memoryintel 1.0.0

package/dist/core/sectionWriter.js

@@ -0,0 +1,91 @@
+import { extractHeadings, findHeadingMatch, suggestHeading, normalizeHeading } from './headingMatch.js';
+export class SectionRejectedError extends Error {
+    section;
+    suggestion;
+    constructor(section, suggestion) {
+        super(suggestion
+            ? `Section "${section}" not found. Did you mean "${suggestion}"?`
+            : `Section "${section}" not found and no similar heading exists.`);
+        this.section = section;
+        this.suggestion = suggestion;
+    }
+}
+// Returns [startLine, endLine) of the section's content, and [headingLine] index.
+function findSectionBounds(lines, headingText) {
+    const target = normalizeHeading(headingText);
+    for (let i = 0; i < lines.length; i++) {
+        const match = /^##[ \t]+(.+?)\s*$/.exec(lines[i]);
+        if (match && normalizeHeading(match[1].trim()) === target) {
+            let end = lines.length;
+            for (let j = i + 1; j < lines.length; j++) {
+                if (/^##[ \t]+.+/.test(lines[j])) {
+                    end = j;
+                    break;
+                }
+            }
+            return { headingLine: i, contentStart: i + 1, contentEnd: end };
+        }
+    }
+    return null;
+}
+// Returns just the matched section's content block (the lines between its heading and the
+// next ## heading, or end of file), or null if no heading matches `section`.
+export function getSectionContent(markdown, section) {
+    const lines = markdown.split('\n');
+    const headings = extractHeadings(markdown);
+    const existingHeading = findHeadingMatch(headings, section);
+    if (!existingHeading)
+        return null;
+    const bounds = findSectionBounds(lines, existingHeading);
+    if (!bounds)
+        return null;
+    // Strip the trailing empty-string artifact produced by split('\n') when the section's content
+    // (or the file itself, for the last section) ends with a newline — mirrors the same stripping
+    // applySectionUpdate does when building on top of existing content for 'append'.
+    const contentLines = lines.slice(bounds.contentStart, bounds.contentEnd);
+    if (contentLines.length > 0 && contentLines[contentLines.length - 1] === '') {
+        contentLines.pop();
+    }
+    return contentLines.join('\n');
+}
+const VALID_ACTIONS = ['append', 'replace', 'create-section'];
+export function applySectionUpdate(markdown, section, action, content) {
+    // Anything that is not exactly one of the three known actions used to fall through to the
+    // append branch, so a typo'd (or hostile) action string silently wrote content anyway.
+    if (!VALID_ACTIONS.includes(action)) {
+        throw new Error(`Unknown action "${action}". Expected one of: ${VALID_ACTIONS.join(', ')}.`);
+    }
+    const lines = markdown.split('\n');
+    const headings = extractHeadings(markdown);
+    const existingHeading = findHeadingMatch(headings, section);
+    if (action === 'create-section' && !existingHeading) {
+        const needsTrailingNewline = lines.length > 0 && lines[lines.length - 1] !== '';
+        const prefix = needsTrailingNewline ? lines.join('\n') + '\n' : lines.join('\n');
+        return `${prefix}## ${section}\n${content}\n`;
+    }
+    // create-section on an existing heading degrades to append; append/replace require an existing match.
+    if (!existingHeading) {
+        const suggestion = suggestHeading(headings, section);
+        throw new SectionRejectedError(section, suggestion);
+    }
+    const bounds = findSectionBounds(lines, existingHeading);
+    const before = lines.slice(0, bounds.contentStart);
+    const existingContentLines = lines.slice(bounds.contentStart, bounds.contentEnd);
+    const after = lines.slice(bounds.contentEnd);
+    const newContentLines = action === 'replace'
+        ? [content]
+        : (() => {
+            // Preserve all interior blank lines; only strip the trailing empty string
+            // artifact produced by split('\n') when content ends with \n.
+            const filtered = existingContentLines.slice();
+            if (filtered.length > 0 && filtered[filtered.length - 1] === '') {
+                filtered.pop();
+            }
+            return [...filtered, content];
+        })();
+    const result = [...before, ...newContentLines, ...after].join('\n');
+    return result.endsWith('\n') ? result : result + '\n';
+}
+export function isNearDuplicate(existingBlock, newContent) {
+    return normalizeHeading(existingBlock).includes(normalizeHeading(newContent));
+}

