any).projectId !== delProjectId) {
             sendJson({ error: `Observation #${obsId} belongs to project "${(matchObs as any).projectId}", not "${delProjectId}"` }, 403);
+          } else if (!canManageObservation(matchObs, { projectId: delProjectId })) {
+            sendJson({ error: `Observation #${obsId} is not manageable from the unbound dashboard.` }, 403);
           } else {
             await store.remove(obsId);
             // Sync: clean up graph entity references

package/src/cli/commands/serve-shared.ts

@@ -1,118 +1,118 @@
-import type { ProjectInfo } from '../../types.js';
-
-export interface ResolveServeProjectOptions {
-  cwdArg?: string;
-  envProjectRoot?: string;
-  initCwd?: string;
-  processCwd: string;
-  homeDir: string;
-  lastKnownProjectRoot?: string;
-}
-
-export interface ResolveServeProjectDeps {
-  detectProject: (cwd: string) => ProjectInfo | null;
-  findGitInSubdirs: (dir: string) => string | null;
-  isSystemDirectory: (dir: string) => boolean;
-}
-
-export interface ServeProjectResolution {
-  projectRoot: string;
-  detectedProject: ProjectInfo | null;
-  source: 'direct' | 'subdir' | 'last-known' | 'home' | 'home-subdir' | 'unresolved';
-  messages: string[];
-  error?: string;
-}
-
-export function resolveServeProject(
-  options: ResolveServeProjectOptions,
-  deps: ResolveServeProjectDeps,
-): ServeProjectResolution {
-  let projectRoot =
-    options.cwdArg ||
-    options.envProjectRoot ||
-    options.initCwd ||
-    options.processCwd;
-
-  const messages: string[] = [`[memorix] Starting with cwd: ${projectRoot}`];
-
-  let detected = deps.detectProject(projectRoot);
-  if (detected) {
-    return {
-      projectRoot,
-      detectedProject: detected,
-      source: 'direct',
-      messages,
-    };
-  }
-
-  const subGit = deps.findGitInSubdirs(projectRoot);
-  if (subGit) {
-    projectRoot = subGit;
-    detected = deps.detectProject(subGit);
-    if (detected) {
-      messages.push(`[memorix] Found .git in subdirectory: ${subGit}`);
-      return {
-        projectRoot,
-        detectedProject: detected,
-        source: 'subdir',
-        messages,
-      };
-    }
-  }
-
-  if (deps.isSystemDirectory(projectRoot)) {
-    messages.push(`[memorix] System directory detected: ${projectRoot}`);
-    messages.push('[memorix] Your IDE launched memorix from a non-workspace directory.');
-    messages.push('[memorix] Fix: add --cwd to your MCP config, or use an IDE/client that exposes workspace roots.');
-
-    if (options.lastKnownProjectRoot) {
-      detected = deps.detectProject(options.lastKnownProjectRoot);
-      if (detected) {
-        messages.push(`[memorix] Restored last known project: ${options.lastKnownProjectRoot}`);
-        return {
-          projectRoot: options.lastKnownProjectRoot,
-          detectedProject: detected,
-          source: 'last-known',
-          messages,
-        };
-      }
-    }
-
-    detected = deps.detectProject(options.homeDir);
-    if (detected) {
-      messages.push(`[memorix] Restored project from home directory: ${options.homeDir}`);
-      return {
-        projectRoot: options.homeDir,
-        detectedProject: detected,
-        source: 'home',
-        messages,
-      };
-    }
-
-    const homeSubGit = deps.findGitInSubdirs(options.homeDir);
-    if (homeSubGit) {
-      detected = deps.detectProject(homeSubGit);
-      if (detected) {
-        messages.push(`[memorix] Found .git in home subdirectory: ${homeSubGit}`);
-        return {
-          projectRoot: homeSubGit,
-          detectedProject: detected,
-          source: 'home-subdir',
-          messages,
-        };
-      }
-    }
-  }
-
-  messages.push('[memorix] Unable to establish a reliable git-backed project context.');
-  messages.push('[memorix] Memorix now refuses to silently fall back to untracked/* in stdio mode.');
-
