memorix 1.9.3 → 1.9.5

package/dist/cli/index.js

@@ -3232,7 +3232,7 @@ ${import_picocolors.default.gray(m3)}  ${s4}
 
 // src/cli/version.ts
 function getCliVersion() {
-  return true ? "1.9.3" : pkg.version;
+  return true ? "1.9.5" : pkg.version;
 }
 var init_version = __esm({
   "src/cli/version.ts"() {
@@ -9473,6 +9473,14 @@ END;
 });
 
 // src/store/sqlite-db.ts
+var sqlite_db_exports = {};
+__export(sqlite_db_exports, {
+  closeAllDatabases: () => closeAllDatabases,
+  closeDatabase: () => closeDatabase,
+  getDatabase: () => getDatabase,
+  isSqliteAvailable: () => isSqliteAvailable,
+  loadBetterSqlite3: () => loadBetterSqlite3
+});
 import "module";
 import path3 from "path";
 import fs from "fs";
@@ -9589,6 +9597,17 @@ function getDatabase(dataDir) {
     throw error40;
   }
 }
+function closeDatabase(dataDir) {
+  const normalized = path3.resolve(dataDir);
+  const db2 = _dbCache.get(normalized);
+  if (db2) {
+    try {
+      db2.close();
+    } catch {
+    }
+    _dbCache.delete(normalized);
+  }
+}
 function closeAllDatabases() {
   for (const [key, db2] of _dbCache) {
     try {
@@ -9598,6 +9617,14 @@ function closeAllDatabases() {
     _dbCache.delete(key);
   }
 }
+function isSqliteAvailable() {
+  try {
+    loadBetterSqlite3();
+    return true;
+  } catch {
+    return false;
+  }
+}
 var BetterSqlite3, CREATE_OBSERVATIONS_TABLE, CREATE_MINI_SKILLS_TABLE, CREATE_SESSIONS_TABLE, CREATE_META_TABLE, CREATE_TEAM_AGENTS_TABLE, CREATE_TEAM_MESSAGES_TABLE, CREATE_TEAM_TASKS_TABLE, CREATE_TEAM_TASK_DEPS_TABLE, CREATE_TEAM_LOCKS_TABLE, CREATE_TEAM_ROLES_TABLE, CREATE_CHAT_TRANSCRIPT_TABLE, CREATE_GRAPH_ENTITIES_TABLE, CREATE_GRAPH_RELATIONS_TABLE, CREATE_CODE_FILES_TABLE, CREATE_CODE_SYMBOLS_TABLE, CREATE_CODE_EDGES_TABLE, CREATE_OBSERVATION_CODE_REFS_TABLE, CREATE_SCHEMA_MIGRATIONS_TABLE, CREATE_CODE_STATE_SNAPSHOTS_TABLE, CREATE_CODE_STATE_SNAPSHOT_FILES_TABLE, CREATE_KNOWLEDGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_CLAIM_EVIDENCE_TABLE, CREATE_KNOWLEDGE_CLAIM_EVENTS_TABLE, CREATE_KNOWLEDGE_WORKSPACES_TABLE, CREATE_KNOWLEDGE_PAGES_TABLE, CREATE_KNOWLEDGE_PAGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_PAGE_LINKS_TABLE, CREATE_KNOWLEDGE_PROPOSALS_TABLE, CREATE_KNOWLEDGE_WORKFLOWS_TABLE, CREATE_KNOWLEDGE_WORKFLOW_RUNS_TABLE, CREATE_LONG_TERM_MEMORIES_TABLE, CREATE_LONG_TERM_MEMORY_EVIDENCE_TABLE, CREATE_LONG_TERM_MEMORY_EVENTS_TABLE, CREATE_MEMORY_OUTCOME_SIGNALS_TABLE, CREATE_MEDIA_ASSETS_TABLE, CREATE_MEDIA_ASSET_LINKS_TABLE, CREATE_MEDIA_DERIVATIONS_TABLE, CREATE_MEDIA_EMBEDDING_PROFILES_TABLE, CREATE_MEDIA_EMBEDDINGS_TABLE, CREATE_MEDIA_JOBS_TABLE, CREATE_MAINTENANCE_JOBS_TABLE, CREATE_MAINTENANCE_TARGETS_TABLE, CREATE_COMPACTION_CHECKPOINTS_TABLE, CREATE_EVIDENCE_CARDS_TABLE, CREATE_EVIDENCE_CARD_EVENTS_TABLE, CREATE_MEMORY_FEEDBACK_STATES_TABLE, CREATE_MEMORY_FEEDBACK_EVENTS_TABLE, CREATE_MCP_BINDINGS_TABLE, CREATE_INDEXES, SCHEMA_MIGRATIONS, _dbCache;
 var init_sqlite_db = __esm({
   "src/store/sqlite-db.ts"() {
@@ -9770,18 +9797,21 @@ CREATE TABLE IF NOT EXISTS chat_transcript (
 `;
     CREATE_GRAPH_ENTITIES_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_entities (
-  name            TEXT PRIMARY KEY,
+  projectId       TEXT NOT NULL,
+  name            TEXT NOT NULL,
   entityType      TEXT NOT NULL DEFAULT '',
-  observations    TEXT NOT NULL DEFAULT '[]'
+  observations    TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (projectId, name)
 );
 `;
     CREATE_GRAPH_RELATIONS_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_relations (
   id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  projectId       TEXT NOT NULL,
   from_entity     TEXT NOT NULL,
   to_entity       TEXT NOT NULL,
   relationType    TEXT NOT NULL DEFAULT '',
-  UNIQUE(from_entity, to_entity, relationType)
+  UNIQUE(projectId, from_entity, to_entity, relationType)
 );
 `;
     CREATE_CODE_FILES_TABLE = `
@@ -10649,6 +10679,21 @@ var init_sqlite_reliability = __esm({
 import { promises as fs2 } from "fs";
 import { randomUUID } from "crypto";
 import path4 from "path";
+function canReclaimStaleLock(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const pid = Number(parsed.pid);
+    if (!Number.isSafeInteger(pid) || pid < 1) return true;
+    try {
+      process.kill(pid, 0);
+      return false;
+    } catch (error40) {
+      return error40.code !== "EPERM";
+    }
+  } catch {
+    return true;
+  }
+}
 async function acquireLock(lockPath) {
   for (let i4 = 0; i4 < MAX_RETRIES; i4++) {
     try {
@@ -10662,9 +10707,12 @@ async function acquireLock(lockPath) {
         try {
           const stat6 = await fs2.stat(lockPath);
           if (Date.now() - stat6.mtimeMs > LOCK_STALE_MS) {
-            await fs2.unlink(lockPath).catch(() => {
-            });
-            continue;
+            const raw2 = await fs2.readFile(lockPath, "utf8").catch(() => "");
+            if (canReclaimStaleLock(raw2)) {
+              await fs2.unlink(lockPath).catch(() => {
+              });
+              continue;
+            }
           }
         } catch {
           continue;
@@ -10675,6 +10723,10 @@ async function acquireLock(lockPath) {
       }
     }
   }
+  const raw = await fs2.readFile(lockPath, "utf8").catch(() => "");
+  if (!canReclaimStaleLock(raw)) {
+    throw new Error(`Failed to acquire lock: ${lockPath} (owner is still running)`);
+  }
   await fs2.unlink(lockPath).catch(() => {
   });
   try {
@@ -10913,6 +10965,11 @@ async function listProjectDirs(baseDir) {
   }
 }
 async function migrateSubdirsToFlat(baseDir) {
+  const base = baseDir ?? resolveDefaultDataDir();
+  await fs4.mkdir(base, { recursive: true });
+  return withFileLock(base, () => migrateSubdirsToFlatUnlocked(base));
+}
+async function migrateSubdirsToFlatUnlocked(baseDir) {
   const base = baseDir ?? resolveDefaultDataDir();
   await fs4.mkdir(base, { recursive: true });
   let entries;
@@ -10969,7 +11026,7 @@ async function migrateSubdirsToFlat(baseDir) {
   for (const { obs } of subdirData) {
     for (const o4 of obs) {
       const isDuplicate = allObs.some(
-        (existing) => existing.title === o4.title && existing.createdAt === o4.createdAt
+        (existing) => existing.title === o4.title && existing.createdAt === o4.createdAt && existing.projectId === o4.projectId
       );
       if (!isDuplicate) {
         allObs.push(o4);
@@ -11002,18 +11059,14 @@ async function migrateSubdirsToFlat(baseDir) {
       mergedRelations.push(rel);
     }
   }
-  await fs4.writeFile(path6.join(base, "observations.json"), JSON.stringify(allObs, null, 2), "utf-8");
-  await fs4.writeFile(
-    path6.join(base, "counter.json"),
-    JSON.stringify({ nextId: allObs.length + 1 }),
-    "utf-8"
-  );
+  await atomicWriteFile(path6.join(base, "observations.json"), JSON.stringify(allObs, null, 2));
+  await atomicWriteFile(path6.join(base, "counter.json"), JSON.stringify({ nextId: allObs.length + 1 }));
   const graphLines = [
     ...[...entityMap.values()].map((e5) => JSON.stringify({ type: "entity", name: e5.name, entityType: e5.entityType, observations: e5.observations })),
     ...mergedRelations.map((r6) => JSON.stringify({ type: "relation", from: r6.from, to: r6.to, relationType: r6.relationType }))
   ];
   if (graphLines.length > 0) {
-    await fs4.writeFile(path6.join(base, "graph.jsonl"), graphLines.join("\n"), "utf-8");
+    await atomicWriteFile(path6.join(base, "graph.jsonl"), graphLines.join("\n"));
   }
   let allSessions = [];
   try {
@@ -11031,7 +11084,7 @@ async function migrateSubdirsToFlat(baseDir) {
     }
   }
   if (allSessions.length > 0) {
-    await fs4.writeFile(path6.join(base, "sessions.json"), JSON.stringify(allSessions, null, 2), "utf-8");
+    await atomicWriteFile(path6.join(base, "sessions.json"), JSON.stringify(allSessions, null, 2));
   }
   const backupDir = path6.join(base, ".migrated-subdirs");
   await fs4.mkdir(backupDir, { recursive: true });
@@ -11067,6 +11120,7 @@ var init_persistence = __esm({
   "src/store/persistence.ts"() {
     "use strict";
     init_esm_shims();
+    init_file_lock();
     init_persistence_json();
   }
 });
@@ -25338,6 +25392,7 @@ var init_sqlite_store = __esm({
     init_sqlite_db();
     init_sqlite_reliability();
     init_sqlite_fts();
+    init_file_lock();
     SqliteBackend = class {
       db = null;
       dataDir = "";
@@ -25501,38 +25556,43 @@ var init_sqlite_store = __esm({
       }
       // ── Migration ────────────────────────────────────────────────────
       async migrateFromJsonIfNeeded() {
-        const count3 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
-        if (count3.cnt > 0) return;
         const jsonPath = path9.join(this.dataDir, "observations.json");
         if (!fs6.existsSync(jsonPath)) return;
-        try {
+        await withFileLock(this.dataDir, async () => {
+          const count3 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
+          if (count3.cnt > 0) return;
           const raw = fs6.readFileSync(jsonPath, "utf-8");
-          const observations2 = JSON.parse(raw);
+          const parsed = JSON.parse(raw);
+          if (!Array.isArray(parsed)) {
+            throw new Error("[memorix] observations.json migration refused: expected a JSON array");
+          }
+          const observations2 = parsed;
           if (observations2.length === 0) return;
+          if (observations2.some((obs) => !obs || !Number.isSafeInteger(obs.id) || obs.id < 1 || typeof obs.projectId !== "string")) {
+            throw new Error("[memorix] observations.json migration refused: invalid observation record");
+          }
           console.error(`[memorix] Migrating ${observations2.length} observations from JSON to SQLite...`);
           const insertMany = this.db.transaction((obsList) => {
             for (const obs of obsList) {
               this.stmtInsert.run(obsToRow(obs));
             }
-          });
-          insertMany(observations2);
-          const counterPath = path9.join(this.dataDir, "counter.json");
-          if (fs6.existsSync(counterPath)) {
-            try {
+            const counterPath = path9.join(this.dataDir, "counter.json");
+            let counterNextId;
+            if (fs6.existsSync(counterPath)) {
               const counterData = JSON.parse(fs6.readFileSync(counterPath, "utf-8"));
-              const nextId2 = counterData.nextId ?? counterData.next_id ?? Math.max(...observations2.map((o4) => o4.id)) + 1;
-              this.rawSaveIdCounter(nextId2);
-            } catch {
-              this.rawSaveIdCounter(Math.max(...observations2.map((o4) => o4.id)) + 1);
+              const candidate2 = counterData.nextId ?? counterData.next_id;
+              if (candidate2 !== void 0 && (!Number.isSafeInteger(candidate2) || Number(candidate2) < 1)) {
+                throw new Error("[memorix] counter.json migration refused: nextId must be a positive integer");
+              }
+              counterNextId = candidate2 === void 0 ? void 0 : Number(candidate2);
             }
-          } else {
-            this.rawSaveIdCounter(Math.max(...observations2.map((o4) => o4.id)) + 1);
-          }
-          this.bumpGeneration();
+            const maxId = Math.max(...obsList.map((obs) => obs.id));
+            this.rawSaveIdCounter(Math.max(counterNextId ?? 1, maxId + 1));
+            this.bumpGeneration();
+          });
+          insertMany(observations2);
           console.error(`[memorix] Migration complete. ${observations2.length} observations now in SQLite.`);
-        } catch (err) {
-          console.error(`[memorix] JSON\u2192SQLite migration failed (non-fatal, data preserved in JSON): ${err}`);
-        }
+        });
       }
       // ── Public read ──────────────────────────────────────────────────
       async loadAll() {
@@ -86686,12 +86746,12 @@ var require_jwa = __commonJS({
       };
     }
     var bufferEqual;
-    var timingSafeEqual2 = "timingSafeEqual" in crypto2 ? function timingSafeEqual3(a4, b4) {
+    var timingSafeEqual3 = "timingSafeEqual" in crypto2 ? function timingSafeEqual4(a4, b4) {
       if (a4.byteLength !== b4.byteLength) {
         return false;
       }
       return crypto2.timingSafeEqual(a4, b4);
-    } : function timingSafeEqual3(a4, b4) {
+    } : function timingSafeEqual4(a4, b4) {
       if (!bufferEqual) {
         bufferEqual = require_buffer_equal_constant_time();
       }
@@ -86700,7 +86760,7 @@ var require_jwa = __commonJS({
     function createHmacVerifier(bits) {
       return function verify2(thing, signature, secret) {
         var computedSig = createHmacSigner(bits)(thing, secret);
-        return timingSafeEqual2(Buffer5.from(signature), Buffer5.from(computedSig));
+        return timingSafeEqual3(Buffer5.from(signature), Buffer5.from(computedSig));
       };
     }
     function createKeySigner(bits) {
@@ -177667,7 +177727,20 @@ function normalizeMiniMaxVideoRequest(input) {
   if (ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1") {
     throw new Error("MiniMax video ratio must be adaptive, 16:9, 9:16, or 1:1");
   }
-  return { region, model, prompt: prompt2, resolution, duration: duration3, ratio };
+  let firstFrameImageUrl;
+  if (input.firstFrameImageUrl !== void 0) {
+    firstFrameImageUrl = input.firstFrameImageUrl.trim();
+    let parsed;
+    try {
+      parsed = new URL(firstFrameImageUrl);
+    } catch {
+      throw new Error("MiniMax first-frame image must be a public HTTPS URL");
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || sanitizeCredentials(firstFrameImageUrl) !== firstFrameImageUrl) {
+      throw new Error("MiniMax first-frame image must be an HTTPS URL without credentials");
+    }
+  }
+  return { region, model, prompt: prompt2, resolution, duration: duration3, ratio, ...firstFrameImageUrl ? { firstFrameImageUrl } : {} };
 }
 function videoRequestConfig(input) {
   const normalized = normalizeMiniMaxVideoRequest(input);
@@ -177744,7 +177817,14 @@ async function createMiniMaxVideoTask(input, dependencies = {}) {
       headers: videoHeaders(config2.apiKey),
       body: JSON.stringify({
         model: config2.model,
-        content: [{ type: "text", text: config2.prompt }],
+        content: [
+          { type: "text", text: config2.prompt },
+          ...config2.firstFrameImageUrl ? [{
+            type: "image_url",
+            image_url: { url: config2.firstFrameImageUrl },
+            role: "first_frame"
+          }] : []
+        ],
         resolution: config2.resolution,
         duration: config2.duration,
         ratio: config2.ratio
@@ -177992,10 +178072,19 @@ function parseStoredRequest(value) {
   const duration3 = value.duration;
   const ratio = value.ratio;
   const maxBytes = value.maxBytes;
-  if (provider2 !== "minimax" && provider2 !== "minimax-cn" || region !== "global" && region !== "cn" || model !== "MiniMax-H3" || typeof prompt2 !== "string" || resolution !== "2K" || duration3 !== 5 && duration3 !== 10 || ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1" || typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+  if (provider2 !== "minimax" && provider2 !== "minimax-cn" || region !== "global" && region !== "cn" || model !== "MiniMax-H3" || typeof prompt2 !== "string" || value.firstFrameImageUrl !== void 0 && typeof value.firstFrameImageUrl !== "string" || resolution !== "2K" || duration3 !== 5 && duration3 !== 10 || ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1" || typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1) {
     throw new Error("Media video job has an invalid request payload");
   }
-  return { provider: provider2, region, model, prompt: prompt2, resolution, duration: duration3, ratio, maxBytes };
+  const normalized = normalizeMiniMaxVideoRequest({
+    region,
+    model,
+    prompt: prompt2,
+    resolution,
+    duration: duration3,
+    ratio,
+    firstFrameImageUrl: value.firstFrameImageUrl
+  });
+  return { provider: provider2, ...normalized, maxBytes };
 }
 function mediaJobIdFromMaintenance(job) {
   const mediaJobId = job.payload.mediaJobId;
@@ -178007,6 +178096,7 @@ function mediaJobIdFromMaintenance(job) {
 function toVideoRequest(request) {
   return {
     prompt: request.prompt,
+    firstFrameImageUrl: request.firstFrameImageUrl,
     model: request.model,
     region: request.region,
     resolution: request.resolution,
@@ -178098,6 +178188,7 @@ function queueMiniMaxVideoGeneration(input) {
     region: normalized.region,
     model: normalized.model,
     prompt: normalized.prompt,
+    ...normalized.firstFrameImageUrl ? { firstFrameImageUrl: normalized.firstFrameImageUrl } : {},
     resolution: normalized.resolution,
     duration: normalized.duration,
     ratio: normalized.ratio,
@@ -194246,6 +194337,32 @@ var init_codebuddy = __esm({
   }
 });
 
+// src/workspace/mcp-adapters/grok.ts
+import { homedir as homedir25 } from "os";
+import { join as join22 } from "path";
+var GrokMCPAdapter;
+var init_grok = __esm({
+  "src/workspace/mcp-adapters/grok.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_codex();
+    GrokMCPAdapter = class {
+      source = "grok";
+      toml = new CodexMCPAdapter();
+      parse(content) {
+        return this.toml.parse(content);
+      }
+      generate(servers) {
+        return this.toml.generate(servers);
+      }
+      getConfigPath(_projectRoot) {
+        const grokHome = process.env.GROK_HOME?.trim() || join22(homedir25(), ".grok");
+        return join22(grokHome, "config.toml");
+      }
+    };
+  }
+});
+
 // src/integrations/registry.ts
 function getSetupIntegrationRows() {
   return MEMORIX_INTEGRATIONS.filter((item) => item.status === "ready" && item.agent !== "memcode" && item.agent !== "any-mcp").map((item) => ({
@@ -194303,7 +194420,7 @@ var init_registry2 = __esm({
         status: "ready",
         install: "memorix setup --agent grok --global",
         surfaces: ["hooks", "AGENTS.md"],
-        note: "Writes ~/.grok/hooks/memorix.json and leaves Grok MCP host-owned; setup does not write config.toml."