package/dist/core/toon.js

@@ -0,0 +1,118 @@
+function quoteField(value) {
+    // Leading whitespace must be quoted as well: rows are written with a two-space indent, and
+    // the decoder strips a row's leading whitespace to find its first field. An unquoted
+    // ' foo' in the first column would therefore come back as 'foo'.
+    if (value.includes(',') || value.includes('"') || value.includes('\n') || /^[ \t]/.test(value)) {
+        return `"${value.replace(/"/g, '""')}"`;
+    }
+    return value;
+}
+// Parses the whole body of a TOON table (everything after the header line) into rows of fields.
+//
+// This MUST scan character-by-character across the entire text rather than splitting on '\n'
+// first: `quoteField` deliberately quotes any value containing a newline, so a row's field can
+// legitimately span several physical lines. Splitting on '\n' up front would tear such a field
+// apart and silently drop everything after its first physical line.
+function parseCsvRows(text) {
+    const rows = [];
+    let fields = [];
+    let current = '';
+    let inQuotes = false;
+    // True once any field content has been seen on the current row. Used both to strip a row's
+    // leading indentation (the encoder writes rows with a two-space prefix) and to ignore blank
+    // separator lines between rows without discarding blank lines *inside* a quoted field.
+    let rowStarted = false;
+    const endRow = () => {
+        fields.push(current);
+        rows.push(fields);
+        fields = [];
+        current = '';
+        rowStarted = false;
+    };
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inQuotes) {
+            if (ch === '"' && text[i + 1] === '"') {
+                current += '"';
+                i++;
+            }
+            else if (ch === '"') {
+                inQuotes = false;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '\r' && text[i + 1] === '\n')
+            continue; // normalize CRLF outside quotes
+        if (ch === '\n') {
+            if (rowStarted)
+                endRow();
+            continue;
+        }
+        if (!rowStarted && (ch === ' ' || ch === '\t'))
+            continue; // row indentation
+        rowStarted = true;
+        if (ch === '"') {
+            inQuotes = true;
+        }
+        else if (ch === ',') {
+            fields.push(current);
+            current = '';
+        }
+        else {
+            current += ch;
+        }
+    }
+    if (inQuotes) {
+        throw new Error('Malformed TOON table: unterminated quoted field.');
+    }
+    if (rowStarted)
+        endRow();
+    return rows;
+}
+export function encodeToonTable(rows) {
+    if (rows.length === 0)
+        return `items[0]{}:\n`;
+    const fields = Object.keys(rows[0]);
+    const header = `items[${rows.length}]{${fields.join(',')}}:`;
+    const lines = rows.map((row) => '  ' + fields.map((f) => quoteField(row[f] ?? '')).join(','));
+    return [header, ...lines].join('\n') + '\n';
+}
+// Splits off the first non-blank line (the header) and returns it plus the untouched remainder.
+function splitHeaderLine(text) {
+    let cursor = 0;
+    while (cursor < text.length) {
+        const newlineIndex = text.indexOf('\n', cursor);
+        const rawLine = newlineIndex === -1 ? text.slice(cursor) : text.slice(cursor, newlineIndex);
+        const line = rawLine.replace(/\r$/, '');
+        if (line.trim().length > 0) {
+            return { headerLine: line.trim(), body: newlineIndex === -1 ? '' : text.slice(newlineIndex + 1) };
+        }
+        if (newlineIndex === -1)
+            break;
+        cursor = newlineIndex + 1;
+    }
+    return { headerLine: '', body: '' };
+}
+export function decodeToonTable(text) {
+    const { headerLine, body } = splitHeaderLine(text);
+    const headerMatch = /^items\[(\d+)\]\{(.*)\}:$/.exec(headerLine);
+    if (!headerMatch)
+        throw new Error(`Malformed TOON table header: ${headerLine}`);
+    const count = Number(headerMatch[1]);
+    const fields = headerMatch[2].length > 0 ? headerMatch[2].split(',') : [];
+    const rawRows = parseCsvRows(body);
+    if (rawRows.length !== count) {
+        throw new Error(`Malformed TOON table: header declares ${count} row(s) but ${rawRows.length} row(s) were found.`);
+    }
+    return rawRows.map((values, rowIndex) => {
+        if (values.length !== fields.length) {
+            throw new Error(`Malformed TOON table: row ${rowIndex} has ${values.length} field(s) but the header declares ${fields.length}.`);
+        }
+        const row = {};
+        fields.forEach((f, idx) => { row[f] = values[idx]; });
+        return row;
+    });
+}