-  return {
-    projectRoot,
-    detectedProject: null,
-    source: 'unresolved',
-    messages,
-    error:
-      'No git project could be resolved from the current workspace. Open the repo root, pass --cwd, or use an MCP client that sends workspace roots.',
-  };
-}
+import type { ProjectInfo } from '../../types.js';
+
+export interface ResolveServeProjectOptions {
+  cwdArg?: string;
+  envProjectRoot?: string;
+  initCwd?: string;
+  processCwd: string;
+  homeDir: string;
+  lastKnownProjectRoot?: string;
+}
+
+export interface ResolveServeProjectDeps {
+  detectProject: (cwd: string) => ProjectInfo | null;
+  findGitInSubdirs: (dir: string) => string | null;
+  isSystemDirectory: (dir: string) => boolean;
+}
+
+export interface ServeProjectResolution {
+  projectRoot: string;
+  detectedProject: ProjectInfo | null;
+  source: 'direct' | 'subdir' | 'last-known' | 'home' | 'home-subdir' | 'unresolved';
+  messages: string[];
+  error?: string;
+}
+
+export function resolveServeProject(
+  options: ResolveServeProjectOptions,
+  deps: ResolveServeProjectDeps,
+): ServeProjectResolution {
+  let projectRoot =
+    options.cwdArg ||
+    options.envProjectRoot ||
+    options.initCwd ||
+    options.processCwd;
+
+  const messages: string[] = [`[memorix] Starting with cwd: ${projectRoot}`];
+
+  let detected = deps.detectProject(projectRoot);
+  if (detected) {
+    return {
+      projectRoot,
+      detectedProject: detected,
+      source: 'direct',
+      messages,
+    };
+  }
+
+  const subGit = deps.findGitInSubdirs(projectRoot);
+  if (subGit) {
+    projectRoot = subGit;
+    detected = deps.detectProject(subGit);
+    if (detected) {
+      messages.push(`[memorix] Found .git in subdirectory: ${subGit}`);
+      return {
+        projectRoot,
+        detectedProject: detected,
+        source: 'subdir',
+        messages,
+      };
+    }
+  }
+
+  if (deps.isSystemDirectory(projectRoot)) {
+    messages.push(`[memorix] System directory detected: ${projectRoot}`);
+    messages.push('[memorix] Your IDE launched memorix from a non-workspace directory.');
+    messages.push('[memorix] Fix: add --cwd to your MCP config, or use an IDE/client that exposes workspace roots.');
+
+    if (options.lastKnownProjectRoot) {
+      detected = deps.detectProject(options.lastKnownProjectRoot);
+      if (detected) {
+        messages.push(`[memorix] Restored last known project: ${options.lastKnownProjectRoot}`);
+        return {
+          projectRoot: options.lastKnownProjectRoot,
+          detectedProject: detected,
+          source: 'last-known',
+          messages,
+        };
+      }
+    }
+
+    detected = deps.detectProject(options.homeDir);
+    if (detected) {
+      messages.push(`[memorix] Restored project from home directory: ${options.homeDir}`);
+      return {
+        projectRoot: options.homeDir,
+        detectedProject: detected,
+        source: 'home',
+        messages,
+      };
+    }
+
+    const homeSubGit = deps.findGitInSubdirs(options.homeDir);
+    if (homeSubGit) {
+      detected = deps.detectProject(homeSubGit);
+      if (detected) {
+        messages.push(`[memorix] Found .git in home subdirectory: ${homeSubGit}`);
+        return {
+          projectRoot: homeSubGit,
+          detectedProject: detected,
+          source: 'home-subdir',
+          messages,
+        };
+      }
+    }
+  }
+
+  messages.push('[memorix] Unable to establish a reliable git-backed project context.');
+  messages.push('[memorix] Memorix now refuses to silently fall back to untracked/* in stdio mode.');
+
+  return {
+    projectRoot,
+    detectedProject: null,
+    source: 'unresolved',
+    messages,
+    error:
+      'No git project could be resolved from the current workspace. Open the repo root, pass --cwd, or use an MCP client that sends workspace roots.',
+  };
+}