+        note: "Writes ~/.grok/hooks/memorix.json and leaves Grok MCP host-owned by default. Pass --mcp http to write [mcp_servers.memorix] in Grok config.toml."
       },
       {
         agent: "cursor",
@@ -194708,9 +194825,9 @@ __export(audit_exports, {
 });
 import * as fs18 from "fs/promises";
 import * as path30 from "path";
-import { homedir as homedir25 } from "os";
+import { homedir as homedir26 } from "os";
 function getAuditFilePath() {
-  return process.env.MEMORIX_AUDIT_FILE || path30.join(homedir25(), ".memorix", "audit.json");
+  return process.env.MEMORIX_AUDIT_FILE || path30.join(homedir26(), ".memorix", "audit.json");
 }
 async function loadAudit() {
   try {
@@ -196164,6 +196281,7 @@ var init_installers = __esm({
 // src/cli/commands/setup.ts
 var setup_exports = {};
 __export(setup_exports, {
+  MEMORIX_HTTP_MCP_URL: () => MEMORIX_HTTP_MCP_URL,
   buildMemorixServer: () => buildMemorixServer,
   buildSetupPlan: () => buildSetupPlan,
   default: () => setup_default,
@@ -196183,19 +196301,20 @@ __export(setup_exports, {
   migrateLegacyCodexIntegration: () => migrateLegacyCodexIntegration,
   parseCodexPluginState: () => parseCodexPluginState,
   removeLegacyCodexMemorixMcpConfig: () => removeLegacyCodexMemorixMcpConfig,
+  rewriteBundledMemorixMcpToHttp: () => rewriteBundledMemorixMcpToHttp,
   tryInstallCodexPlugin: () => tryInstallCodexPlugin
 });
 import { spawnSync } from "child_process";
 import { existsSync as existsSync17 } from "fs";
 import { copyFile as copyFile2, mkdir as mkdir6, readFile as readFile6, readdir as readdir3, rm as rm2, writeFile as writeFile7 } from "fs/promises";
-import { homedir as homedir27 } from "os";
+import { homedir as homedir28 } from "os";
 import path32 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function getSetupAgentTargets() {
   return [...SUPPORTED_SETUP_AGENTS];
 }
 function buildSetupPlan(options) {
-  const mcp = options.agent === "grok" ? "none" : options.mcp ?? "stdio";
+  const mcp = options.agent === "grok" ? options.mcp === "http" ? "http" : "none" : options.mcp ?? "stdio";
   const actions = [];
   const isPackageOwnedAgent = options.agent !== "all" && PACKAGE_OWNED_INTEGRATION_AGENTS.has(options.agent);
   const includeHooks = options.hooks ?? true;
@@ -196351,7 +196470,8 @@ function getMcpAdapter(agent) {
     opencode: new OpenCodeMCPAdapter(),
     trae: new TraeMCPAdapter(),
     dsh: new DshMCPAdapter(),
-    workbuddy: new WorkbuddyMCPAdapter()
+    workbuddy: new WorkbuddyMCPAdapter(),
+    grok: new GrokMCPAdapter()
   };
   return adapters[agent];
 }
@@ -196361,7 +196481,7 @@ function buildMemorixServer(mcp) {
       name: "memorix",
       command: "",
       args: [],
-      url: "http://localhost:3211/mcp"
+      url: MEMORIX_HTTP_MCP_URL
     };
   }
   return {
@@ -196372,6 +196492,36 @@ function buildMemorixServer(mcp) {
     args: ["serve", "--mode", "lite"]
   };
 }
+function toHttpMemorixServer(existing) {
+  const next = { url: MEMORIX_HTTP_MCP_URL };
+  if (existing.alwaysLoad === true) next.alwaysLoad = true;
+  if (typeof existing.type === "string") next.type = "http";
+  return next;
+}
+async function rewriteBundledMemorixMcpToHttp(root) {
+  const candidates = [".mcp.json", "mcp_config.json", "gemini-extension.json"].map((name) => path32.join(root, name));
+  const rewritten = [];
+  for (const filePath of candidates) {
+    if (!existsSync17(filePath)) continue;
+    let doc;
+    try {
+      doc = JSON.parse(await readFile6(filePath, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (!doc || typeof doc !== "object" || Array.isArray(doc)) continue;
+    const record2 = doc;
+    const servers = record2.mcpServers;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers)) continue;
+    const serverMap = servers;
+    const existing = serverMap.memorix;
+    if (!existing || typeof existing !== "object" || Array.isArray(existing)) continue;
+    serverMap.memorix = toHttpMemorixServer(existing);
+    await writeFile7(filePath, JSON.stringify(record2, null, 2) + "\n", "utf-8");
+    rewritten.push(filePath);
+  }
+  return rewritten;
+}
 function mergeJsonMcpConfig(existingContent, generatedContent) {
   let generated;
   try {
@@ -196473,7 +196623,7 @@ function isOwnedLegacyCodexMcp(content) {
   const server = new CodexMCPAdapter().parse(content).find((entry) => entry.name === "memorix");
   return Boolean(server && isLegacyCodexMemorixNodeServer(server));
 }
-async function removeLegacyCodexMemorixMcpConfig(configPath = path32.join(homedir27(), ".codex", "config.toml")) {
+async function removeLegacyCodexMemorixMcpConfig(configPath = path32.join(homedir28(), ".codex", "config.toml")) {
   let existingContent;
   try {
     existingContent = await readFile6(configPath, "utf-8");
@@ -196530,7 +196680,7 @@ async function removeOwnedLegacyCodexPluginFolder(homeDir) {
   }
 }
 async function migrateLegacyCodexIntegration(options = {}) {
-  const homeDir = options.homeDir ?? homedir27();
+  const homeDir = options.homeDir ?? homedir28();
   const projectRoot = options.projectRoot ?? process.cwd();
   const configPath = path32.join(homeDir, ".codex", "config.toml");
   let mcp = "missing";
@@ -196640,7 +196790,7 @@ async function installMcpConfig(options) {
     existingContent = null;
   }
   const generated = adapter.generate([server]);
-  const content = options.agent === "codex" ? mergeTomlMcpConfig(existingContent, generated) : options.agent === "hermes" ? mergeYamlMcpConfig(existingContent, generated) : options.agent === "dsh" ? mergeDshPatchConfig(existingContent, generated) : mergeJsonMcpConfig(existingContent, generated);
+  const content = options.agent === "codex" || options.agent === "grok" ? mergeTomlMcpConfig(existingContent, generated) : options.agent === "hermes" ? mergeYamlMcpConfig(existingContent, generated) : options.agent === "dsh" ? mergeDshPatchConfig(existingContent, generated) : mergeJsonMcpConfig(existingContent, generated);
   await mkdir6(path32.dirname(configPath), { recursive: true });
   await writeFile7(configPath, content, "utf-8");
   return { agent: options.agent, configPath, transport: options.mcp };
@@ -196731,7 +196881,7 @@ async function stripCodeBuddyHookCapture(pluginPath) {
   await writeFile7(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf-8");
 }
 async function installCodeBuddyPluginPackage(options = {}) {
-  const home = options.homeDir ?? homedir27();
+  const home = options.homeDir ?? homedir28();
   const packageRoot = findPackageRoot();
   const source = path32.join(packageRoot, "plugins", "codebuddy", "memorix");
   if (!existsSync17(source)) throw new Error(`CodeBuddy plugin template not found: ${source}`);
@@ -196751,7 +196901,7 @@ async function installCodeBuddyPluginPackage(options = {}) {
   };
 }
 async function installPluginPackage(options) {
-  const home = options.homeDir ?? homedir27();
+  const home = options.homeDir ?? homedir28();
   const packageRoot = findPackageRoot();
   const source = path32.join(packageRoot, "plugins", options.agent, "memorix");
   const includeHooks = options.includeHooks ?? true;
@@ -196800,7 +196950,7 @@ async function installPluginPackage(options) {
   };
 }
 async function installGeminiExtensionPackage(options = {}) {
-  const home = options.homeDir ?? homedir27();
+  const home = options.homeDir ?? homedir28();
   const packageRoot = findPackageRoot();
   const source = path32.join(packageRoot, "plugins", "gemini", "memorix");
   if (!existsSync17(source)) {
@@ -196820,7 +196970,7 @@ async function installAntigravityPluginPackage(options = {}) {
   if (!existsSync17(source)) {
     throw new Error(`Antigravity plugin template not found: ${source}`);
   }
-  const pluginPath = options.global === false ? path32.join(options.projectRoot ?? process.cwd(), ".agents", "plugins", "memorix") : path32.join(options.homeDir ?? homedir27(), ".gemini", "config", "plugins", "memorix");
+  const pluginPath = options.global === false ? path32.join(options.projectRoot ?? process.cwd(), ".agents", "plugins", "memorix") : path32.join(options.homeDir ?? homedir28(), ".gemini", "config", "plugins", "memorix");
   await copyDir(source, pluginPath);
   if (options.includeHooks === false) {
     await rm2(path32.join(pluginPath, "hooks.json"), { force: true });
@@ -196838,7 +196988,7 @@ async function installPiPackage(options = {}) {
   if (!existsSync17(source)) {
     throw new Error(`Pi package template not found: ${source}`);
   }
-  const defaultRoot = options.global ? path32.join(options.homeDir ?? homedir27(), ".pi", "agent", "packages") : path32.join(process.cwd(), ".pi", "packages");
+  const defaultRoot = options.global ? path32.join(options.homeDir ?? homedir28(), ".pi", "agent", "packages") : path32.join(process.cwd(), ".pi", "packages");
   const packagePath = options.packageDir ?? path32.join(defaultRoot, "memorix");
   await copyDir(source, packagePath);
   await writeOfficialSkills(path32.join(packagePath, "skills"));
@@ -196850,7 +197000,7 @@ async function installPiPackage(options = {}) {
   };
 }
 async function installOpenClawBundlePackage(options = {}) {
-  const home = options.homeDir ?? homedir27();
+  const home = options.homeDir ?? homedir28();
   const packageRoot = findPackageRoot();
   const source = path32.join(packageRoot, "plugins", "openclaw", "memorix");
   if (!existsSync17(source)) {
@@ -196899,7 +197049,7 @@ async function installOmpPackage(options = {}) {
   if (!existsSync17(source)) {
     throw new Error(`Oh-my-Pi package template not found: ${source}`);
   }
-  const defaultRoot = options.global ? path32.join(options.homeDir ?? homedir27(), ".omp", "agent", "packages") : path32.join(process.cwd(), ".omp", "packages");
+  const defaultRoot = options.global ? path32.join(options.homeDir ?? homedir28(), ".omp", "agent", "packages") : path32.join(process.cwd(), ".omp", "packages");
   const packagePath = options.packageDir ?? path32.join(defaultRoot, "memorix");
   await copyDir(source, packagePath);
   await writeOfficialSkills(path32.join(packagePath, "skills"));
@@ -197173,7 +197323,7 @@ ${result.stdout || ""}`.toLowerCase();
 }
 async function installAgentSetup(agent, plan, global2) {
   const { installAgentGuidance: installAgentGuidance2, installHooks: installHooks2 } = await Promise.resolve().then(() => (init_installers(), installers_exports));
-  const targetRoot = global2 ? homedir27() : process.cwd();
+  const targetRoot = global2 ? homedir28() : process.cwd();
   const hasPluginPackage = plan.actions.includes("plugin-package") && PLUGIN_PACKAGE_AGENTS.has(agent);
   const hasExtensionPackage = plan.actions.includes("extension-package") && agent === "gemini-cli";
   const hasPiPackage = plan.actions.includes("pi-package") && agent === "pi";
@@ -197182,7 +197332,8 @@ async function installAgentSetup(agent, plan, global2) {
   const hasHermesPlugin = plan.actions.includes("hermes-plugin") && agent === "hermes";
   const hasOmpPackage = plan.actions.includes("omp-package") && agent === "omp";
   const hasCodeBuddyPlugin = plan.actions.includes("codebuddy-plugin") && agent === "codebuddy";
-  const wantsMcpConfig = plan.mcp !== "none" && agent !== "pi" && agent !== "grok" && !(agent === "codex" && !global2);
+  const wantsMcpConfig = plan.mcp !== "none" && agent !== "pi" && !(agent === "codex" && !global2) && !(agent === "grok" && plan.mcp !== "http");
+  const bundledMcpRoots = [];
   if (PLUGIN_PACKAGE_AGENTS.has(agent) && plan.includePlugin && !global2) {
     v3.info(`${agent}: project setup leaves user-level plugins untouched. Run \`memorix setup --agent ${agent} --global\` to install its plugin, skills, and lifecycle hooks.`);
   }
@@ -197191,6 +197342,7 @@ async function installAgentSetup(agent, plan, global2) {
       agent,
       includeHooks: plan.includeHooks
     });
+    bundledMcpRoots.push(result.pluginPath);
     v3.success(`${agent}: plugin package -> ${result.pluginPath}`);
     if (result.marketplacePath) {
       v3.info(`${agent}: marketplace -> ${result.marketplacePath}`);
@@ -197221,6 +197373,7 @@ async function installAgentSetup(agent, plan, global2) {
   }
   if (hasCodeBuddyPlugin) {
     const result = await installCodeBuddyPluginPackage({ includeHooks: plan.includeHooks });
+    bundledMcpRoots.push(result.pluginPath);
     v3.success(`${agent}: plugin -> ${result.pluginPath}`);
     v3.info(`${agent}: marketplace -> ${result.marketplacePath}`);
     const install = tryInstallCodeBuddyPlugin(result.marketplaceRoot);
@@ -197231,6 +197384,7 @@ async function installAgentSetup(agent, plan, global2) {
   }
   if (hasExtensionPackage) {
     const result = await installGeminiExtensionPackage();
+    bundledMcpRoots.push(result.extensionPath);
     v3.success(`${agent}: extension package -> ${result.extensionPath}`);
     v3.info(result.installHint);
   }
@@ -197244,6 +197398,7 @@ async function installAgentSetup(agent, plan, global2) {
   }
   if (hasOpenClawBundle) {
     const result = await installOpenClawBundlePackage({ includeHooks: plan.includeHooks });
+    bundledMcpRoots.push(result.bundlePath);
     v3.success(`${agent}: compatible bundle -> ${result.bundlePath}`);
     if (plan.includeHooks) {
       const install = tryInstallOpenClawBundle(result.bundlePath);
@@ -197256,6 +197411,7 @@ async function installAgentSetup(agent, plan, global2) {
   }
   if (hasAntigravityPlugin) {
     const result = await installAntigravityPluginPackage({ global: global2, projectRoot: targetRoot, includeHooks: plan.includeHooks });
+    bundledMcpRoots.push(result.pluginPath);
     v3.success(`${agent}: plugin -> ${result.pluginPath}`);
     if (!plan.includeHooks) {
       v3.info(`${agent}: hooks.json skipped because --noHooks was selected`);
@@ -197286,9 +197442,17 @@ async function installAgentSetup(agent, plan, global2) {
     v3.info(result.installHint);
   }
   if (wantsMcpConfig) {
-    if ((hasPluginPackage || hasCodeBuddyPlugin || hasExtensionPackage || hasOpenClawBundle || hasAntigravityPlugin) && plan.mcp === "stdio") {
+    const mcpOwnedByPackage = hasPluginPackage || hasCodeBuddyPlugin || hasExtensionPackage || hasOpenClawBundle || hasAntigravityPlugin;
+    if (mcpOwnedByPackage && plan.mcp === "stdio") {
       const packageLabel = hasExtensionPackage ? "extension package" : hasCodeBuddyPlugin ? "CodeBuddy plugin" : hasOpenClawBundle ? "OpenClaw bundle" : hasAntigravityPlugin ? "Antigravity plugin" : "plugin package";
       v3.info(`${agent}: stdio MCP is bundled in the ${packageLabel}`);
+    } else if (mcpOwnedByPackage && plan.mcp === "http") {
+      for (const root of bundledMcpRoots) {
+        const rewritten = await rewriteBundledMemorixMcpToHttp(root);
+        for (const filePath of rewritten) {
+          v3.success(`${agent}: plugin MCP -> HTTP ${filePath}`);
+        }
+      }
     } else {
       const mcp = plan.mcp === "http" ? "http" : "stdio";
       const result = await installMcpConfig({ agent, projectRoot: targetRoot, global: global2, mcp });
@@ -197342,7 +197506,11 @@ async function installAgentSetup(agent, plan, global2) {
   if (agent === "pi") {
     v3.info("pi: Pi has no MCP config lane in the current CLI; use the installed package extension and skill.");
   } else if (agent === "grok") {
-    v3.info("grok: lifecycle hooks write ~/.grok/hooks/memorix.json. MCP stays host-owned (do not write config.toml).");
+    if (plan.mcp === "http") {
+      v3.info("grok: wrote [mcp_servers.memorix] HTTP URL in Grok config.toml. Start the control plane with `memorix background start`.");
+    } else {
+      v3.info("grok: lifecycle hooks write ~/.grok/hooks/memorix.json. MCP stays host-owned unless you pass `--mcp http`.");
+    }
     if (!global2) v3.info("grok: project hooks require `/hooks-trust` or launching Grok with `--trust`.");
   } else if (plan.mcp === "stdio") {
     v3.info(`${agent}: MCP server command is \`memorix serve\``);
@@ -197369,7 +197537,7 @@ function printSetupIntegrationRows() {
   ].join("\n");
   ye2(table, "Memorix integrations");
 }
-var import_yaml5, PLUGIN_PACKAGE_AGENTS, EXTENSION_PACKAGE_AGENTS, PI_PACKAGE_AGENTS, OPENCLAW_BUNDLE_AGENTS, ANTIGRAVITY_PLUGIN_AGENTS, HERMES_PLUGIN_AGENTS, OMP_PACKAGE_AGENTS, CODEBUDDY_PLUGIN_AGENTS, PACKAGE_OWNED_INTEGRATION_AGENTS, SUPPORTED_SETUP_AGENTS, getSetupIntegrationRows2, setup_default;