package/dist/daemon/daemonHandle.js

@@ -0,0 +1,52 @@
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { createServer } from 'node:net';
+import { ensureGlobalDir, daemonHandlePath } from './globalPaths.js';
+export function readDaemonHandle() {
+    const path = daemonHandlePath();
+    if (!existsSync(path))
+        return null;
+    return JSON.parse(readFileSync(path, 'utf-8'));
+}
+export function writeDaemonHandle(handle) {
+    ensureGlobalDir();
+    writeFileSync(daemonHandlePath(), JSON.stringify(handle, null, 2) + '\n');
+}
+export function clearDaemonHandle() {
+    const path = daemonHandlePath();
+    if (existsSync(path))
+        unlinkSync(path);
+}
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+export function pickFreePort(startPort) {
+    return new Promise((resolve, reject) => {
+        const tryPort = (port) => {
+            const tester = createServer();
+            tester.once('error', (err) => {
+                if (err.code === 'EADDRINUSE') {
+                    tester.close(() => tryPort(port + 1));
+                }
+                else {
+                    reject(err);
+                }
+            });
+            tester.once('listening', () => {
+                const address = tester.address();
+                // When startPort is 0, the OS assigns a random free port — address().port carries
+                // the real value; `port` itself would still be 0. For an explicit non-zero startPort,
+                // address().port equals it, so this is safe for both cases.
+                const boundPort = typeof address === 'object' && address !== null ? address.port : port;
+                tester.close(() => resolve(boundPort));
+            });
+            tester.listen(port, '127.0.0.1');
+        };
+        tryPort(startPort);
+    });
+}

package/dist/daemon/globalPaths.js

@@ -0,0 +1,15 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdirSync } from 'node:fs';
+export function getGlobalDir() {
+    return process.env.MEMORYINTEL_GLOBAL_DIR ?? join(homedir(), '.memoryintel');
+}
+export function ensureGlobalDir() {
+    const dir = getGlobalDir();
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+export function registryPath() { return join(getGlobalDir(), 'registry.json'); }
+export function settingsPath() { return join(getGlobalDir(), 'settings.json'); }
+export function daemonHandlePath() { return join(getGlobalDir(), 'daemon.json'); }
+export function daemonLockPath() { return join(getGlobalDir(), 'daemon.lock'); }

package/dist/daemon/health.js

@@ -0,0 +1,14 @@
+import { WRITABLE_FILES } from '../core/pathSafety.js';
+import { readIndex } from '../core/memoryIndex.js';
+import { join } from 'node:path';
+export function computeFileHealth(memoryRoot) {
+    const index = readIndex(join(memoryRoot, 'memory-index.json'));
+    const now = Date.now();
+    return WRITABLE_FILES.map((file) => {
+        const entry = index[file];
+        if (!entry)
+            return { file, lastUpdated: null, staleDays: null };
+        const staleDays = Math.floor((now - new Date(entry.lastUpdated).getTime()) / (24 * 60 * 60 * 1000));
+        return { file, lastUpdated: entry.lastUpdated, staleDays };
+    });
+}