package/src/cli/commands/session.ts

@@ -5,6 +5,8 @@ import { computeWatermark } from '../../team/poll.js';
 import { withFreshIndex } from '../../memory/freshness.js';
 import { getAllObservations } from '../../memory/observations.js';
 import { getObservationStore } from '../../store/obs-store.js';
+import { filterReadableObservations } from '../../memory/visibility.js';
+import { saveCliIdentity } from '../identity.js';
 import { emitError, emitResult, getCliProjectContext, parsePositiveInt } from './operator-shared.js';
 
 export default defineCommand({
@@ -18,6 +20,7 @@ export default defineCommand({
     instanceId: { type: 'string', description: 'Stable instance identity across restarts' },
     projectRoot: { type: 'string', description: 'Absolute project root used to bind the session context' },
     joinTeam: { type: 'boolean', description: 'Explicitly join orchestration coordination state for this session' },
+    use: { type: 'boolean', description: 'Make the joined coordination identity active for later CLI commands' },
     role: { type: 'string', description: 'Explicit role override used only when --joinTeam is set' },
     sessionId: { type: 'string', description: 'Custom session ID (optional)' },
     summary: { type: 'string', description: 'Structured session summary for session end' },
@@ -35,6 +38,14 @@ export default defineCommand({
 
       switch (action) {
         case 'start': {
+          if (args.use && !args.joinTeam) {
+            emitError('use requires --joinTeam when starting a session.', asJson);
+            return;
+          }
+          if (args.use && !args.agent && !args.agentType) {
+            emitError('use requires --agent or --agentType so Memorix can activate a coordination identity.', asJson);
+            return;
+          }
           const result = await startSession(dataDir, project.id, {
             sessionId: args.sessionId as string | undefined,
             agent: args.agent as string | undefined,
@@ -61,6 +72,16 @@ export default defineCommand({
             teamJoinNotice = 'Coordination join skipped: provide --agent or --agentType to create a coordination identity.';
           }
 
+          let identityActivated = false;
+          if (args.use && agentRecord) {
+            await saveCliIdentity(dataDir, {
+              agentId: agentRecord.agent_id,
+              projectId: project.id,
+              activatedAt: new Date().toISOString(),
+            });
+            identityActivated = true;
+          }
+
           let watermark = computeWatermark(0, 0, 0);
           let rescuedAgentIds: string[] = [];
           let availableTasks = 0;
@@ -70,8 +91,11 @@ export default defineCommand({
             const store = getObservationStore();
             const currentGen = store.getGeneration();
             const projectObs = await withFreshIndex(() =>
-              getAllObservations().filter(
-                (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+              filterReadableObservations(
+                getAllObservations().filter(
+                  (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+                ),
+                { projectId: project.id, agentId: agentRecord.agent_id, isTeamMember: agentRecord.status === 'active' },
               ),
             );
             watermark = computeWatermark(lastSeen, currentGen, projectObs.length);
@@ -97,6 +121,7 @@ export default defineCommand({
               joined: !!agentRecord,
               notice: teamJoinNotice,
             },
+            identityActivated,
             watermark,
             rescue: {
               staleAgents: rescuedAgentIds,
@@ -113,6 +138,7 @@ export default defineCommand({
             agentRecord
               ? `Agent: ${agentRecord.name} [${agentRecord.agent_type}] as ${agentRecord.role} (${agentRecord.agent_id})`
               : '',
+            identityActivated ? 'CLI identity activated for follow-up memory and coordination commands.' : '',
             !agentRecord ? 'Coordination identity: not joined (memory/session context only)' : '',
             teamJoinNotice ?? '',
             agentRecord && watermark.newObservationCount > 0
@@ -173,7 +199,7 @@ export default defineCommand({
           console.log('Memorix Session Commands');
           console.log('');
           console.log('Usage:');
-          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam]');
+          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam --use]');
           console.log('  memorix session end --sessionId <id> [--summary "..."]');
           console.log('  memorix session context [--limit 3]');
           console.log('');