+var import_yaml5, PLUGIN_PACKAGE_AGENTS, EXTENSION_PACKAGE_AGENTS, PI_PACKAGE_AGENTS, OPENCLAW_BUNDLE_AGENTS, ANTIGRAVITY_PLUGIN_AGENTS, HERMES_PLUGIN_AGENTS, OMP_PACKAGE_AGENTS, CODEBUDDY_PLUGIN_AGENTS, PACKAGE_OWNED_INTEGRATION_AGENTS, SUPPORTED_SETUP_AGENTS, getSetupIntegrationRows2, MEMORIX_HTTP_MCP_URL, setup_default;
 var init_setup = __esm({
   "src/cli/commands/setup.ts"() {
     "use strict";
@@ -197393,6 +197561,7 @@ var init_setup = __esm({
     init_dsh();
     init_workbuddy();
     init_codebuddy();
+    init_grok();
     init_registry2();
     init_official_skills();
     init_version();
@@ -197426,6 +197595,7 @@ var init_setup = __esm({
       "grok"
     ];
     getSetupIntegrationRows2 = getSetupIntegrationRows;
+    MEMORIX_HTTP_MCP_URL = "http://localhost:3211/mcp";
     setup_default = defineCommand({
       meta: {
         name: "setup",
@@ -197501,7 +197671,7 @@ var init_setup = __esm({
               { value: "codex", label: "Codex", hint: "plugin package + marketplace + MCP" },
               { value: "copilot", label: "GitHub Copilot CLI", hint: "plugin package + hooks + MCP" },
               { value: "cursor", label: "Cursor", hint: "MCP + rules + skills" },
-              { value: "grok", label: "Grok Build", hint: "hooks file; MCP stays host-owned" },
+              { value: "grok", label: "Grok Build", hint: "hooks file; MCP host-owned unless --mcp http" },
               { value: "gemini-cli", label: "Gemini CLI", hint: "extension + MCP" },
               { value: "openclaw", label: "OpenClaw", hint: "bundle + hook pack + skills + MCP" },
               { value: "hermes", label: "Hermes Agent", hint: "plugin + hooks + commands + skills + MCP" },
@@ -197567,7 +197737,7 @@ var config_path_exports = {};
 __export(config_path_exports, {
   default: () => config_path_default
 });
-import { homedir as homedir28 } from "os";
+import { homedir as homedir29 } from "os";
 var config_path_default;
 var init_config_path = __esm({
   "src/cli/commands/config-path.ts"() {
@@ -197585,7 +197755,7 @@ var init_config_path = __esm({
       run: async () => {
         const project = detectProject(process.cwd());
         ye2([
-          `Global:  ${getGlobalConfigTomlPath(homedir28())}`,
+          `Global:  ${getGlobalConfigTomlPath(homedir29())}`,
           `Project: ${project ? getProjectConfigTomlPath(project.rootPath) : "not inside a git project"}`
         ].join("\n"), "Memorix config");
       }
@@ -197661,7 +197831,7 @@ __export(config_migrate_exports, {
   serializeResolvedConfigToToml: () => serializeResolvedConfigToToml
 });
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir29 } from "os";
+import { homedir as homedir30 } from "os";
 import { dirname as dirname4 } from "path";
 function serializeResolvedConfigToToml(config2, options = {}) {
   const includeSecrets = options.includeSecrets === true;
@@ -197760,7 +197930,7 @@ var init_config_migrate = __esm({
           v3.error("Not inside a git project. Use `memorix config migrate --global` for global config.");
           return;
         }
-        const target = isGlobal ? getGlobalConfigTomlPath(homedir29()) : getProjectConfigTomlPath(project.rootPath);
+        const target = isGlobal ? getGlobalConfigTomlPath(homedir30()) : getProjectConfigTomlPath(project.rootPath);
         const resolved = getResolvedConfig({ projectRoot: project?.rootPath ?? null });
         const content = serializeResolvedConfigToToml(resolved, { includeSecrets: isGlobal });
         mkdirSync4(dirname4(target), { recursive: true });
@@ -197772,8 +197942,8 @@ var init_config_migrate = __esm({
 });
 
 // src/cli/commands/integrate-shared.ts
-import { homedir as homedir30 } from "os";
-function getIntegrationTargetRoot(useGlobalDefaults, cwd, homeDir = homedir30()) {
+import { homedir as homedir31 } from "os";
+function getIntegrationTargetRoot(useGlobalDefaults, cwd, homeDir = homedir31()) {
   return useGlobalDefaults ? homeDir : cwd;
 }
 function getIntegrationScopeLabel(useGlobalDefaults) {
@@ -199035,7 +199205,7 @@ __export(external_provider_exports, {
 });
 import { spawn as spawn5 } from "child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync12 } from "fs";
-import { delimiter, dirname as dirname5, extname, isAbsolute as isAbsolute4, join as join24, relative as relative4, resolve as resolve6, sep as sep2 } from "path";
+import { delimiter, dirname as dirname5, extname, isAbsolute as isAbsolute4, join as join25, relative as relative4, resolve as resolve6, sep as sep2 } from "path";
 function boundedTimeout(value) {
   if (!Number.isFinite(value)) return DEFAULT_EXTERNAL_CODEGRAPH_TIMEOUT_MS;
   return Math.max(100, Math.min(Math.floor(value), MAX_EXTERNAL_CODEGRAPH_TIMEOUT_MS));
@@ -199064,10 +199234,10 @@ function resolveCommandCandidates(command) {
   }
   const names = extname(requested) ? [requested] : process.platform === "win32" ? [requested + ".exe", requested + ".cmd", requested + ".js", requested] : [requested];
   const directories = [
-    ...process.platform === "win32" && process.env.LOCALAPPDATA ? [join24(process.env.LOCALAPPDATA, "codegraph", "current", "bin")] : [],
+    ...process.platform === "win32" && process.env.LOCALAPPDATA ? [join25(process.env.LOCALAPPDATA, "codegraph", "current", "bin")] : [],
     ...(process.env.PATH ?? "").split(delimiter).filter(Boolean)
   ];
-  return [...new Set(directories.flatMap((directory) => names.map((name) => join24(directory, name))))];
+  return [...new Set(directories.flatMap((directory) => names.map((name) => join25(directory, name))))];
 }
 function resolveLaunch(command) {
   for (const candidate2 of resolveCommandCandidates(command)) {
@@ -199075,8 +199245,8 @@ function resolveLaunch(command) {
     const extension3 = extname(candidate2).toLowerCase();
     if (extension3 === ".cmd") {
       const bundleRoot = resolve6(dirname5(candidate2), "..");
-      const node = join24(bundleRoot, "node.exe");
-      const entry = join24(bundleRoot, "lib", "dist", "bin", "codegraph.js");
+      const node = join25(bundleRoot, "node.exe");
+      const entry = join25(bundleRoot, "lib", "dist", "bin", "codegraph.js");
       if (existsSync19(node) && existsSync19(entry)) {
         return { executable: node, prefixArgs: ["--liftoff-only", entry] };
       }
@@ -199234,7 +199404,7 @@ async function inspectExternalCodeGraph(input) {
     const health2 = { state: "disabled", reason: "External CodeGraph is disabled by configuration." };
     return { health: health2, quality: providerQuality({ mode, health: health2 }) };
   }
-  if (!existsSync19(join24(input.projectRoot, ".codegraph"))) {
+  if (!existsSync19(join25(input.projectRoot, ".codegraph"))) {
     const health2 = { state: "not-detected", reason: "No local .codegraph index is present for this project." };
     return { health: health2, quality: providerQuality({ mode, health: health2 }) };
   }
@@ -199269,7 +199439,7 @@ async function runExternalCodeGraphLifecycle(input) {
       quality: providerQuality({ mode, health })
     };
   }
-  const indexPath = join24(input.projectRoot, ".codegraph");
+  const indexPath = join25(input.projectRoot, ".codegraph");
   if (input.action === "sync" && !existsSync19(indexPath)) {
     const health = { state: "not-detected", reason: "No local .codegraph index is present for this project." };
     return {
@@ -200095,6 +200265,7 @@ var init_project_context = __esm({
 // src/store/graph-store.ts
 var graph_store_exports = {};
 __export(graph_store_exports, {
+  DEFAULT_GRAPH_PROJECT_ID: () => DEFAULT_GRAPH_PROJECT_ID,
   GraphSqliteStore: () => GraphSqliteStore,
   getGraphStore: () => getGraphStore,
   initGraphStore: () => initGraphStore,
@@ -200124,37 +200295,106 @@ function entityToRow(entity) {
     observations: JSON.stringify(entity.observations ?? [])
   };
 }
-async function initGraphStore(dataDir) {
-  if (_graphStore && _graphDataDir === dataDir) return _graphStore;
-  _graphStore = new GraphSqliteStore();
-  await _graphStore.init(dataDir);
-  _graphDataDir = dataDir;
-  return _graphStore;
+function ensureScopedGraphSchema(db2) {
+  const entityColumns = db2.prepare("PRAGMA table_info(graph_entities)").all();
+  if (!entityColumns.some((column) => column.name === "projectId")) {
+    const migrate = db2.transaction(() => {
+      db2.exec("ALTER TABLE graph_entities RENAME TO graph_entities_legacy_unscoped");
+      db2.exec(CREATE_SCOPED_GRAPH_ENTITIES);
+      db2.exec(`INSERT INTO graph_entities (projectId, name, entityType, observations)
+        SELECT '${LEGACY_GRAPH_PROJECT_ID}', name, entityType, observations
+        FROM graph_entities_legacy_unscoped`);
+      db2.exec("DROP TABLE graph_entities_legacy_unscoped");
+    });
+    migrate();
+  } else {
+    db2.exec(CREATE_SCOPED_GRAPH_ENTITIES);
+  }
+  const relationColumns = db2.prepare("PRAGMA table_info(graph_relations)").all();
+  if (!relationColumns.some((column) => column.name === "projectId")) {
+    const migrate = db2.transaction(() => {
+      db2.exec("ALTER TABLE graph_relations RENAME TO graph_relations_legacy_unscoped");
+      db2.exec(CREATE_SCOPED_GRAPH_RELATIONS);
+      db2.exec(`INSERT INTO graph_relations (projectId, from_entity, to_entity, relationType)
+        SELECT '${LEGACY_GRAPH_PROJECT_ID}', from_entity, to_entity, relationType
+        FROM graph_relations_legacy_unscoped`);
+      db2.exec("DROP TABLE graph_relations_legacy_unscoped");
+    });
+    migrate();
+  } else {
+    db2.exec(CREATE_SCOPED_GRAPH_RELATIONS);
+  }
+}
+function graphStoreKey(dataDir, projectId) {
+  return `${path34.resolve(dataDir)}\0${projectId}`;
 }
-function getGraphStore() {
-  if (!_graphStore) throw new Error("[memorix] GraphStore not initialized \u2014 call initGraphStore() first");
-  return _graphStore;
+async function initGraphStore(dataDir, projectId = DEFAULT_GRAPH_PROJECT_ID) {
+  const key = graphStoreKey(dataDir, projectId);
+  const existing = _graphStores.get(key);
+  if (existing) {
+    _graphStores.delete(key);
+    _graphStores.set(key, existing);
+    _activeGraphKey = key;
+    return existing;
+  }
+  const store2 = new GraphSqliteStore();
+  await store2.init(dataDir, projectId);
+  _graphStores.set(key, store2);
+  while (_graphStores.size > MAX_GRAPH_STORE_CACHE) {
+    const oldest = _graphStores.keys().next().value;
+    if (!oldest) break;
+    _graphStores.delete(oldest);
+  }
+  _activeGraphKey = key;
+  return store2;
+}
+function getGraphStore(dataDir, projectId) {
+  const key = dataDir && projectId ? graphStoreKey(dataDir, projectId) : _activeGraphKey;
+  const store2 = key ? _graphStores.get(key) : void 0;
+  if (!store2) throw new Error("[memorix] GraphStore not initialized \u2014 call initGraphStore() first");
+  return store2;
 }
 function resetGraphStore() {
-  if (_graphStore) {
+  for (const store2 of _graphStores.values()) {
     try {
-      _graphStore.close();
+      store2.close();
     } catch {
     }
   }
-  _graphStore = null;
-  _graphDataDir = null;
+  _graphStores.clear();
+  _activeGraphKey = null;
 }
-var GraphSqliteStore, _graphStore, _graphDataDir;
+var DEFAULT_GRAPH_PROJECT_ID, LEGACY_GRAPH_PROJECT_ID, MAX_GRAPH_STORE_CACHE, CREATE_SCOPED_GRAPH_ENTITIES, CREATE_SCOPED_GRAPH_RELATIONS, GraphSqliteStore, _graphStores, _activeGraphKey;
 var init_graph_store = __esm({
   "src/store/graph-store.ts"() {
     "use strict";
     init_esm_shims();
     init_sqlite_db();
     init_persistence();
+    DEFAULT_GRAPH_PROJECT_ID = "__default__";
+    LEGACY_GRAPH_PROJECT_ID = "__legacy__";
+    MAX_GRAPH_STORE_CACHE = 32;
+    CREATE_SCOPED_GRAPH_ENTITIES = `
+CREATE TABLE IF NOT EXISTS graph_entities (
+  projectId       TEXT NOT NULL,
+  name            TEXT NOT NULL,
+  entityType      TEXT NOT NULL DEFAULT '',
+  observations    TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (projectId, name)
+);`;
+    CREATE_SCOPED_GRAPH_RELATIONS = `
+CREATE TABLE IF NOT EXISTS graph_relations (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  projectId       TEXT NOT NULL,
+  from_entity     TEXT NOT NULL,
+  to_entity       TEXT NOT NULL,
+  relationType    TEXT NOT NULL DEFAULT '',
+  UNIQUE(projectId, from_entity, to_entity, relationType)
+);`;
     GraphSqliteStore = class {
       db = null;
       dataDir = "";
+      projectId = DEFAULT_GRAPH_PROJECT_ID;
       stmtInsertEntity = null;
       stmtUpdateEntityObs = null;
       stmtDeleteEntity = null;
@@ -200164,45 +200404,89 @@ var init_graph_store = __esm({
       stmtDeleteRelation = null;
       stmtDeleteRelationsByEntity = null;
       stmtSelectAllRelations = null;
-      async init(dataDir) {
+      async init(dataDir, projectId = DEFAULT_GRAPH_PROJECT_ID) {
         this.dataDir = dataDir;
+        this.projectId = projectId;
         this.db = getDatabase(dataDir);
+        ensureScopedGraphSchema(this.db);
         this.stmtInsertEntity = this.db.prepare(
-          `INSERT OR REPLACE INTO graph_entities (name, entityType, observations) VALUES (@name, @entityType, @observations)`
+          `INSERT OR REPLACE INTO graph_entities (projectId, name, entityType, observations) VALUES (@projectId, @name, @entityType, @observations)`
         );
         this.stmtUpdateEntityObs = this.db.prepare(
-          `UPDATE graph_entities SET observations = @observations WHERE name = @name`
+          `UPDATE graph_entities SET observations = @observations WHERE projectId = @projectId AND name = @name`
         );
-        this.stmtDeleteEntity = this.db.prepare(`DELETE FROM graph_entities WHERE name = ?`);
-        this.stmtSelectAllEntities = this.db.prepare(`SELECT * FROM graph_entities`);
-        this.stmtSelectEntityByName = this.db.prepare(`SELECT * FROM graph_entities WHERE name = ?`);
+        this.stmtDeleteEntity = this.db.prepare(`DELETE FROM graph_entities WHERE projectId = ? AND name = ?`);
+        this.stmtSelectAllEntities = this.db.prepare(`SELECT * FROM graph_entities WHERE projectId = ? ORDER BY name`);
+        this.stmtSelectEntityByName = this.db.prepare(`SELECT * FROM graph_entities WHERE projectId = ? AND name = ?`);
         this.stmtInsertRelation = this.db.prepare(
-          `INSERT OR IGNORE INTO graph_relations (from_entity, to_entity, relationType) VALUES (@from, @to, @relationType)`
+          `INSERT OR IGNORE INTO graph_relations (projectId, from_entity, to_entity, relationType) VALUES (@projectId, @from, @to, @relationType)`
         );
         this.stmtDeleteRelation = this.db.prepare(
-          `DELETE FROM graph_relations WHERE from_entity = ? AND to_entity = ? AND relationType = ?`
+          `DELETE FROM graph_relations WHERE projectId = ? AND from_entity = ? AND to_entity = ? AND relationType = ?`
         );
         this.stmtDeleteRelationsByEntity = this.db.prepare(
-          `DELETE FROM graph_relations WHERE from_entity = ? OR to_entity = ?`
+          `DELETE FROM graph_relations WHERE projectId = ? AND (from_entity = ? OR to_entity = ?)`
         );
-        this.stmtSelectAllRelations = this.db.prepare(`SELECT * FROM graph_relations`);
+        this.stmtSelectAllRelations = this.db.prepare(`SELECT * FROM graph_relations WHERE projectId = ? ORDER BY id`);
         await this.migrateFromJsonlIfNeeded();
       }
       async migrateFromJsonlIfNeeded() {
-        const count3 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM graph_entities`).get();
+        const count3 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM graph_entities WHERE projectId = ?`).get(this.projectId);
+        const totalCount = this.db.prepare(`SELECT COUNT(*) AS cnt FROM graph_entities`).get();
         if (count3.cnt > 0) return;
+        if (totalCount.cnt > 0) return;
         const jsonlPath = path34.join(this.dataDir, "graph.jsonl");
         if (!fs20.existsSync(jsonlPath)) return;
         try {
           const data = await loadGraphJsonl(this.dataDir);
           if (data.entities.length === 0 && data.relations.length === 0) return;
           console.error(`[memorix] Migrating graph from JSONL to SQLite (${data.entities.length} entities, ${data.relations.length} relations)...`);
+          const observations2 = this.db.prepare("SELECT id, projectId FROM observations").all();
+          const projectByObservationId = new Map(observations2.map((row) => [row.id, row.projectId]));
+          const projectsByEntity = /* @__PURE__ */ new Map();
+          for (const entity of data.entities) {
+            const projects = /* @__PURE__ */ new Set();
+            for (const content of entity.observations ?? []) {
+              const match2 = /^\[#(\d+)\]/.exec(content);
+              const projectId = match2 ? projectByObservationId.get(Number(match2[1])) : void 0;
+              if (projectId) projects.add(projectId);
+            }
+            projectsByEntity.set(entity.name, projects);
+          }
+          let changed = true;
+          while (changed) {
+            changed = false;
+            for (const relation of data.relations) {
+              const from = projectsByEntity.get(relation.from) ?? /* @__PURE__ */ new Set();
+              const to2 = projectsByEntity.get(relation.to) ?? /* @__PURE__ */ new Set();
+              if (from.size > 0 && to2.size === 0) {
+                projectsByEntity.set(relation.to, new Set(from));
+                changed = true;
+              } else if (to2.size > 0 && from.size === 0) {
+                projectsByEntity.set(relation.from, new Set(to2));
+                changed = true;
+              }
+            }
+          }
+          const entityRows = data.entities.flatMap((entity) => {
+            const projects = projectsByEntity.get(entity.name) ?? /* @__PURE__ */ new Set();
+            const owners = projects.size > 0 ? [...projects] : [this.projectId];
+            return owners.map((projectId) => ({ ...entityToRow(entity), projectId }));
+          });
+          const projectSet = new Set(entityRows.map((row) => String(row.projectId)));
+          const relationRows = data.relations.flatMap((relation) => {
+            const from = projectsByEntity.get(relation.from) ?? /* @__PURE__ */ new Set();
+            const to2 = projectsByEntity.get(relation.to) ?? /* @__PURE__ */ new Set();
+            const shared = [...from].filter((projectId) => to2.has(projectId));
+            const owners = shared.length > 0 ? shared : from.size === 0 && to2.size === 0 ? [this.projectId] : [];
+            return owners.filter((projectId) => projectSet.has(projectId)).map((projectId) => ({ projectId, from: relation.from, to: relation.to, relationType: relation.relationType }));
+          });
           const insertAll = this.db.transaction(() => {
-            for (const entity of data.entities) {
-              this.stmtInsertEntity.run(entityToRow(entity));
+            for (const entity of entityRows) {
+              this.stmtInsertEntity.run(entity);
             }
-            for (const rel of data.relations) {
-              this.stmtInsertRelation.run({ from: rel.from, to: rel.to, relationType: rel.relationType });
+            for (const relation of relationRows) {
+              this.stmtInsertRelation.run(relation);
             }
           });
           insertAll();
@@ -200212,10 +200496,10 @@ var init_graph_store = __esm({
         }
       }
       loadEntities() {
-        return this.stmtSelectAllEntities.all().map(rowToEntity);
+        return this.stmtSelectAllEntities.all(this.projectId).map(rowToEntity);
       }
       loadRelations() {
-        return this.stmtSelectAllRelations.all().map((row) => ({
+        return this.stmtSelectAllRelations.all(this.projectId).map((row) => ({
           from: row.from_entity,
           to: row.to_entity,
           relationType: row.relationType
@@ -200224,7 +200508,7 @@ var init_graph_store = __esm({
       insertEntities(entities) {
         const insertAll = this.db.transaction(() => {
           for (const entity of entities) {
-            this.stmtInsertEntity.run(entityToRow(entity));
+            this.stmtInsertEntity.run({ ...entityToRow(entity), projectId: this.projectId });
           }
         });
         insertAll();
@@ -200232,7 +200516,7 @@ var init_graph_store = __esm({
       insertRelations(relations) {
         const insertAll = this.db.transaction(() => {
           for (const rel of relations) {
-            this.stmtInsertRelation.run({ from: rel.from, to: rel.to, relationType: rel.relationType });
+            this.stmtInsertRelation.run({ projectId: this.projectId, from: rel.from, to: rel.to, relationType: rel.relationType });
           }
         });
         insertAll();
@@ -200240,8 +200524,8 @@ var init_graph_store = __esm({
       deleteEntities(names) {
         const deleteAll = this.db.transaction(() => {
           for (const name of names) {
-            this.stmtDeleteRelationsByEntity.run(name, name);
-            this.stmtDeleteEntity.run(name);
+            this.stmtDeleteRelationsByEntity.run(this.projectId, name, name);
+            this.stmtDeleteEntity.run(this.projectId, name);
           }
         });
         deleteAll();
@@ -200249,7 +200533,7 @@ var init_graph_store = __esm({
       deleteRelations(relations) {
         const deleteAll = this.db.transaction(() => {
           for (const rel of relations) {
-            this.stmtDeleteRelation.run(rel.from, rel.to, rel.relationType);
+            this.stmtDeleteRelation.run(this.projectId, rel.from, rel.to, rel.relationType);
           }
         });
         deleteAll();
@@ -200257,13 +200541,13 @@ var init_graph_store = __esm({
       addObservations(updates) {
         const updateAll = this.db.transaction(() => {
           for (const u5 of updates) {
-            const row = this.stmtSelectEntityByName.get(u5.entityName);
+            const row = this.stmtSelectEntityByName.get(this.projectId, u5.entityName);
             if (!row) continue;
             const existing = safeJsonParse3(row.observations, []);
             const newObs = u5.contents.filter((c6) => !existing.includes(c6));
             if (newObs.length > 0) {
               existing.push(...newObs);
-              this.stmtUpdateEntityObs.run({ name: u5.entityName, observations: JSON.stringify(existing) });
+              this.stmtUpdateEntityObs.run({ projectId: this.projectId, name: u5.entityName, observations: JSON.stringify(existing) });
             }
           }
         });
@@ -200272,11 +200556,11 @@ var init_graph_store = __esm({
       deleteObservations(deletions) {
         const deleteAll = this.db.transaction(() => {
           for (const d4 of deletions) {
-            const row = this.stmtSelectEntityByName.get(d4.entityName);
+            const row = this.stmtSelectEntityByName.get(this.projectId, d4.entityName);
             if (!row) continue;
             const existing = safeJsonParse3(row.observations, []);
             const filtered = existing.filter((o4) => !d4.observations.includes(o4));
-            this.stmtUpdateEntityObs.run({ name: d4.entityName, observations: JSON.stringify(filtered) });
+            this.stmtUpdateEntityObs.run({ projectId: this.projectId, name: d4.entityName, observations: JSON.stringify(filtered) });
           }
         });
         deleteAll();
@@ -200287,13 +200571,13 @@ var init_graph_store = __esm({
        */
       replaceAll(entities, relations) {
         const replaceAll = this.db.transaction(() => {
-          this.db.prepare("DELETE FROM graph_relations").run();
-          this.db.prepare("DELETE FROM graph_entities").run();
+          this.db.prepare("DELETE FROM graph_relations WHERE projectId = ?").run(this.projectId);
+          this.db.prepare("DELETE FROM graph_entities WHERE projectId = ?").run(this.projectId);
           for (const entity of entities) {
-            this.stmtInsertEntity.run(entityToRow(entity));
+            this.stmtInsertEntity.run({ ...entityToRow(entity), projectId: this.projectId });
           }
           for (const rel of relations) {
-            this.stmtInsertRelation.run({ from: rel.from, to: rel.to, relationType: rel.relationType });
+            this.stmtInsertRelation.run({ projectId: this.projectId, from: rel.from, to: rel.to, relationType: rel.relationType });
           }
         });
         replaceAll();
@@ -200301,8 +200585,8 @@ var init_graph_store = __esm({
       close() {
       }
     };
-    _graphStore = null;
-    _graphDataDir = null;
+    _graphStores = /* @__PURE__ */ new Map();
+    _activeGraphKey = null;
   }
 });
 
@@ -200317,11 +200601,14 @@ var init_graph = __esm({
       entities = [];
       relations = [];
       projectDir;
+      projectId;
+      store = null;
       initialized = false;
       /** Index: lowercase entity name → Entity for O(1) lookups */
       entityIndex = /* @__PURE__ */ new Map();
-      constructor(projectDir2) {
+      constructor(projectDir2, projectId = "__default__") {
         this.projectDir = projectDir2;
+        this.projectId = projectId;
       }
       /** Rebuild the entity name index */
       rebuildIndex() {
@@ -200333,10 +200620,9 @@ var init_graph = __esm({
       /** Load graph from SQLite on first access */
       async init() {
         if (this.initialized) return;
-        await initGraphStore(this.projectDir);
-        const store2 = getGraphStore();
-        this.entities = store2.loadEntities();
-        this.relations = store2.loadRelations();
+        this.store = await initGraphStore(this.projectDir, this.projectId);
+        this.entities = this.store.loadEntities();
+        this.relations = this.store.loadRelations();
         this.rebuildIndex();
         this.initialized = true;
       }
@@ -200350,8 +200636,8 @@ var init_graph = __esm({
       }
       /** Persist current state to SQLite */
       async save() {
-        const store2 = getGraphStore();
-        store2.replaceAll(this.entities, this.relations);
+        if (!this.store) throw new Error("[memorix] KnowledgeGraphManager not initialized");
+        this.store.replaceAll(this.entities, this.relations);
       }
       /** Create new entities (skip duplicates by name) */
       async createEntities(entities) {
@@ -200727,7 +201013,7 @@ async function getSessionContext(projectDir2, projectId, limit2 = 3, reader2) {
     let graphNeighbors = [];
     if (!reader2 && activeEntities.length > 0) {
       try {
-        const graphMgr = new KnowledgeGraphManager(projectDir2);
+        const graphMgr = new KnowledgeGraphManager(projectDir2, projectId);
         await graphMgr.init();
         const { relations } = await graphMgr.readGraph();
         const activeSet = new Set(activeEntities.map((n3) => n3.toLowerCase()));
@@ -205235,8 +205521,8 @@ __export(engine_exports2, {
   SkillsEngine: () => SkillsEngine
 });
 import { existsSync as existsSync21, readFileSync as readFileSync13, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync3 } from "fs";
-import { join as join25 } from "path";
-import { homedir as homedir31 } from "os";
+import { join as join26 } from "path";
+import { homedir as homedir32 } from "os";
 var SKILLS_DIRS, SKILL_WORTHY_TYPES, MIN_OBS_FOR_SKILL, MIN_SCORE_FOR_SKILL, LOW_SIGNAL_TITLE_PATTERNS, LOW_SIGNAL_ENTITY_PATTERNS, COMMAND_TRACE_PATTERNS2, SkillsEngine;
 var init_engine4 = __esm({
   "src/skills/engine.ts"() {
@@ -205307,12 +205593,12 @@ var init_engine4 = __esm({
       listSkills() {
         const skills = [];
         const seen = /* @__PURE__ */ new Set();
-        const home = homedir31();
+        const home = homedir32();
         for (const [agent, dirs] of Object.entries(SKILLS_DIRS)) {
           for (const dir of dirs) {
-            const paths = [join25(this.projectRoot, dir)];
+            const paths = [join26(this.projectRoot, dir)];
             if (!this.skipGlobal) {
-              paths.push(join25(home, dir));
+              paths.push(join26(home, dir));
             }
             for (const skillsRoot of paths) {
               if (!existsSync21(skillsRoot)) continue;
@@ -205322,7 +205608,7 @@ var init_engine4 = __esm({
                   if (!entry.isDirectory()) continue;
                   const name = entry.name;
                   if (seen.has(name)) continue;
-                  const skillMd = join25(skillsRoot, name, "SKILL.md");
+                  const skillMd = join26(skillsRoot, name, "SKILL.md");
                   if (!existsSync21(skillMd)) continue;
                   try {
                     const content = readFileSync13(skillMd, "utf-8");
@@ -205330,7 +205616,7 @@ var init_engine4 = __esm({
                     skills.push({
                       name,
                       description,
-                      sourcePath: join25(skillsRoot, name),
+                      sourcePath: join26(skillsRoot, name),
                       sourceAgent: agent,
                       content,
                       generated: false
@@ -205373,11 +205659,11 @@ var init_engine4 = __esm({
       writeSkill(skill2, target) {
         const dirs = SKILLS_DIRS[target];
         if (!dirs || dirs.length === 0) return null;
-        const targetDir = join25(this.projectRoot, dirs[0], skill2.name);
+        const targetDir = join26(this.projectRoot, dirs[0], skill2.name);
         try {
           mkdirSync5(targetDir, { recursive: true });
-          writeFileSync5(join25(targetDir, "SKILL.md"), skill2.content, "utf-8");
-          return join25(dirs[0], skill2.name, "SKILL.md");
+          writeFileSync5(join26(targetDir, "SKILL.md"), skill2.content, "utf-8");
+          return join26(dirs[0], skill2.name, "SKILL.md");
         } catch {
           return null;
         }
@@ -206546,7 +206832,7 @@ var init_task_graph = __esm({
 // src/orchestrate/context-collector.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { readFileSync as readFileSync14, existsSync as existsSync22 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function normalizeEntryLimit(value, fallback) {
   if (!Number.isSafeInteger(value) || value < 1) return fallback;
   return Math.min(value, 500);
@@ -206621,7 +206907,7 @@ function collectFileTree(projectDir2, maxEntries) {
 }
 function collectDependencies(projectDir2) {
   try {
-    const pkgPath = join26(projectDir2, "package.json");
+    const pkgPath = join27(projectDir2, "package.json");
     if (!existsSync22(pkgPath)) return "";
     const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     const parts = [];
@@ -207958,7 +208244,7 @@ var init_tool_profile = __esm({
 function getMcpServerInfo() {
   return {
     name: "memorix",
-    version: true ? "1.9.3" : "1.0.1"
+    version: true ? "1.9.5" : "1.0.1"
   };
 }
 function createMcpDiscoverResult(capabilities, serverInfo) {
@@ -221764,8 +222050,8 @@ __export(engine_exports3, {
   WorkspaceSyncEngine: () => WorkspaceSyncEngine
 });
 import { readFileSync as readFileSync16, readdirSync as readdirSync4, existsSync as existsSync25, cpSync, mkdirSync as mkdirSync7 } from "fs";
-import { join as join28 } from "path";
-import { homedir as homedir32 } from "os";
+import { join as join29 } from "path";
+import { homedir as homedir33 } from "os";
 var WorkspaceSyncEngine;
 var init_engine5 = __esm({
   "src/workspace/engine.ts"() {
@@ -221837,9 +222123,9 @@ var init_engine5 = __esm({
           const globalPath = adapter.getConfigPath();
           const pathsToCheck = [configPath, globalPath];
           if (target === "antigravity") {
-            pathsToCheck.push(join28(this.projectRoot, ".gemini", "settings.json"));
-            pathsToCheck.push(join28(homedir32(), ".gemini", "settings.json"));
-            pathsToCheck.push(join28(homedir32(), ".gemini", "antigravity", "mcp_config.json"));
+            pathsToCheck.push(join29(this.projectRoot, ".gemini", "settings.json"));
+            pathsToCheck.push(join29(homedir33(), ".gemini", "settings.json"));
+            pathsToCheck.push(join29(homedir33(), ".gemini", "antigravity", "mcp_config.json"));
           }
           const merged = /* @__PURE__ */ new Map();
           for (const path50 of pathsToCheck) {
@@ -221956,7 +222242,7 @@ var init_engine5 = __esm({
       getTargetSkillsDir(target) {
         const dirs = _WorkspaceSyncEngine.SKILLS_DIRS[target];
         if (!dirs || dirs.length === 0) return null;
-        return join28(this.projectRoot, dirs[0]);
+        return join29(this.projectRoot, dirs[0]);
       }
       /**
        * Scan all agent skills directories and collect unique skills.