package/src/cli/commands/skills.ts

@@ -1,123 +1,128 @@
-import { defineCommand } from 'citty';
+import { defineCommand } from 'citty';
 import type { AgentTarget } from '../../types.js';
 import { getObservationStore } from '../../store/obs-store.js';
-import { emitError, emitResult, getCliProjectContext } from './operator-shared.js';
-
-export default defineCommand({
-  meta: {
-    name: 'skills',
-    description: 'Discover, generate, and inspect project skills from the CLI',
-  },
-  args: {
-    name: { type: 'string', description: 'Skill name for "show"' },
-    target: { type: 'string', description: 'Target agent for generated skills' },
-    write: { type: 'boolean', description: 'Write generated skills to disk' },
-    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
-  },
-  run: async ({ args }) => {
-    const action = (args._ as string[])?.[0] || '';
-    const asJson = !!args.json;
-
-    try {
-      const { project } = await getCliProjectContext();
-      const { SkillsEngine } = await import('../../skills/engine.js');
-      const engine = new SkillsEngine(project.rootPath);
-
-      switch (action) {
-        case 'list': {
-          const skills = engine.listSkills();
-          emitResult(
-            { project, skills },
-            skills.length === 0
-              ? 'No skills found in project or global agent directories.'
-              : skills.map((skill) => `- ${skill.name} (${skill.sourceAgent})`).join('\n'),
-            asJson,
-          );
-          return;
-        }
-
-        case 'generate': {
-          const observations = (await getObservationStore().loadAll())
-            .filter((obs) => obs.projectId === project.id)
+import { filterReadableObservations, resolveObservationVisibility } from '../../memory/visibility.js';
+import { emitError, emitResult, getCliProjectContext } from './operator-shared.js';
+
+export default defineCommand({
+  meta: {
+    name: 'skills',
+    description: 'Discover, generate, and inspect project skills from the CLI',
+  },
+  args: {
+    name: { type: 'string', description: 'Skill name for "show"' },
+    target: { type: 'string', description: 'Target agent for generated skills' },
+    write: { type: 'boolean', description: 'Write generated skills to disk' },
+    json: { type: 'boolean', description: 'Emit machine-readable JSON output' },
+  },
+  run: async ({ args }) => {
+    const action = (args._ as string[])?.[0] || '';
+    const asJson = !!args.json;
+
+    try {
+      const { project, reader } = await getCliProjectContext();
+      const { SkillsEngine } = await import('../../skills/engine.js');
+      const engine = new SkillsEngine(project.rootPath);
+
+      switch (action) {
+        case 'list': {
+          const skills = engine.listSkills();
+          emitResult(
+            { project, skills },
+            skills.length === 0
+              ? 'No skills found in project or global agent directories.'
+              : skills.map((skill) => `- ${skill.name} (${skill.sourceAgent})`).join('\n'),
+            asJson,
+          );
+          return;
+        }
+
+        case 'generate': {
+          const observations = filterReadableObservations(
+            await getObservationStore().loadAll(),
+            reader,
+          ).filter((observation) => resolveObservationVisibility(observation) === 'project')
             .map((obs) => ({
-              id: obs.id,
-              entityName: obs.entityName,
-              type: obs.type,
-              title: obs.title,
-              narrative: obs.narrative,
-              facts: obs.facts,
-              concepts: obs.concepts,
-              filesModified: obs.filesModified,
-              createdAt: obs.createdAt,
-              status: obs.status,
-              source: obs.source,
-            }));
-          const skills = engine.generateFromObservations(observations);
-          const written: string[] = [];
-          if (args.write && args.target) {
-            for (const skill of skills) {
-              const writtenPath = engine.writeSkill(skill, args.target as AgentTarget);
-              if (writtenPath) written.push(writtenPath);
-            }
-          }
-          emitResult(
-            { project, skills, written },
-            skills.length === 0
-              ? 'No skill-worthy patterns found yet.'
-              : skills.map((skill) => `- ${skill.name}: ${skill.description}`).join('\n'),
-            asJson,
-          );
-          return;
-        }
-
-        case 'show': {
-          const name = (args.name as string | undefined)?.trim();
-          if (!name) {
-            emitError('name is required for "memorix skills show"', asJson);
-            return;
-          }
-          const direct = engine.injectSkill(name);
-          if (direct) {
-            emitResult({ project, skill: direct }, direct.content, asJson);
-            return;
-          }
-
-          const observations = (await getObservationStore().loadAll())
-            .filter((obs) => obs.projectId === project.id)
+              id: obs.id,
+              entityName: obs.entityName,
+              type: obs.type,
+              title: obs.title,
+              narrative: obs.narrative,
+              facts: obs.facts,
+              concepts: obs.concepts,
+              filesModified: obs.filesModified,
+              createdAt: obs.createdAt,
+              status: obs.status,
+              source: obs.source,
+            }));
+          const skills = engine.generateFromObservations(observations);
+          const written: string[] = [];
+          if (args.write && args.target) {
+            for (const skill of skills) {
+              const writtenPath = engine.writeSkill(skill, args.target as AgentTarget);
+              if (writtenPath) written.push(writtenPath);
+            }
+          }
+          emitResult(
+            { project, skills, written },
+            skills.length === 0
+              ? 'No skill-worthy patterns found yet.'
+              : skills.map((skill) => `- ${skill.name}: ${skill.description}`).join('\n'),
+            asJson,
+          );
+          return;
+        }
+
+        case 'show': {
+          const name = (args.name as string | undefined)?.trim();
+          if (!name) {
+            emitError('name is required for "memorix skills show"', asJson);
+            return;
+          }
+          const direct = engine.injectSkill(name);
+          if (direct) {
+            emitResult({ project, skill: direct }, direct.content, asJson);
+            return;
+          }
+
+          const observations = filterReadableObservations(
+            await getObservationStore().loadAll(),
+            reader,
+          ).filter((observation) => resolveObservationVisibility(observation) === 'project')
             .map((obs) => ({
-              id: obs.id,
-              entityName: obs.entityName,
-              type: obs.type,
-              title: obs.title,
-              narrative: obs.narrative,
-              facts: obs.facts,
-              concepts: obs.concepts,
-              filesModified: obs.filesModified,
-              createdAt: obs.createdAt,
-              status: obs.status,
-              source: obs.source,
-            }));
-          const generated = engine.generateFromObservations(observations);
-          const skill = generated.find((entry) => entry.name.toLowerCase() === name.toLowerCase());
-          if (!skill) {
-            emitError(`Skill "${name}" not found`, asJson);
-            return;
-          }
-          emitResult({ project, skill }, skill.content, asJson);
-          return;
-        }
-
-        default:
-          console.log('Memorix Skills Commands');
-          console.log('');
-          console.log('Usage:');
-          console.log('  memorix skills list');
-          console.log('  memorix skills generate [--write --target codex]');
-          console.log('  memorix skills show --name <skill>');
-      }
-    } catch (error) {
-      emitError(error instanceof Error ? error.message : String(error), asJson);
-    }
-  },
-});
-
+              id: obs.id,
+              entityName: obs.entityName,
+              type: obs.type,
+              title: obs.title,
+              narrative: obs.narrative,
+              facts: obs.facts,
+              concepts: obs.concepts,
+              filesModified: obs.filesModified,
+              createdAt: obs.createdAt,
+              status: obs.status,
+              source: obs.source,
+            }));
+          const generated = engine.generateFromObservations(observations);
+          const skill = generated.find((entry) => entry.name.toLowerCase() === name.toLowerCase());
+          if (!skill) {
+            emitError(`Skill "${name}" not found`, asJson);
+            return;
+          }
+          emitResult({ project, skill }, skill.content, asJson);
+          return;
+        }
+
+        default:
+          console.log('Memorix Skills Commands');
+          console.log('');
+          console.log('Usage:');
+          console.log('  memorix skills list');
+          console.log('  memorix skills generate [--write --target codex]');
+          console.log('  memorix skills show --name <skill>');
+      }
+    } catch (error) {
+      emitError(error instanceof Error ? error.message : String(error), asJson);
+    }
+  },
+});
+