@@ -221965,12 +222251,12 @@ var init_engine5 = __esm({
         const skills = [];
         const conflicts = [];
         const seen = /* @__PURE__ */ new Map();
-        const home = homedir32();
+        const home = homedir33();
         for (const [agent, dirs] of Object.entries(_WorkspaceSyncEngine.SKILLS_DIRS)) {
           for (const dir of dirs) {
             const paths = [
-              join28(this.projectRoot, dir),
-              join28(home, dir)
+              join29(this.projectRoot, dir),
+              join29(home, dir)
             ];
             for (const skillsRoot of paths) {
               if (!existsSync25(skillsRoot)) continue;
@@ -221978,7 +222264,7 @@ var init_engine5 = __esm({
                 const entries = readdirSync4(skillsRoot, { withFileTypes: true });
                 for (const entry of entries) {
                   if (!entry.isDirectory()) continue;
-                  const skillMd = join28(skillsRoot, entry.name, "SKILL.md");
+                  const skillMd = join29(skillsRoot, entry.name, "SKILL.md");
                   if (!existsSync25(skillMd)) continue;
                   let description = "";
                   try {
@@ -221990,7 +222276,7 @@ var init_engine5 = __esm({
                   const newEntry = {
                     name: entry.name,
                     description,
-                    sourcePath: join28(skillsRoot, entry.name),
+                    sourcePath: join29(skillsRoot, entry.name),
                     sourceAgent: agent
                   };
                   const existing = seen.get(entry.name);
@@ -222027,7 +222313,7 @@ var init_engine5 = __esm({
         }
         for (const skill2 of skills) {
           if (skill2.sourceAgent === target) continue;
-          const dest = join28(targetDir, skill2.name);
+          const dest = join29(targetDir, skill2.name);
           if (existsSync25(dest)) {
             skipped.push(`${skill2.name} (already exists in ${target})`);
             continue;
@@ -222043,13 +222329,13 @@ var init_engine5 = __esm({
       }
       scanWorkflows() {
         const workflows = [];
-        const wfDir = join28(this.projectRoot, ".windsurf", "workflows");
+        const wfDir = join29(this.projectRoot, ".windsurf", "workflows");
         if (!existsSync25(wfDir)) return workflows;
         try {
           const files = readdirSync4(wfDir).filter((f7) => f7.endsWith(".md"));
           for (const file2 of files) {
             try {
-              const content = readFileSync16(join28(wfDir, file2), "utf-8");
+              const content = readFileSync16(join29(wfDir, file2), "utf-8");
               workflows.push(this.workflowSyncer.parseWindsurfWorkflow(file2, content));
             } catch {
             }
@@ -222324,7 +222610,7 @@ __export(behavior_exports, {
   resetBehaviorConfigCache: () => resetBehaviorConfigCache
 });
 import { existsSync as existsSync26, readFileSync as readFileSync17 } from "fs";
-import { homedir as homedir33 } from "os";
+import { homedir as homedir34 } from "os";
 function isSessionInject(value) {
   return value === "full" || value === "minimal" || value === "silent";
 }
@@ -222342,7 +222628,7 @@ function legacyBehavior(homeDir) {
   }
 }
 function getBehaviorConfig(options = {}) {
-  const homeDir = options.homeDir ?? homedir33();
+  const homeDir = options.homeDir ?? homedir34();
   const projectRoot = options.projectRoot === void 0 ? detectProject()?.rootPath ?? null : options.projectRoot;
   const cacheKey2 = `${homeDir}\0${projectRoot ?? ""}`;
   const cached2 = cache4.get(cacheKey2);
@@ -223580,8 +223866,7 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
         break;
       }
       case "/graph": {
-        await initGraphStore(effectiveDataDir);
-        const gStore = getGraphStore();
+        const gStore = await initGraphStore(effectiveDataDir, effectiveProjectId);
         const graph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
         const graphObs = filterDashboardObservations(
           await getObservationStore().loadByProject(effectiveProjectId, { status: "active" }),
@@ -223625,8 +223910,8 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
         break;
       }
       case "/stats": {
-        await initGraphStore(effectiveDataDir);
-        const graph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
+        const gStore = await initGraphStore(effectiveDataDir, effectiveProjectId);
+        const graph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
         const observations2 = filterDashboardObservations(
           await getObservationStore().loadByProject(effectiveProjectId, { status: "active" }),
           effectiveProjectId
@@ -223819,15 +224104,15 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
       case "/knowledge-graph": {
         const { generateKnowledgeGraph: generateKnowledgeGraph2 } = await Promise.resolve().then(() => (init_knowledge_graph(), knowledge_graph_exports));
         const { initMiniSkillStore: initMiniSkillStore2, getMiniSkillStore: getMiniSkillStore2 } = await Promise.resolve().then(() => (init_mini_skill_store(), mini_skill_store_exports));
-        const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+        const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
         await initMiniSkillStore2(effectiveDataDir);
-        await initGraphStore2(effectiveDataDir);
+        const gStore = await initGraphStore2(effectiveDataDir, effectiveProjectId);
         const allObs = filterDashboardObservations(
           await getObservationStore().loadByProject(effectiveProjectId, { status: "active" }),
           effectiveProjectId
         );
         const skills = await getMiniSkillStore2().loadByProject(effectiveProjectId);
-        const fullGraph = { entities: getGraphStore2().loadEntities(), relations: getGraphStore2().loadRelations() };
+        const fullGraph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
         const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
         const graph = generateKnowledgeGraph2({
           projectId: effectiveProjectId,
@@ -223842,7 +224127,7 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
       case "/config": {
         const os10 = await import("os");
         const { existsSync: existsSync36 } = await import("fs");
-        const { join: join35 } = await import("path");
+        const { join: join36 } = await import("path");
         const configProjectRoot = effectiveProjectRoot;
         const resolved = getResolvedConfig({ projectRoot: configProjectRoot });
         const files = {
@@ -223857,13 +224142,13 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
         try {
           const home = os10.homedir();
           const paths = {
-            "project memorix.yml": configProjectRoot ? join35(configProjectRoot, "memorix.yml") : null,
-            "user memorix.yml": join35(home, ".memorix", "memorix.yml"),
-            "project memorix.toml": configProjectRoot ? join35(configProjectRoot, "memorix.toml") : null,
-            "user config.toml": join35(home, ".memorix", "config.toml"),
-            "project .env": configProjectRoot ? join35(configProjectRoot, ".env") : null,
-            "user .env": join35(home, ".memorix", ".env"),
-            "legacy config.json": join35(home, ".memorix", "config.json")
+            "project memorix.yml": configProjectRoot ? join36(configProjectRoot, "memorix.yml") : null,
+            "user memorix.yml": join36(home, ".memorix", "memorix.yml"),
+            "project memorix.toml": configProjectRoot ? join36(configProjectRoot, "memorix.toml") : null,
+            "user config.toml": join36(home, ".memorix", "config.toml"),
+            "project .env": configProjectRoot ? join36(configProjectRoot, ".env") : null,
+            "user .env": join36(home, ".memorix", ".env"),
+            "legacy config.json": join36(home, ".memorix", "config.json")
           };
           for (const [key, fpath] of Object.entries(paths)) {
             if (fpath === null) {
@@ -224024,8 +224309,7 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
           } else {
             await obsStore.remove(obsId);
             try {
-              await initGraphStore(effectiveDataDir);
-              const gStore = getGraphStore();
+              const gStore = await initGraphStore(effectiveDataDir, effectiveProjectId);
               const prefix = `[#${obsId}] `;
               const deletions = [];
               for (const entity of gStore.loadEntities()) {
@@ -224040,8 +224324,8 @@ async function handleApi(req, res, dataDir, projectId, projectName, baseDir, pro
           break;
         }
         if (apiPath === "/export") {
-          await initGraphStore(effectiveDataDir);
-          const fullGraph = { entities: getGraphStore().loadEntities(), relations: getGraphStore().loadRelations() };
+          const gStore = await initGraphStore(effectiveDataDir, effectiveProjectId);
+          const fullGraph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
           const observations2 = filterDashboardObservations(
             await getObservationStore().loadByProject(effectiveProjectId, { status: "active" }),
             effectiveProjectId
@@ -264565,7 +264849,7 @@ async function createMemorixServer(cwd, existingServer, sharedTeam, options = {}
     const store2 = getObservationStore();
     console.error(`[memorix] ObservationStore backend: ${store2.getBackendName()}, generation: ${store2.getGeneration()}`);
   }
-  let graphManager = new KnowledgeGraphManager(projectDir2);
+  let graphManager = new KnowledgeGraphManager(projectDir2, project.id);
   if (!deferProjectRuntimeInit) {
     await graphManager.init();
     await initObservations(projectDir2);
@@ -264577,7 +264861,7 @@ async function createMemorixServer(cwd, existingServer, sharedTeam, options = {}
     await initObservationStore(projectDir2);
     await initMiniSkillStore(projectDir2);
     await initSessionStore(projectDir2);
-    graphManager = new KnowledgeGraphManager(projectDir2);
+    graphManager = new KnowledgeGraphManager(projectDir2, project.id);
     await graphManager.init();
     await initObservations(projectDir2);
     const indexed = await prepareSearchIndex();
@@ -266789,10 +267073,10 @@ ${Math.max(0, managedIds.size - result.resolved.length)} visible writable observ
   );
   let enableKG = isToolInProfile("create_entities", toolProfile);
   try {
-    const { homedir: homedir37 } = await import("os");
-    const { join: join35 } = await import("path");
+    const { homedir: homedir38 } = await import("os");
+    const { join: join36 } = await import("path");
     const { readFile: readFile11 } = await import("fs/promises");
-    const raw = await readFile11(join35(homedir37(), ".memorix", "settings.json"), "utf-8");
+    const raw = await readFile11(join36(homedir38(), ".memorix", "settings.json"), "utf-8");
     const s4 = JSON.parse(raw);
     if (s4.knowledgeGraph === true) enableKG = true;
   } catch {
@@ -268636,6 +268920,7 @@ ${lines.join("\n")}` }] };
         } : {},
         ...mediaGenerationEnabled ? {
           image: external_exports2.string().optional().describe("Base64-encoded reference image for image-to-image generation."),
+          firstFrameImageUrl: external_exports2.string().optional().describe("Public HTTPS first-frame image URL for MiniMax video generation; stored with the queued job."),
           region: external_exports2.enum(["global", "cn"]).optional().describe("MiniMax deployment region."),
           n: external_exports2.number().int().min(1).max(4).optional().describe("Image output count."),
           ratio: external_exports2.enum(["adaptive", "1:1", "16:9", "4:3", "3:2", "2:3", "3:4", "9:16", "21:9"]).optional().describe("Image or video aspect ratio."),
@@ -268645,7 +268930,7 @@ ${lines.join("\n")}` }] };
         } : {}
       }
     },
-    async ({ action, path: assetPath, assetId, jobId, kind, limit: limit2, title, narrative, prompt: prompt2, image, model, provider: provider2, language, region, n: n3, ratio, width, height, duration: duration3, maxPages, maxChars, attach }) => {
+    async ({ action, path: assetPath, assetId, jobId, kind, limit: limit2, title, narrative, prompt: prompt2, image, firstFrameImageUrl, model, provider: provider2, language, region, n: n3, ratio, width, height, duration: duration3, maxPages, maxChars, attach }) => {
       const unresolved = requireResolvedProject("manage controlled media");
       if (unresolved) return unresolved;
       const safeError4 = (error40) => sanitizeCredentials(
@@ -268815,6 +269100,7 @@ ${lines.join("\n")}` }] };
             dataDir: projectDir2,
             projectId: project.id,
             prompt: prompt2,
+            firstFrameImageUrl,
             ...model === "MiniMax-H3" ? { model } : {},
             ...region ? { region } : {},
             ...videoRatio ? { ratio: videoRatio } : {},
@@ -269365,8 +269651,8 @@ __export(update_checker_exports, {
 });
 import { execFile as execFile3 } from "child_process";
 import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir7 } from "fs/promises";
-import { join as join29 } from "path";
-import { homedir as homedir34 } from "os";
+import { join as join30 } from "path";
+import { homedir as homedir35 } from "os";
 function getCurrentVersion() {
   try {
     return getCliVersion();
@@ -269545,8 +269831,8 @@ var init_update_checker = __esm({
     MIN_AUTO_UPDATE_TIMEOUT_MS = 5e3;
     MAX_AUTO_UPDATE_TIMEOUT_MS = 30 * 60 * 1e3;
     REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
-    CACHE_DIR2 = join29(homedir34(), ".memorix");
-    CACHE_FILE2 = join29(CACHE_DIR2, "update-check.json");
+    CACHE_DIR2 = join30(homedir35(), ".memorix");
+    CACHE_FILE2 = join30(CACHE_DIR2, "update-check.json");
     _testing = {
       CACHE_FILE: CACHE_FILE2,
       CHECK_INTERVAL_MS,
@@ -269604,7 +269890,7 @@ var init_serve = __esm({
         const { serveStdio, StdioServerTransport } = await import("@modelcontextprotocol/server/stdio");
         const { createModernMcpBridge: createModernMcpBridge2 } = await Promise.resolve().then(() => (init_modern_mcp_bridge(), modern_mcp_bridge_exports));
         const { detectProject: detectProject2, findGitInSubdirs: findGitInSubdirs2, isSystemDirectory: isSystemDirectory2 } = await Promise.resolve().then(() => (init_detector(), detector_exports));
-        const { homedir: homedir37 } = await import("os");
+        const { homedir: homedir38 } = await import("os");
         const { writeLastProjectRoot: writeLastProjectRoot2 } = await Promise.resolve().then(() => (init_launch_root(), launch_root_exports));
         const { resolveServeProject: resolveServeProject2 } = await Promise.resolve().then(() => (init_serve_shared(), serve_shared_exports));
         let stdioHandle;
@@ -269633,7 +269919,7 @@ var init_serve = __esm({
         try {
           safeCwd = process.cwd();
         } catch {
-          safeCwd = homedir37();
+          safeCwd = homedir38();
         }
         const resolution = resolveServeProject2(
           {
@@ -269641,7 +269927,7 @@ var init_serve = __esm({
             envProjectRoot: process.env.MEMORIX_PROJECT_ROOT,
             initCwd: process.env.INIT_CWD,
             processCwd: safeCwd,
-            homeDir: homedir37()
+            homeDir: homedir38()
           },
           { detectProject: detectProject2, findGitInSubdirs: findGitInSubdirs2, isSystemDirectory: isSystemDirectory2 }
         );
@@ -271862,6 +272148,7 @@ var init_streamableHttp = __esm({
 // src/server/mcp-binding-store.ts
 var mcp_binding_store_exports = {};
 __export(mcp_binding_store_exports, {
+  DEFAULT_MCP_BINDING_TTL_MS: () => DEFAULT_MCP_BINDING_TTL_MS,
   McpBindingStore: () => McpBindingStore
 });
 import { randomUUID as randomUUID19 } from "crypto";
@@ -271876,12 +272163,13 @@ function rowToBinding(row) {
     ...row.expires_at ? { expiresAt: String(row.expires_at) } : {}
   };
 }
-var McpBindingStore;
+var DEFAULT_MCP_BINDING_TTL_MS, McpBindingStore;
 var init_mcp_binding_store = __esm({
   "src/server/mcp-binding-store.ts"() {
     "use strict";
     init_esm_shims();
     init_sqlite_db();
+    DEFAULT_MCP_BINDING_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
     McpBindingStore = class {
       db = null;
       async init(dataDir) {
@@ -271893,6 +272181,7 @@ var init_mcp_binding_store = __esm({
       }
       create(input) {
         const now3 = /* @__PURE__ */ new Date();
+        const ttlMs = input.ttlMs ?? DEFAULT_MCP_BINDING_TTL_MS;
         const binding = {
           handleId: `mxh_${randomUUID19().replace(/-/g, "")}`,
           projectId: input.projectId,
@@ -271900,7 +272189,7 @@ var init_mcp_binding_store = __esm({
           dataDir: input.dataDir,
           createdAt: now3.toISOString(),
           lastUsedAt: now3.toISOString(),
-          ...input.ttlMs && input.ttlMs > 0 ? { expiresAt: new Date(now3.getTime() + input.ttlMs).toISOString() } : {}
+          ...ttlMs > 0 ? { expiresAt: new Date(now3.getTime() + ttlMs).toISOString() } : {}
         };
         this.requireDb().prepare(`
       INSERT INTO mcp_bindings (handle_id, project_id, project_root, data_dir, created_at, last_used_at, expires_at)
@@ -271922,8 +272211,15 @@ var init_mcp_binding_store = __esm({
         const binding = this.get(handleId);
         if (!binding) return void 0;
         const lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
-        this.requireDb().prepare(`UPDATE mcp_bindings SET last_used_at = ? WHERE handle_id = ?`).run(lastUsedAt, handleId);
-        return { ...binding, lastUsedAt };
+        const expiresAt = new Date(Date.now() + DEFAULT_MCP_BINDING_TTL_MS).toISOString();
+        this.requireDb().prepare(`UPDATE mcp_bindings SET last_used_at = ?, expires_at = ? WHERE handle_id = ?`).run(lastUsedAt, expiresAt, handleId);
+        return { ...binding, lastUsedAt, expiresAt };
+      }
+      cleanupExpired(now3 = Date.now()) {
+        const result = this.requireDb().prepare(
+          `DELETE FROM mcp_bindings WHERE expires_at IS NOT NULL AND expires_at <= ?`
+        ).run(new Date(now3).toISOString());
+        return Number(result.changes ?? 0);
       }
       /** Reuse the most recent valid extension handle for a verified project root. */
       findByProjectRoot(projectRoot) {
@@ -272013,16 +272309,25 @@ var init_control_plane_maintenance = __esm({
 // src/cli/commands/serve-http.ts
 var serve_http_exports = {};
 __export(serve_http_exports, {
+  DEFAULT_HTTP_BODY_LIMIT_BYTES: () => DEFAULT_HTTP_BODY_LIMIT_BYTES,
   DEFAULT_SESSION_TIMEOUT_MS: () => DEFAULT_SESSION_TIMEOUT_MS,
   EXPIRED_SESSION_TTL_MS: () => EXPIRED_SESSION_TTL_MS,
+  HttpPayloadTooLargeError: () => HttpPayloadTooLargeError,
+  MAX_HTTP_BODY_LIMIT_BYTES: () => MAX_HTTP_BODY_LIMIT_BYTES,
   MCP_SDK_COMPAT_PROTOCOL_VERSION: () => MCP_SDK_COMPAT_PROTOCOL_VERSION,
+  MIN_HTTP_BODY_LIMIT_BYTES: () => MIN_HTTP_BODY_LIMIT_BYTES,
   _testing: () => _testing2,
   default: () => serve_http_default,
+  isLoopbackHost: () => isLoopbackHost,
   isServerDiscoverRequest: () => isServerDiscoverRequest,
+  parseHttpBodyLimit: () => parseHttpBodyLimit,
+  parseJsonBody: () => parseJsonBody,
   parseSessionTimeoutMs: () => parseSessionTimeoutMs,
-  resolveServeHttpDefaults: () => resolveServeHttpDefaults
+  resolveServeHttpDefaults: () => resolveServeHttpDefaults,
+  validateHttpBindSecurity: () => validateHttpBindSecurity
 });
 import { getHeapStatistics } from "v8";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 function isServerDiscoverRequest(body) {
   return Boolean(body && typeof body === "object" && !Array.isArray(body) && body.method === "server/discover");
 }
@@ -272033,6 +272338,78 @@ function parseSessionTimeoutMs(raw) {
   if (!Number.isFinite(parsed) || parsed < 0) return DEFAULT_SESSION_TIMEOUT_MS;
   return Math.floor(parsed);
 }
+function parseHttpBodyLimit(raw) {
+  const value = raw?.trim();
+  if (!value) return DEFAULT_HTTP_BODY_LIMIT_BYTES;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < MIN_HTTP_BODY_LIMIT_BYTES) {
+    return DEFAULT_HTTP_BODY_LIMIT_BYTES;
+  }
+  return Math.min(parsed, MAX_HTTP_BODY_LIMIT_BYTES);
+}
+function isLoopbackHost(host) {
+  const normalized = host.trim().toLowerCase();
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
+}
+function validateHttpBindSecurity(host, env3 = process.env) {
+  const hasToken = Boolean(env3.MEMORIX_HTTP_AUTH_TOKEN?.trim());
+  const explicitlyUnauthenticated = env3.MEMORIX_HTTP_ALLOW_UNAUTHENTICATED_BIND === "1";
+  if (!isLoopbackHost(host) && !hasToken && !explicitlyUnauthenticated) {
+    throw new Error(
+      `[memorix] Refusing unauthenticated non-loopback HTTP bind on ${host}. Set MEMORIX_HTTP_AUTH_TOKEN or explicitly set MEMORIX_HTTP_ALLOW_UNAUTHENTICATED_BIND=1.`
+    );
+  }
+  return { requiresAuth: hasToken, explicitlyUnauthenticated };
+}
+function isAuthorizedHttpRequest(req, token) {
+  const header = req.headers.authorization;
+  if (!header) return false;
+  const match2 = /^Bearer\s+(.+)$/iu.exec(header);
+  if (!match2) return false;
+  const provided = Buffer.from(match2[1], "utf8");
+  const expected = Buffer.from(token, "utf8");
+  return provided.length === expected.length && timingSafeEqual2(provided, expected);
+}
+function parseJsonBody(req, limitBytes) {
+  return new Promise((resolve9, reject) => {
+    const contentLength = Number(req.headers["content-length"]);
+    if (Number.isSafeInteger(contentLength) && contentLength > limitBytes) {
+      req.resume();
+      reject(new HttpPayloadTooLargeError(limitBytes));
+      return;
+    }
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    const fail2 = (error40) => {
+      if (settled) return;
+      settled = true;
+      reject(error40);
+    };
+    req.on("data", (chunk) => {
+      if (settled) return;
+      size += chunk.length;
+      if (size > limitBytes) {
+        req.removeAllListeners("data");
+        req.resume();
+        fail2(new HttpPayloadTooLargeError(limitBytes));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      if (settled) return;
+      settled = true;
+      try {
+        const body = Buffer.concat(chunks).toString("utf-8");
+        resolve9(body ? JSON.parse(body) : void 0);
+      } catch (error40) {
+        reject(error40);
+      }
+    });
+    req.on("error", fail2);
+  });
+}
 function resolveServeHttpDefaults(argsPort, configured) {
   const configuredPort = typeof configured.port === "number" && Number.isFinite(configured.port) ? configured.port : void 0;
   const port = parseTcpPortOrReport(argsPort, configuredPort ?? 3211);
@@ -272042,7 +272419,7 @@ function resolveServeHttpDefaults(argsPort, configured) {
   const transportNotice = configured.transport === "stdio" ? '[memorix] config server.transport = "stdio"; serve-http continues on HTTP (the explicit command wins).' : void 0;
   return { port, transportNotice };
 }
-var DEFAULT_SESSION_TIMEOUT_MS, EXPIRED_SESSION_TTL_MS, MCP_SDK_COMPAT_PROTOCOL_VERSION, serve_http_default, _testing2;
+var DEFAULT_SESSION_TIMEOUT_MS, EXPIRED_SESSION_TTL_MS, DEFAULT_HTTP_BODY_LIMIT_BYTES, MAX_HTTP_BODY_LIMIT_BYTES, MIN_HTTP_BODY_LIMIT_BYTES, MCP_SDK_COMPAT_PROTOCOL_VERSION, HttpPayloadTooLargeError, serve_http_default, _testing2;
 var init_serve_http = __esm({
   "src/cli/commands/serve-http.ts"() {
     "use strict";
@@ -272058,7 +272435,17 @@ var init_serve_http = __esm({
     init_mcp_root_path();
     DEFAULT_SESSION_TIMEOUT_MS = 12 * 60 * 60 * 1e3;
     EXPIRED_SESSION_TTL_MS = 10 * 60 * 1e3;
+    DEFAULT_HTTP_BODY_LIMIT_BYTES = 10 * 1024 * 1024;
+    MAX_HTTP_BODY_LIMIT_BYTES = 64 * 1024 * 1024;
+    MIN_HTTP_BODY_LIMIT_BYTES = 64 * 1024;
     MCP_SDK_COMPAT_PROTOCOL_VERSION = "2025-11-25";
+    HttpPayloadTooLargeError = class extends Error {
+      statusCode = 413;
+      constructor(limitBytes) {
+        super(`Request body exceeds the ${limitBytes} byte limit.`);
+        this.name = "HttpPayloadTooLargeError";
+      }
+    };
     serve_http_default = defineCommand({
       meta: {
         name: "serve-http",
@@ -272095,7 +272482,7 @@ var init_serve_http = __esm({
         const { createProjectBindingController: createProjectBindingController2 } = await Promise.resolve().then(() => (init_request_context(), request_context_exports));
         const { findGitInSubdirs: findGitInSubdirs2 } = await Promise.resolve().then(() => (init_detector(), detector_exports));
         const { writeFileSync: writeFileSync13, mkdirSync: mkdirSync13 } = await import("fs");
-        const { homedir: homedir37 } = await import("os");
+        const { homedir: homedir38 } = await import("os");
         const { McpBindingStore: McpBindingStore2 } = await Promise.resolve().then(() => (init_mcp_binding_store(), mcp_binding_store_exports));
         const { MemoryFeedbackStore: MemoryFeedbackStore2 } = await Promise.resolve().then(() => (init_feedback(), feedback_exports));
         const { createModernMcpBridge: createModernMcpBridge2 } = await Promise.resolve().then(() => (init_modern_mcp_bridge(), modern_mcp_bridge_exports));
@@ -272111,12 +272498,20 @@ var init_serve_http = __esm({
         if (resolved.transportNotice) console.error(resolved.transportNotice);
         const port = resolved.port;
         const host = args.host || "127.0.0.1";
+        const bindSecurity = validateHttpBindSecurity(host);
+        const httpAuthToken = process.env.MEMORIX_HTTP_AUTH_TOKEN?.trim() || "";
+        if (bindSecurity.explicitlyUnauthenticated && !isLoopbackHost(host)) {
+          console.error(`[memorix] WARNING: HTTP control plane is unauthenticated on ${host}; keep it behind a private network or authenticated proxy.`);
+        }
+        if (bindSecurity.requiresAuth) {
+          console.error("[memorix] HTTP control plane authentication is enabled (Bearer token).");
+        }
         const toolProfile = resolveToolProfile({ explicit: args.mode, envValue: process.env.MEMORIX_MODE, fallback: "team" });
         let safeCwd;
         try {
           safeCwd = process.cwd();
         } catch {
-          safeCwd = homedir37();
+          safeCwd = homedir38();
         }
         const { resolveServeProject: resolveServeProject2 } = await Promise.resolve().then(() => (init_serve_shared(), serve_shared_exports));
         const { writeLastProjectRoot: writeLastProjectRoot2 } = await Promise.resolve().then(() => (init_launch_root(), launch_root_exports));
@@ -272127,7 +272522,7 @@ var init_serve_http = __esm({
             cwdArg: args.cwd,
             envProjectRoot: process.env.MEMORIX_PROJECT_ROOT,
             processCwd: safeCwd,
-            homeDir: homedir37()
+            homeDir: homedir38()
           },
           { detectProject: detectorMod.detectProject, findGitInSubdirs: detectorMod.findGitInSubdirs, isSystemDirectory: detectorMod.isSystemDirectory }
         );
@@ -272141,6 +272536,7 @@ var init_serve_http = __esm({
         console.error(`[memorix] HTTP transport starting on ${host}:${port}`);
         console.error(`[memorix] Project root: ${projectRoot}`);
         const sessionTimeoutMs = parseSessionTimeoutMs(process.env.MEMORIX_SESSION_TIMEOUT_MS);
+        const httpBodyLimitBytes = parseHttpBodyLimit(process.env.MEMORIX_HTTP_MAX_BODY_BYTES);
         console.error(
           sessionTimeoutMs === 0 ? "[memorix] HTTP session idle timeout: disabled" : `[memorix] HTTP session idle timeout: ${Math.round(sessionTimeoutMs / 6e4)}min (${sessionTimeoutMs}ms)`
         );
@@ -272211,21 +272607,6 @@ var init_serve_http = __esm({
           res.writeHead(404, { "Content-Type": "text/plain" });
           res.end(message);
         }
-        function parseBody(req) {
-          return new Promise((resolve9, reject) => {
-            const chunks = [];
-            req.on("data", (chunk) => chunks.push(chunk));
-            req.on("end", () => {
-              try {
-                const body = Buffer.concat(chunks).toString("utf-8");
-                resolve9(body ? JSON.parse(body) : void 0);
-              } catch (err) {
-                reject(err);
-              }
-            });
-            req.on("error", reject);
-          });
-        }
         function patchMcpResponse(res) {
           const origWriteHead = res.writeHead;
           const origWrite = res.write;
@@ -272315,7 +272696,7 @@ var init_serve_http = __esm({
             res.setHeader("Vary", "Origin");
           }
           res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-          res.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, Mcp-Session-Id, Mcp-Project-Handle, Mcp-Project-Root, Mcp-Stateless, Last-Event-Id");
+          res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, Accept, Mcp-Session-Id, Mcp-Project-Handle, Mcp-Project-Root, Mcp-Stateless, Last-Event-Id");
           res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Mcp-Project-Handle, Mcp-Protocol-Version, Mcp-Method, Mcp-Name");
           res.setHeader("Mcp-Protocol-Version", MCP_SDK_COMPAT_PROTOCOL_VERSION);
           res.setHeader("Mcp-Method", req.method || "UNKNOWN");
@@ -272323,7 +272704,7 @@ var init_serve_http = __esm({
         }
         async function handlePost(req, res) {
           const sessionId = req.headers["mcp-session-id"];
-          const body = await parseBody(req);
+          const body = await parseJsonBody(req, httpBodyLimitBytes);
           const params = body && typeof body === "object" && !Array.isArray(body) ? body.params : void 0;
           const claimlessDiscovery = !sessionId && isServerDiscoverRequest(body) && !req.headers["mcp-protocol-version"] && !req.headers["mcp-method"] && req.headers["mcp-stateless"] !== "true" && (params === void 0 || typeof params === "object" && params !== null && !Array.isArray(params) && !Object.prototype.hasOwnProperty.call(params, "_meta"));
           if (claimlessDiscovery) {
@@ -272627,7 +273008,7 @@ var init_serve_http = __esm({
                 sendJson2({ error: "Maintenance actions require POST." }, 405);
                 return;
               }
-              const bodyValue = await parseBody(req);
+              const bodyValue = await parseJsonBody(req, Math.min(httpBodyLimitBytes, 1024 * 1024));
               const body = bodyValue && typeof bodyValue === "object" && !Array.isArray(bodyValue) ? bodyValue : {};
               const { projectId: maintenanceProjectId, dataDir: maintenanceDataDir } = await resolveRequestProject(url2);
               const maintenanceStore = await getDashboardObservationStore(maintenanceDataDir);
@@ -272762,9 +273143,9 @@ var init_serve_http = __esm({
             }
             if (apiPath === "/stats") {
               const { projectId: statsProjectId, dataDir: statsDataDir } = await resolveRequestProject(url2);
-              const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
-              await initGraphStore2(statsDataDir);
-              const graph = { entities: getGraphStore2().loadEntities(), relations: getGraphStore2().loadRelations() };
+              const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+              const gStore = await initGraphStore2(statsDataDir, statsProjectId);
+              const graph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
               const observations2 = await loadDashboardProjectObservations(statsDataDir, statsProjectId, "active");
               const feedback = await loadProjectFeedback(statsDataDir, statsProjectId);
               const statsStore = await getDashboardObservationStore(statsDataDir);
@@ -272926,9 +273307,9 @@ var init_serve_http = __esm({
             }
             if (apiPath === "/graph") {
               const { projectId: graphProjectId, dataDir: graphDataDir } = await resolveRequestProject(url2);
-              const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
-              await initGraphStore2(graphDataDir);
-              const fullGraph = { entities: getGraphStore2().loadEntities(), relations: getGraphStore2().loadRelations() };
+              const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+              const gStore = await initGraphStore2(graphDataDir, graphProjectId);
+              const fullGraph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
               const allObs = await loadDashboardProjectObservations(graphDataDir, graphProjectId, "active");
               const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
               sendJson2({ entities: scoped.entities, relations: scoped.relations });
@@ -273001,12 +273382,12 @@ var init_serve_http = __esm({
               const { projectId: kgProjectId, dataDir: kgDataDir } = await resolveRequestProject(url2);
               const { generateKnowledgeGraph: generateKnowledgeGraph2 } = await Promise.resolve().then(() => (init_knowledge_graph(), knowledge_graph_exports));
               const { initMiniSkillStore: initMiniSkillStore2, getMiniSkillStore: getMiniSkillStore2 } = await Promise.resolve().then(() => (init_mini_skill_store(), mini_skill_store_exports));
-              const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+              const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
               await initMiniSkillStore2(kgDataDir);
-              await initGraphStore2(kgDataDir);
+              const gStore = await initGraphStore2(kgDataDir, kgProjectId);
               const allObs = await loadDashboardProjectObservations(kgDataDir, kgProjectId, "active");
               const skills = await getMiniSkillStore2().loadByProject(kgProjectId);
-              const fullGraph = { entities: getGraphStore2().loadEntities(), relations: getGraphStore2().loadRelations() };
+              const fullGraph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
               const scoped = scopeKnowledgeGraphToProject(fullGraph, allObs);
               const graph = generateKnowledgeGraph2({
                 projectId: kgProjectId,
@@ -273022,7 +273403,7 @@ var init_serve_http = __esm({
               const { projectId: configProjectId } = await resolveRequestProject(url2);
               const os10 = await import("os");
               const { existsSync: existsSync36 } = await import("fs");
-              const { join: join35 } = await import("path");
+              const { join: join36 } = await import("path");
               const { loadYamlConfig: loadYamlConfig2 } = await Promise.resolve().then(() => (init_yaml_loader(), yaml_loader_exports));
               const { loadFileConfig: loadFileConfig2, loadDotenv: loadDotenv2, getLoadedEnvFiles: getLoadedEnvFiles2 } = await Promise.resolve().then(() => (init_config(), config_exports));
               const isStartupProject = configProjectId === defaultProject.id;
@@ -273036,11 +273417,11 @@ var init_serve_http = __esm({
               const home = os10.homedir();
               if (effectiveRoot) {
                 const paths = {
-                  "project memorix.yml": join35(effectiveRoot, "memorix.yml"),
-                  "user memorix.yml": join35(home, ".memorix", "memorix.yml"),
-                  "project .env": join35(effectiveRoot, ".env"),
-                  "user .env": join35(home, ".memorix", ".env"),
-                  "legacy config.json": join35(home, ".memorix", "config.json")
+                  "project memorix.yml": join36(effectiveRoot, "memorix.yml"),
+                  "user memorix.yml": join36(home, ".memorix", "memorix.yml"),
+                  "project .env": join36(effectiveRoot, ".env"),
+                  "user .env": join36(home, ".memorix", ".env"),
+                  "legacy config.json": join36(home, ".memorix", "config.json")
                 };
                 for (const [key, fpath] of Object.entries(paths)) {
                   files[key] = { exists: existsSync36(fpath), path: fpath };
@@ -273049,9 +273430,9 @@ var init_serve_http = __esm({
                 files["project memorix.yml"] = { exists: false, path: "unavailable", unavailable: true };
                 files["project .env"] = { exists: false, path: "unavailable", unavailable: true };
                 const userPaths = {
-                  "user memorix.yml": join35(home, ".memorix", "memorix.yml"),
-                  "user .env": join35(home, ".memorix", ".env"),
-                  "legacy config.json": join35(home, ".memorix", "config.json")