package/src/cli/commands/status.ts

@@ -39,8 +39,8 @@ export default defineCommand({
       const { initObservationStore, getObservationStore } = await import('../../store/obs-store.js');
       await initObservationStore(dataDir);
       const store = getObservationStore();
-      const data = await store.loadAll() as Array<{ projectId?: string; status?: string }>;
-      const projectObs = data.filter(o => o.projectId === project.id);
+      const { filterReadableObservations } = await import('../../memory/visibility.js');
+      const projectObs = filterReadableObservations(await store.loadAll(), { projectId: project.id });
       obsCount = projectObs.length;
       activeCount = projectObs.filter(o => (o.status ?? 'active') === 'active').length;
     } catch { /* ignore */ }
@@ -165,7 +165,8 @@ export default defineCommand({
       const { initObservationStore, getObservationStore } = await import('../../store/obs-store.js');
       await initObservationStore(dataDir);
       const store = getObservationStore();
-      const allObs = await store.loadAll() as Array<{ source?: string; type?: string }>;
+      const { filterReadableObservations } = await import('../../memory/visibility.js');
+      const allObs = filterReadableObservations(await store.loadAll(), { projectId: project.id });
       const gitCount = allObs.filter(o => o.source === 'git').length;
       const reasoningCount = allObs.filter(o => o.type === 'reasoning').length;
       if (gitCount > 0 || reasoningCount > 0) {