+                  "user memorix.yml": join36(home, ".memorix", "memorix.yml"),
+                  "user .env": join36(home, ".memorix", ".env"),
+                  "legacy config.json": join36(home, ".memorix", "config.json")
                 };
                 for (const [key, fpath] of Object.entries(userPaths)) {
                   files[key] = { exists: existsSync36(fpath), path: fpath };
@@ -273267,9 +273648,8 @@ var init_serve_http = __esm({
               } else {
                 await store2.remove(obsId);
                 try {
-                  const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
-                  await initGraphStore2(delDataDir);
-                  const gStore = getGraphStore2();
+                  const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+                  const gStore = await initGraphStore2(delDataDir, delProjectId);
                   const prefix = `[#${obsId}] `;
                   const deletions = [];
                   for (const entity of gStore.loadEntities()) {
@@ -273285,9 +273665,9 @@ var init_serve_http = __esm({
             }
             if (apiPath === "/export") {
               const { projectId: expProjectId, projectName: expProjectName, dataDir: expDataDir } = await resolveRequestProject(url2);
-              const { initGraphStore: initGraphStore2, getGraphStore: getGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
-              await initGraphStore2(expDataDir);
-              const fullGraph = { entities: getGraphStore2().loadEntities(), relations: getGraphStore2().loadRelations() };
+              const { initGraphStore: initGraphStore2 } = await Promise.resolve().then(() => (init_graph_store(), graph_store_exports));
+              const gStore = await initGraphStore2(expDataDir, expProjectId);
+              const fullGraph = { entities: gStore.loadEntities(), relations: gStore.loadRelations() };
               const observations2 = await loadDashboardProjectObservations(expDataDir, expProjectId, "active");
               const expStore = await getDashboardObservationStore(expDataDir);
               const nextId2 = await expStore.loadIdCounter();
@@ -273325,7 +273705,8 @@ var init_serve_http = __esm({
               }, 503);
               return;
             }
-            sendJson2({ error: err instanceof Error ? err.message : "Unknown error" }, 500);
+            const status = err instanceof HttpPayloadTooLargeError ? err.statusCode : 500;
+            sendJson2({ error: err instanceof Error ? err.message : "Unknown error" }, status);
           }
         }
         let httpReadyAt = null;
@@ -273337,6 +273718,14 @@ var init_serve_http = __esm({
             return;
           }
           const url2 = new URL(req.url || "/", `http://localhost:${port}`);
+          if (bindSecurity.requiresAuth && url2.pathname !== "/health" && !isAuthorizedHttpRequest(req, httpAuthToken)) {
+            res.writeHead(401, {
+              "Content-Type": "application/json",
+              "WWW-Authenticate": "Bearer"
+            });
+            res.end(JSON.stringify({ error: "Authentication required" }));
+            return;
+          }
           if (url2.pathname === "/health") {
             const { getEmbeddingRuntimeHealth: getEmbeddingRuntimeHealth2 } = await Promise.resolve().then(() => (init_provider(), provider_exports));
             const memory = process.memoryUsage();
@@ -273407,10 +273796,15 @@ var init_serve_http = __esm({
             } catch (err) {
               console.error("[memorix] HTTP handler error:", err);
               if (!res.headersSent) {
-                res.writeHead(500, { "Content-Type": "application/json" });
+                const status = err instanceof HttpPayloadTooLargeError ? err.statusCode : 500;
+                const message = err instanceof Error ? err.message : "Internal server error";
+                res.writeHead(status, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({
                   jsonrpc: "2.0",
-                  error: { code: -32603, message: "Internal server error" },
+                  error: {
+                    code: status === 413 ? -32013 : -32603,
+                    message: status === 413 ? message : "Internal server error"
+                  },
                   id: null
                 }));
               }
@@ -273425,31 +273819,62 @@ var init_serve_http = __esm({
         });
         httpServer.keepAliveTimeout = 6e4;
         httpServer.headersTimeout = 65e3;
-        httpServer.listen(port, host, () => {
-          httpReadyAt = (/* @__PURE__ */ new Date()).toISOString();
-          try {
-            const memorixDir = (process.env.HOME || process.env.USERPROFILE || "").replace(/\\/g, "/") + "/.memorix";
-            mkdirSync13(memorixDir, { recursive: true });
-            writeFileSync13(memorixDir + "/background.ready", JSON.stringify({ pid: process.pid, port, readyAt: Date.now() }));
-          } catch {
+        const listenPromise = new Promise((resolve9, reject) => {
+          const onError = (error40) => {
+            if (typeof httpServer.off === "function") httpServer.off("listening", onListening);
+            reject(error40);
+          };
+          const onListening = () => {
+            if (typeof httpServer.off === "function") httpServer.off("error", onError);
+            httpReadyAt = (/* @__PURE__ */ new Date()).toISOString();
+            try {
+              const memorixDir = (process.env.HOME || process.env.USERPROFILE || "").replace(/\\/g, "/") + "/.memorix";
+              mkdirSync13(memorixDir, { recursive: true });
+              writeFileSync13(memorixDir + "/background.ready", JSON.stringify({ pid: process.pid, port, readyAt: Date.now() }));
+            } catch {
+            }
+            console.error(`[memorix] \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550`);
+            console.error(`[memorix] Mode: Control Plane (HTTP MCP + multi-session live dashboard)`);
+            console.error(`[memorix] MCP Server listening on http://${host}:${port}/mcp`);
+            console.error(`[memorix] Dashboard:     http://${host}:${port}/`);
+            console.error(`[memorix] Coordination:  http://${host}:${port}/api/team`);
+            console.error(`[memorix] Port:          ${port}`);
+            console.error(`[memorix] \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550`);
+            console.error(`[memorix] Sessions at startup: ${sessions.size} (live count available at /api/team)`);
+            console.error(`[memorix] Agents can connect via: { "transport": "http", "url": "http://localhost:${port}/mcp" }`);
+            Promise.resolve().then(() => (init_update_checker(), update_checker_exports)).then((m6) => m6.checkForUpdates()).catch(() => {
+            });
+            resolve9();
+          };
+          if (typeof httpServer.once === "function") {
+            httpServer.once("error", onError);
+            httpServer.once("listening", onListening);
+            httpServer.listen(port, host);
+          } else {
+            httpServer.listen(port, host, onListening);
           }
-          console.error(`[memorix] \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550`);
-          console.error(`[memorix] Mode: Control Plane (HTTP MCP + multi-session live dashboard)`);
-          console.error(`[memorix] MCP Server listening on http://${host}:${port}/mcp`);
-          console.error(`[memorix] Dashboard:     http://${host}:${port}/`);
-          console.error(`[memorix] Coordination:  http://${host}:${port}/api/team`);
-          console.error(`[memorix] Port:          ${port}`);
-          console.error(`[memorix] \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550`);
-          console.error(`[memorix] Sessions at startup: ${sessions.size} (live count available at /api/team)`);
-          console.error(`[memorix] Agents can connect via: { "transport": "http", "url": "http://localhost:${port}/mcp" }`);
-          Promise.resolve().then(() => (init_update_checker(), update_checker_exports)).then((m6) => m6.checkForUpdates()).catch(() => {
-          });
         });
+        try {
+          await listenPromise;
+        } catch (error40) {
+          console.error(`[memorix] HTTP server failed to listen on ${host}:${port}: ${error40 instanceof Error ? error40.message : String(error40)}`);
+          for (const store2 of dashboardObservationStores.values()) {
+            try {
+              store2.close();
+            } catch {
+            }
+          }
+          dashboardObservationStores.clear();
+          const { closeAllDatabases: closeAllDatabases2 } = await Promise.resolve().then(() => (init_sqlite_db(), sqlite_db_exports));
+          closeAllDatabases2();
+          throw error40;
+        }
         const SESSION_TIMEOUT_MS = sessionTimeoutMs;
         const gcInterval = setInterval(() => {
           maybeProbeSummary();
           const now3 = Date.now();
           forgetExpiredSessions(now3);
+          statelessBindingStore.cleanupExpired(now3);
           if (SESSION_TIMEOUT_MS === 0) return;
           for (const [sid, state] of sessions) {
             const lastActive = sessionLastActivity.get(sid) ?? 0;
@@ -273464,7 +273889,10 @@ var init_serve_http = __esm({
           }
         }, 6e4);
         gcInterval.unref();
+        let shutdownStarted = false;
         const shutdown = async () => {
+          if (shutdownStarted) return;
+          shutdownStarted = true;
           if (suppressedProbeCount > 0) {
             console.error(`[memorix] ${suppressedProbeCount} probe connection(s) suppressed during this session`);
           }
@@ -273498,7 +273926,17 @@ var init_serve_http = __esm({
               console.error(`[memorix] Error closing session ${sid}:`, err);
             }
           }
-          httpServer.close();
+          clearInterval(gcInterval);
+          clearInterval(heartbeatInterval);
+          await new Promise((resolve9) => {
+            if (!httpServer.listening) {
+              resolve9();
+              return;
+            }
+            httpServer.close(() => resolve9());
+          });
+          const { closeAllDatabases: closeAllDatabases2 } = await Promise.resolve().then(() => (init_sqlite_db(), sqlite_db_exports));
+          closeAllDatabases2();
           process.exit(0);
         };
         process.on("SIGINT", shutdown);
@@ -273537,7 +273975,13 @@ var init_serve_http = __esm({
     });
     _testing2 = {
       DEFAULT_SESSION_TIMEOUT_MS,
+      DEFAULT_HTTP_BODY_LIMIT_BYTES,
+      MAX_HTTP_BODY_LIMIT_BYTES,
+      MIN_HTTP_BODY_LIMIT_BYTES,
       parseSessionTimeoutMs,
+      parseHttpBodyLimit,
+      isLoopbackHost,
+      validateHttpBindSecurity,
       parseTcpPortOrReport
     };
   }
@@ -273988,8 +274432,10 @@ var init_journal = __esm({
 });
 
 // src/sync/policy.ts
-function syncEligibility(observation, projectId) {
-  if (observation.projectId !== projectId) return { eligible: false, reason: "other-project" };
+function syncEligibility(observation, scopeId, scope = "project") {
+  if (scope === "project" && observation.projectId !== scopeId) {
+    return { eligible: false, reason: "other-project" };
+  }
   if ((observation.visibility ?? "project") !== "project") return { eligible: false, reason: "non-project-visibility" };
   if ((observation.sharedWithAgentIds?.length ?? 0) > 0) {
     return { eligible: false, reason: "agent-targeted" };
@@ -274000,11 +274446,11 @@ function syncEligibility(observation, projectId) {
   if (observation.valueCategory === "ephemeral") return { eligible: false, reason: "ephemeral-value" };
   return { eligible: true };
 }
-function eligibleObservations(observations2, projectId) {
+function eligibleObservations(observations2, scopeId, scope = "project") {
   const eligible = [];
   let excluded = 0;
   for (const observation of observations2) {
-    if (syncEligibility(observation, projectId).eligible) eligible.push(observation);
+    if (syncEligibility(observation, scopeId, scope).eligible) eligible.push(observation);
     else excluded++;
   }
   return { eligible, excluded };
@@ -274021,13 +274467,26 @@ import { createHash as createHash22 } from "crypto";
 function syncNamespace(projectId) {
   return `project-${createHash22("sha256").update(projectId).digest("hex").slice(0, 32)}`;
 }
+function userSyncNamespace(env3 = process.env) {
+  const override = env3.MEMORIX_SYNC_USER_NAMESPACE?.trim();
+  if (!override) {
+    throw new Error("[memorix] MEMORIX_SYNC_USER_NAMESPACE is required for --scope user; use one stable per-user namespace across devices");
+  }
+  if (!isSafeSyncDeviceId(override)) {
+    throw new Error("[memorix] MEMORIX_SYNC_USER_NAMESPACE must match [A-Za-z0-9][A-Za-z0-9._-]{0,127}");
+  }
+  return `${USER_SYNC_NAMESPACE}${override}`;
+}
 function isSafeSyncDeviceId(value) {
   return /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value);
 }
+var USER_SYNC_SCOPE_ID, USER_SYNC_NAMESPACE;
 var init_namespace = __esm({
   "src/sync/namespace.ts"() {
     "use strict";
     init_esm_shims();
+    USER_SYNC_SCOPE_ID = "__user__";
+    USER_SYNC_NAMESPACE = "user-";
   }
 });
 
@@ -274038,6 +274497,7 @@ async function runSync(store2, remote, opts) {
     remote: remote.kind,
     namespace: remote.namespace,
     projectId: store2.projectId(),
+    scope: store2.scope(),
     deviceId: opts.deviceId,
     pushed: 0,
     pulledBatches: 0,
@@ -274065,7 +274525,7 @@ async function runSync(store2, remote, opts) {
       report.pending = pending.length;
       if (!opts.dryRun) {
         for (const pendingBatch of pending) {
-          validateBatches([pendingBatch.batch], store2.projectId(), remote.namespace);
+          validateBatches([pendingBatch.batch], store2.projectId(), remote.namespace, store2.scope());
           if (pendingBatch.batch.deviceId !== opts.deviceId) {
             throw new Error("[memorix] sync outbox rejected: batch belongs to another device");
           }
@@ -274077,7 +274537,7 @@ async function runSync(store2, remote, opts) {
         report.pending = 0;
       }
       const current = await store2.loadAll();
-      const filtered = eligibleObservations(current, store2.projectId());
+      const filtered = eligibleObservations(current, store2.projectId(), store2.scope());
       report.eligible = filtered.eligible.length;
       report.excluded = filtered.excluded;
       const state = await store2.loadState();
@@ -274100,7 +274560,7 @@ async function runSync(store2, remote, opts) {
             producedAt: nowIso(),
             entries: chunk.map((c6) => c6.entry)
           };
-          if (!opts.dryRun) validateBatches([batch], store2.projectId(), remote.namespace);
+          if (!opts.dryRun) validateBatches([batch], store2.projectId(), remote.namespace, store2.scope());
           report.pushed += chunk.length;
           if (!opts.dryRun) {
             const states = chunk.map((c6) => ({ ...c6.nextState, shippedSeq: sequence }));
@@ -274121,7 +274581,7 @@ async function runSync(store2, remote, opts) {
       while (hasMore) {
         const page = await remote.pull(pullSince, PULL_PAGE_SIZE, pageToken);
         report.pulledBatches += page.batches.length;
-        validateBatches(page.batches, store2.projectId(), remote.namespace);
+        validateBatches(page.batches, store2.projectId(), remote.namespace, store2.scope());
         for (const batch of page.batches) {
           if (batch.deviceId === opts.deviceId) {
             cursor.applied[batch.deviceId] = Math.max(cursor.applied[batch.deviceId] ?? 0, batch.sequence);
@@ -274191,7 +274651,7 @@ async function runSync(store2, remote, opts) {
     await remote.close();
   }
 }
-function validateBatches(batches, projectId, namespace) {
+function validateBatches(batches, projectId, namespace, scope = "project") {
   for (const batch of batches) {
     if (batch.formatVersion !== 3 || batch.projectId !== projectId || batch.namespace !== namespace) {
       throw new Error("[memorix] sync batch rejected: wrong format, project, or remote namespace");
@@ -274203,7 +274663,7 @@ function validateBatches(batches, projectId, namespace) {
       if (!entry.syncKey || entry.kind !== "upsert" && entry.kind !== "tombstone" || !entry.version || !Number.isSafeInteger(entry.version.revision) || entry.version.revision < 1 || !entry.version.writer || typeof entry.contentHash !== "string" || entry.kind === "tombstone" && (entry.row !== void 0 || entry.contentHash !== "") || entry.kind === "upsert" && (!/^[a-f0-9]{64}$/.test(entry.contentHash) || entry.row === void 0)) {
         throw new Error("[memorix] sync batch rejected: malformed change entry");
       }
-      if (entry.kind === "upsert" && (!Number.isSafeInteger(entry.row.id) || entry.row.id < 1 || !eligibleObservations([entry.row], projectId).eligible.length)) {
+      if (entry.kind === "upsert" && (!Number.isSafeInteger(entry.row.id) || entry.row.id < 1 || !eligibleObservations([entry.row], projectId, scope).eligible.length)) {
         throw new Error("[memorix] sync batch rejected: ineligible observation payload");
       }
       const incomingHash = entry.row ? contentHash(entry.row) : "";
@@ -274275,9 +274735,11 @@ var init_engine6 = __esm({
 // src/sync/store-port.ts
 import os7 from "os";
 import { randomUUID as randomUUID20 } from "crypto";
-function createSqliteSyncStore(dataDir, store2, projectId) {
+function createSqliteSyncStore(dataDir, store2, projectId, options = {}) {
   const db2 = getDatabase(dataDir);
-  ensureSyncSchema(db2, projectId);
+  const scope = options.scope ?? "project";
+  const scopeId = scope === "user" ? USER_SYNC_SCOPE_ID : projectId;
+  ensureSyncSchema(db2, scope === "user" ? LEGACY_PROJECT_ID : projectId);
   const getMeta = db2.prepare("SELECT value FROM sync_meta WHERE key = ?");
   const setMeta = db2.prepare("INSERT OR REPLACE INTO sync_meta (key, value) VALUES (?, ?)");
   const selState = db2.prepare("SELECT projectId, syncKey, obsId, revision, writer, kind, contentHash, shippedSeq FROM sync_row_state WHERE projectId = ?");
@@ -274317,7 +274779,7 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
         SET deviceId = ?, batchJson = ?
       WHERE projectId = ? AND namespace = ? AND deviceId = ? AND sequence = ?`
   );
-  const namespace = syncNamespace(projectId);
+  const namespace = scope === "user" ? userSyncNamespace() : syncNamespace(projectId);
   const deviceFingerprint = process.env.MEMORIX_SYNC_DEVICE_FINGERPRINT?.trim() || `${process.platform}|${os7.hostname()}|${os7.homedir()}`;
   function ensureDevice() {
     const row = getMeta.get(DEVICE_KEY);
@@ -274345,7 +274807,8 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
     return `cursor:${namespace}`;
   }
   return {
-    projectId: () => projectId,
+    projectId: () => scopeId,
+    scope: () => scope,
     namespace: () => namespace,
     deviceId: ensureDevice,
     assertCanPublish,
@@ -274385,14 +274848,14 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
       setMeta.run(cursorKey(), JSON.stringify(cursor));
     },
     async loadPendingBatches() {
-      return selPending.all(projectId, namespace, ensureDevice()).map((row) => ({
+      return selPending.all(scopeId, namespace, ensureDevice()).map((row) => ({
         batch: JSON.parse(row.batchJson),
         states: JSON.parse(row.statesJson)
       }));
     },
     async enqueueBatch(pending) {
       insertPending.run({
-        projectId,
+        projectId: scopeId,
         namespace,
         deviceId: pending.batch.deviceId,
         sequence: pending.batch.sequence,
@@ -274402,13 +274865,13 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
       });
     },
     async markBatchShipped(sequence) {
-      deletePending.run(projectId, namespace, ensureDevice(), sequence);
+      deletePending.run(scopeId, namespace, ensureDevice(), sequence);
     },
     async loadAll() {
-      return store2.loadByProject(projectId);
+      return scope === "user" ? store2.loadAll() : store2.loadByProject(projectId);
     },
     async loadState() {
-      const rows = selState.all(projectId);
+      const rows = selState.all(scopeId);
       const map2 = /* @__PURE__ */ new Map();
       for (const r6 of rows) map2.set(r6.syncKey, r6);
       return map2;
@@ -274422,8 +274885,10 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
     async allocateId() {
       return store2.atomic(async (tx) => {
         const nextId2 = await tx.loadIdCounter();
-        await tx.saveIdCounter(nextId2 + 1);
-        return nextId2;
+        const maxId = Number(db2.prepare("SELECT COALESCE(MAX(id), 0) AS maxId FROM observations").get()?.maxId ?? 0);
+        const allocated = Math.max(nextId2, maxId + 1);
+        await tx.saveIdCounter(allocated + 1);
+        return allocated;
       });
     },
     async applyInsert(row, state) {
@@ -274453,7 +274918,11 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
     async applyRemove(id, state) {
       await store2.atomic(async (tx) => {
         const existing = await tx.getById(id);
-        if (existing && existing.projectId !== state.projectId) {
+        const expectedProjectId = scope === "user" ? sourceProjectIdFromSyncKey(state.syncKey) : state.projectId;
+        if (!expectedProjectId) {
+          throw new Error("[memorix] sync refused to remove an observation without a project-scoped sync key");
+        }
+        if (existing && existing.projectId !== expectedProjectId) {
           throw new Error("[memorix] sync refused to remove an observation from another project");
         }
         await tx.remove(id);
@@ -274482,6 +274951,15 @@ function createSqliteSyncStore(dataDir, store2, projectId) {
     }
   };
 }
+function sourceProjectIdFromSyncKey(syncKey) {
+  const match2 = /^p:([^:]+):/.exec(syncKey);
+  if (!match2) return void 0;
+  try {
+    return decodeURIComponent(match2[1]);
+  } catch {
+    return void 0;
+  }
+}
 function ensureSyncSchema(db2, projectId) {
   db2.exec(CREATE_SYNC_TABLES);
   const columns = db2.prepare("PRAGMA table_info(sync_row_state)").all();
@@ -275392,9 +275870,30 @@ var sync_store_exports = {};
 __export(sync_store_exports, {
   default: () => sync_store_default
 });
+function parseScope(raw) {
+  const value = String(raw || "project").toLowerCase();
+  if (value === "project" || value === "user") return value;
+  throw new Error("--scope must be one of: project, user");
+}
+async function openSyncStore(scope) {
+  if (scope === "user") {
+    const dataDir2 = await getProjectDataDir(USER_SYNC_SCOPE_ID);
+    await initObservationStore(dataDir2);
+    return {
+      projectId: USER_SYNC_SCOPE_ID,
+      syncStore: createSqliteSyncStore(dataDir2, getObservationStore(), USER_SYNC_SCOPE_ID, { scope: "user" })
+    };
+  }
+  const { project, dataDir } = await getCliProjectContext();
+  await initObservationStore(dataDir);
+  return {
+    projectId: project.id,
+    syncStore: createSqliteSyncStore(dataDir, getObservationStore(), project.id)
+  };
+}
 function renderReport(report) {
   const lines = [
-    `Store sync (${report.remote}) \u2014 device ${report.deviceId}${report.dryRun ? " [dry-run]" : ""}`,
+    `Store sync (${report.remote}, scope ${report.scope}) \u2014 device ${report.deviceId}${report.dryRun ? " [dry-run]" : ""}`,
     `- Pushed changes:   ${report.pushed}`,
     `- Pulled batches:   ${report.pulledBatches}`,
     `- Applied upserts:  ${report.applied}`,
@@ -275420,9 +275919,11 @@ var init_sync_store = __esm({
     init_dist2();
     init_operator_shared();
     init_obs_store();
+    init_persistence();
     init_engine6();
     init_store_port();
     init_remote_factory();
+    init_namespace();
     sync_store_default = defineCommand({
       meta: {
         name: "sync-store",
@@ -275434,23 +275935,34 @@ var init_sync_store = __esm({
         "push-only": { type: "boolean", description: "Only push local changes", default: false },
         "pull-only": { type: "boolean", description: "Only pull remote changes", default: false },
         through: { type: "string", description: "Compaction cutoff: device=sequence,device=sequence" },
-        yes: { type: "boolean", description: "Confirm destructive remote compaction", default: false }
+        yes: { type: "boolean", description: "Confirm destructive remote compaction", default: false },
+        scope: {
+          type: "string",
+          description: "project (default: current Git project) or user (all local projects)",
+          default: "project"
+        }
       },
       run: async ({ args }) => {
         const asJson = Boolean(args.json);
         const action = args._?.[0] || "status";
+        let scope;
+        try {
+          scope = parseScope(args.scope);
+        } catch (err) {
+          emitError(err.message, asJson);
+          process.exitCode = 2;
+          return;
+        }
         if (action === "device") {
-          const { project: project2, dataDir: dataDir2 } = await getCliProjectContext();
-          await initObservationStore(dataDir2);
-          const syncStore2 = createSqliteSyncStore(dataDir2, getObservationStore(), project2.id);
           const subaction = args._?.[1] || "";
           if (subaction !== "rotate") {
             emitError('expected "memorix sync store device rotate"', asJson);
             process.exitCode = 2;
             return;
           }
+          const { projectId: projectId2, syncStore: syncStore2 } = await openSyncStore("user");
           const deviceId = syncStore2.rotateDevice();
-          emitResult({ project: project2.id, deviceId, rotated: true }, `Sync device identity rotated: ${deviceId}`, asJson);
+          emitResult({ project: projectId2, scope: "user", deviceId, rotated: true }, `Sync device identity rotated: ${deviceId}`, asJson);
           return;
         }
         if (action !== "push" && action !== "pull" && action !== "status" && action !== "compact") {
@@ -275474,10 +275986,7 @@ var init_sync_store = __esm({
           );
           return;
         }
-        const { project, dataDir } = await getCliProjectContext();
-        await initObservationStore(dataDir);
-        const obsStore = getObservationStore();
-        const syncStore = createSqliteSyncStore(dataDir, obsStore, project.id);
+        const { projectId, syncStore } = await openSyncStore(scope);
         if (action === "compact") {
           if (!args.yes && !args.dry) {
             emitError("remote compaction deletes relay events; repeat with --yes after specifying --through device=sequence", asJson);
@@ -275512,7 +276021,7 @@ var init_sync_store = __esm({
           try {
             await remote2.init({ create: false });
             const result = await remote2.compact(through, { dryRun: Boolean(args.dry) });
-            emitResult({ project: project.id, through, ...result, dryRun: Boolean(args.dry) }, `Compaction candidates: ${result.candidates}; deleted: ${result.deleted}`, asJson);
+            emitResult({ project: projectId, scope, through, ...result, dryRun: Boolean(args.dry) }, `Compaction candidates: ${result.candidates}; deleted: ${result.deleted}`, asJson);
           } catch (err) {
             emitError(err.message, asJson);
             process.exitCode = 1;
@@ -275537,7 +276046,7 @@ var init_sync_store = __esm({
               push: true,
               pull: true
             });
-            emitResult({ project: project.id, ...report }, renderReport(report), asJson);
+            emitResult({ project: projectId, ...report }, renderReport(report), asJson);
           } catch (err) {
             emitError(err.message, asJson);
             process.exitCode = 1;
@@ -275561,7 +276070,7 @@ var init_sync_store = __esm({
             push: doPush,
             pull: doPull
           });
-          emitResult({ project: project.id, ...report }, renderReport(report), asJson);
+          emitResult({ project: projectId, ...report }, renderReport(report), asJson);
         } catch (err) {
           emitError(err.message, asJson);
           process.exitCode = 1;
@@ -275623,6 +276132,32 @@ var init_sync = __esm({
           type: "boolean",
           description: "Emit machine-readable JSON output",
           default: false
+        },
+        scope: {
+          type: "string",
+          description: "Store sync scope: project (default) or user",
+          required: false,
+          default: "project"
+        },
+        "push-only": {
+          type: "boolean",
+          description: "Store sync: only push local changes",
+          required: false
+        },
+        "pull-only": {
+          type: "boolean",
+          description: "Store sync: only pull remote changes",
+          required: false
+        },
+        through: {
+          type: "string",
+          description: "Store sync compaction cutoff: device=sequence[,device=sequence]",
+          required: false
+        },
+        yes: {
+          type: "boolean",
+          description: "Store sync: confirm destructive remote compaction",
+          required: false
         }
       },
       run: async ({ args }) => {
@@ -279290,6 +279825,7 @@ var init_media = __esm({
         concepts: { type: "string", description: "Comma-separated concepts when attaching" },
         visibility: { type: "string", description: "Observation visibility when attaching" },
         prompt: { type: "string", description: "Generation prompt" },
+        "first-frame-image-url": { type: "string", description: "Public HTTPS first-frame image URL for MiniMax video generation; stored with the queued job" },
         image: { type: "string", description: "Path to a reference image for image-to-image generation" },
         model: { type: "string", description: "Provider model" },
         provider: { type: "string", description: "Audio transcription provider: openai or groq" },
@@ -279340,6 +279876,7 @@ var init_media = __esm({
                   dataDir,
                   projectId: project.id,
                   prompt: prompt2,
+                  firstFrameImageUrl: args["first-frame-image-url"],
                   model: parseMiniMaxVideoModel(args.model),
                   region: parseMiniMaxRegion(args.region),
                   duration: parseMiniMaxVideoDuration(args.duration),
@@ -280238,8 +280775,20 @@ async function doStartUnlocked(port) {
   if (healthy) {
     process.stderr.write("[OK] Control plane is running and healthy.\n");
   } else {
-    process.stderr.write("[WARN] Health check timed out \u2014 service may still be initializing.\n");
-    process.stderr.write("  Check later:  memorix background status\n");
+    process.stderr.write("[ERROR] Health check timed out; refusing to leave an unverified background state.\n");
+    if (isProcessRunning(pid)) {
+      killProcess(pid);
+      for (let i4 = 0; i4 < 10 && isProcessRunning(pid); i4++) {
+        await new Promise((r6) => setTimeout(r6, 250));
+      }
+    }
+    clearState();
+    try {
+      fs26.unlinkSync(getMemorixDir() + "/background.ready");
+    } catch {
+    }
+    process.exitCode = 1;
+    return;
   }
   const footer = [
     "",
@@ -280627,7 +281176,7 @@ import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync31, realpathSync as realpathSync2 } from "fs";
 import { mkdir as mkdir9, readFile as readFile10, writeFile as writeFile10 } from "fs/promises";
 import { basename as basename5, dirname as dirname8, resolve as resolve7 } from "path";
-import { homedir as homedir35 } from "os";
+import { homedir as homedir36 } from "os";
 function requestedAgents(agent) {
   const all = getSetupAgentTargets();
   if (!agent || agent === "all") return all;
@@ -280705,16 +281254,16 @@ function asRecordArray(value) {
   return Array.isArray(value) ? value.map(asRecord3).filter((entry) => entry !== null) : [];
 }
 function codexPluginPath() {
-  return `${homedir35()}/plugins/${CODEX_PLUGIN_NAME}`;
+  return `${homedir36()}/plugins/${CODEX_PLUGIN_NAME}`;
 }
 function codexPluginMcpPath() {
   return `${codexPluginPath()}/.mcp.json`;
 }
 function codexMarketplacePath() {
-  return `${homedir35()}/.agents/plugins/marketplace.json`;
+  return `${homedir36()}/.agents/plugins/marketplace.json`;
 }
 function codexConfigPath() {
-  return `${homedir35()}/.codex/config.toml`;
+  return `${homedir36()}/.codex/config.toml`;
 }
 function normalizeMarketplacePath(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -281029,7 +281578,7 @@ function canonicalProjectPath(projectRoot) {
   return canonical.replace(/\\/g, "/");
 }
 function getClaudeLocalConfigPath() {
-  return `${homedir35()}/.claude.json`;
+  return `${homedir36()}/.claude.json`;
 }
 function coerceMcpServer(name, value) {
   const entry = asRecord3(value);
@@ -281191,7 +281740,58 @@ async function inspectCodexPluginMcp() {
     };
   }
 }
+async function inspectOptionalGrokMcp(scope) {
+  if (scope === "project" || scope === "local") {
+    return { status: "skipped", issues: ["mcp-host-owned"], checks: [] };
+  }
+  const adapter = getMcpAdapter("grok");
+  const configPath = adapter.getConfigPath();
+  if (!existsSync31(configPath)) {
+    return {
+      status: "skipped",
+      issues: ["mcp-host-owned"],
+      checks: [{
+        scope: "global",
+        path: configPath,
+        exists: false,
+        status: "skipped",
+        issues: ["mcp-host-owned"]
+      }]
+    };
+  }
+  const content = await readFile10(configPath, "utf-8");
+  const server = adapter.parse(content).find((entry) => entry.name === "memorix");
+  if (!server) {
+    return {
+      status: "skipped",
+      issues: ["mcp-host-owned"],
+      checks: [{
+        scope: "global",
+        path: configPath,
+        exists: true,
+        status: "skipped",
+        issues: ["mcp-host-owned"]
+      }]
+    };
+  }
+  const issues = [];
+  if (!server.url && looksLikeStaleMemorixCommand(server)) issues.push("stale-command-path");
+  if (!server.url && !isRecommendedStdioServer(server)) issues.push("nonstandard-mcp-command");
+  return {
+    status: issues.length > 0 ? "repairable" : "ok",
+    issues,
+    checks: [{
+      scope: "global",
+      path: configPath,
+      exists: true,
+      status: issues.length > 0 ? "repairable" : "ok",
+      issues,
+      server: sanitizeServer(server)
+    }]
+  };
+}
 async function inspectMcp(agent, projectRoot, scope) {
+  if (agent === "grok") return inspectOptionalGrokMcp(scope);
   if (!isMcpConfigAgent(agent)) {
     return { status: "skipped", issues: ["mcp-managed-by-package"], checks: [] };
   }
@@ -281288,7 +281888,7 @@ async function inspectGuidance(agent, projectRoot, scope) {
   }
   const checks = [];
   for (const targetScope of requestedGuidanceScopes(scope)) {
-    const root = targetScope === "project" ? projectRoot : homedir35();
+    const root = targetScope === "project" ? projectRoot : homedir36();
     const rulesPath = getAgentRulesPath(agent, root, targetScope === "global");
     if (!existsSync31(rulesPath)) {
       checks.push({
@@ -281569,8 +282169,8 @@ var init_doctor = __esm({
           return;
         }
         const { existsSync: existsSync36, readFileSync: readFileSync25 } = await import("fs");
-        const { join: join35, basename: basename7 } = await import("path");
-        const { homedir: homedir37 } = await import("os");
+        const { join: join36, basename: basename7 } = await import("path");
+        const { homedir: homedir38 } = await import("os");
         const { execSync: execSync5 } = await import("child_process");
         const report = {};
         const issues = [];
@@ -281632,8 +282232,8 @@ var init_doctor = __esm({
         }
         lines.push("");
         lines.push("\u250C\u2500 Runtime Mode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-        const memorixDir = join35(homedir37(), ".memorix");
-        const bgStatePath = join35(memorixDir, "background.json");
+        const memorixDir = join36(homedir38(), ".memorix");
+        const bgStatePath = join36(memorixDir, "background.json");
         let bgRunning = false;
         let bgPort = 0;
         let bgPid = 0;
@@ -281753,7 +282353,7 @@ var init_doctor = __esm({
               }
             }
             try {
-              const cachePath = join35(memorixDir, "embedding-cache.json");
+              const cachePath = join36(memorixDir, "embedding-cache.json");
               if (existsSync36(cachePath)) {
                 const cache5 = JSON.parse(readFileSync25(cachePath, "utf-8"));
                 const cacheCount = Object.keys(cache5).length;
@@ -282007,7 +282607,7 @@ var init_doctor = __esm({
         lines.push("\u250C\u2500 Conflict Check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
         let conflictsFound = false;
         if (dataDir) {
-          const lockFile = join35(dataDir, ".memorix.lock");
+          const lockFile = join36(dataDir, ".memorix.lock");
           if (existsSync36(lockFile)) {
             try {
               const lockData = JSON.parse(readFileSync25(lockFile, "utf-8"));
@@ -284219,7 +284819,7 @@ var init_pipeline_trace = __esm({
 // src/orchestrate/worktree.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { existsSync as existsSync33, rmSync as rmSync2 } from "fs";
-import { join as join33, basename as basename6 } from "path";
+import { join as join34, basename as basename6 } from "path";
 function runGit4(cwd, args, timeout = 5e3) {
   return String(execFileSync5("git", args, {
     cwd,
@@ -284258,7 +284858,7 @@ function isManagedWorktreePath(worktreePath, worktreeBase) {
 function createWorktree(projectDir2, taskId, pipelineId) {
   const shortId2 = taskId.slice(0, 8);
   const shortPipeline = pipelineId.slice(0, 8);
-  const worktreeBase = join33(projectDir2, WORKTREE_DIR, `task-${shortId2}`);
+  const worktreeBase = join34(projectDir2, WORKTREE_DIR, `task-${shortId2}`);
   const branchBase = `pipeline/${shortPipeline}/task-${shortId2}`;
   for (let attempt = 1; attempt <= 100; attempt++) {
     const suffix = attempt === 1 ? "" : `-${attempt}`;
@@ -284348,7 +284948,7 @@ function listWorktrees(projectDir2) {
       }
     }
     if (current) worktrees.push(current);
-    const worktreeBase = join33(projectDir2, WORKTREE_DIR);
+    const worktreeBase = join34(projectDir2, WORKTREE_DIR);
     return worktrees.filter((w4) => isManagedWorktreePath(w4.path, worktreeBase));
   } catch {
     return [];
@@ -284770,16 +285370,16 @@ var init_cost_tracker = __esm({
 
 // src/orchestrate/evidence.ts
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function writeTaskEvidence(projectDir2, pipelineId, evidence) {
   try {
-    const dir = join34(projectDir2, ".pipeline", pipelineId, "evidence", evidence.taskId.slice(0, 12));
+    const dir = join35(projectDir2, ".pipeline", pipelineId, "evidence", evidence.taskId.slice(0, 12));
     mkdirSync11(dir, { recursive: true });
     if (evidence.prompt) {
-      safeWrite(join34(dir, "prompt.md"), evidence.prompt);
+      safeWrite(join35(dir, "prompt.md"), evidence.prompt);
     }
     if (evidence.tailOutput) {
-      safeWrite(join34(dir, "output.txt"), evidence.tailOutput);
+      safeWrite(join35(dir, "output.txt"), evidence.tailOutput);
     }
     if (evidence.gateResults) {
       for (const g4 of evidence.gateResults) {
@@ -284788,7 +285388,7 @@ Status: ${g4.passed ? "PASS" : "FAIL"}
 Duration: ${(g4.durationMs / 1e3).toFixed(1)}s
 
 ${g4.output}`;
-        safeWrite(join34(dir, `${g4.gate}.txt`), content);
+        safeWrite(join35(dir, `${g4.gate}.txt`), content);
       }
     }
     const resultJson = {
@@ -284802,7 +285402,7 @@ ${g4.output}`;
       tokenUsage: evidence.tokenUsage,
       costUSD: evidence.costUSD
     };
-    safeWrite(join34(dir, "result.json"), JSON.stringify(resultJson, null, 2));
+    safeWrite(join35(dir, "result.json"), JSON.stringify(resultJson, null, 2));
     return dir;
   } catch {
     return null;
@@ -284810,7 +285410,7 @@ ${g4.output}`;
 }
 function writePipelineSummary(projectDir2, summary) {
   try {
-    const dir = join34(projectDir2, ".pipeline", summary.pipelineId);
+    const dir = join35(projectDir2, ".pipeline", summary.pipelineId);
     mkdirSync11(dir, { recursive: true });
     const elapsed = (summary.elapsedMs / 1e3).toFixed(0);
     const lines = [
@@ -284831,8 +285431,8 @@ function writePipelineSummary(projectDir2, summary) {
       lines.push(`- [${status}] ${t4.taskDescription.slice(0, 80)} \u2014 ${t4.agentName}, ${dur}s${fixes}`);
     }
     const content = lines.join("\n") + "\n";
-    safeWrite(join34(dir, "summary.md"), content);
-    return join34(dir, "summary.md");
+    safeWrite(join35(dir, "summary.md"), content);
+    return join35(dir, "summary.md");
   } catch {
     return null;
   }
@@ -291211,11 +291811,11 @@ var GUIDES = {
       "memorix sync rules --action status",
       "memorix sync workspace --action scan",
       "memorix sync store status --json",
-      "memorix sync store push|pull [--dry] [--json]",
+      "memorix sync store push|pull [--dry] [--json] [--scope project|user]",
       "memorix sync store compact --dry --through device=sequence",
       "memorix sync store device rotate"
     ],
-    notes: ["Store sync is opt-in, project-scoped, and never copies the live SQLite database."]
+    notes: ["Store sync is opt-in and never copies the live SQLite database. Default scope is the current Git project; `--scope user` relays every local project."]
   },
   ingest: {
     summary: "Ingest Git and image evidence into project memory.",