package/dist/daemon/lifecycle.js

@@ -0,0 +1,54 @@
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { join, dirname } from 'node:path';
+import { readGlobalSettings } from './settings.js';
+import { readDaemonHandle, writeDaemonHandle, isProcessAlive } from './daemonHandle.js';
+import { ensureGlobalDir, daemonLockPath } from './globalPaths.js';
+import { withLockSync } from '../core/lock.js';
+export function shouldSpawnDaemon() {
+    if (!readGlobalSettings().dashboardEnabled)
+        return false;
+    const handle = readDaemonHandle();
+    if (!handle)
+        return true;
+    return !isProcessAlive(handle.pid);
+}
+// Not deeply unit tested — it starts a real detached process. Exercised by Task 13's
+// e2e test only insofar as `ensureDaemonRunning` decides *whether* to call it.
+export function spawnDaemonProcess() {
+    const cliPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'cli.js');
+    const child = spawn(process.execPath, [cliPath, 'daemon', 'start'], {
+        detached: true,
+        stdio: 'ignore'
+    });
+    child.unref();
+    return child.pid;
+}
+// shouldSpawnDaemon() (read handle, check liveness) and spawnDaemonProcess() (spawn a detached
+// child) are two separate steps with no atomicity between them - two `load`/`update` calls
+// running close together can both see "no live daemon" and both spawn one, and the loser's
+// daemon then has no handle pointing at it at all once the winner's write lands last. That's a
+// genuinely orphaned process with no way to discover it later short of `ps` - confirmed as the
+// root cause of exactly that happening once already on a real project. withLockSync closes the
+// gap: only one caller can be inside the check-and-spawn section at a time. It's not enough on
+// its own, though - the real daemon only writes its OWN full handle (with the real port) once
+// it's actually listening (see server.ts's startDaemon), which happens after this function has
+// already returned. A second caller arriving in that window would still see a stale/missing
+// handle and spawn again. Writing a provisional handle - same pid the child was just spawned
+// with, port unknown - closes that second gap too: isProcessAlive(handle.pid) is true the
+// instant the child exists, before it has bound a port or written anything itself, and the
+// child's own later write (same pid) just fills in the real port over this placeholder.
+export function ensureDaemonRunning() {
+    try {
+        ensureGlobalDir();
+        withLockSync(daemonLockPath(), () => {
+            if (shouldSpawnDaemon()) {
+                const pid = spawnDaemonProcess();
+                writeDaemonHandle({ pid, port: 0 });
+            }
+        });
+    }
+    catch {
+        // Best-effort only — dashboard visibility must never break the calling command.
+    }
+}

package/dist/daemon/registry.js

@@ -0,0 +1,60 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureGlobalDir, registryPath } from './globalPaths.js';
+import { readGlobalSettings } from './settings.js';
+const MARKER = 'memoryintel:managed:start';
+export function detectToolsWired(projectRoot) {
+    const tools = [];
+    // Claude Code automation comes entirely from this package's bundled plugin
+    // (hooks/hooks.json), never from writing to the project's own .claude/settings.json - init
+    // has never touched that file (see src/commands/init.ts). Checking it here was dead code: it
+    // could never be true for any project using the documented setup, which is why a real project
+    // (distilled-docs) never showed claude-code despite Claude driving every session. The
+    // Stop-hook's `.session-marker.json` (written by check-stop / resolveCheckStopMarker, see
+    // src/adapters/claudeCode.ts) only ever exists once the plugin's Stop hook has actually fired
+    // for this project - real evidence of Claude Code automation running, not just installed.
+    // Still also honor a manually-wired settings.json, for anyone who set one up by hand.
+    const claudeSettingsPath = join(projectRoot, '.claude', 'settings.json');
+    const settingsWired = existsSync(claudeSettingsPath) && readFileSync(claudeSettingsPath, 'utf-8').includes('memoryintel load');
+    const sessionMarkerPath = join(projectRoot, '.memoryintel', '.session-marker.json');
+    if (settingsWired || existsSync(sessionMarkerPath)) {
+        tools.push('claude-code');
+    }
+    if (existsSync(join(projectRoot, '.cursor', 'rules', 'memoryintel.mdc'))) {
+        tools.push('cursor');
+    }
+    const agentsPath = join(projectRoot, 'AGENTS.md');
+    if (existsSync(agentsPath) && readFileSync(agentsPath, 'utf-8').includes(MARKER)) {
+        tools.push('agents-md');
+    }
+    const geminiPath = join(projectRoot, 'GEMINI.md');
+    if (existsSync(geminiPath) && readFileSync(geminiPath, 'utf-8').includes(MARKER)) {
+        tools.push('gemini');
+    }
+    return tools;
+}
+export function readRegistry() {
+    const path = registryPath();
+    if (!existsSync(path))
+        return {};
+    const raw = readFileSync(path, 'utf-8').trim();
+    return raw.length === 0 ? {} : JSON.parse(raw);
+}
+function writeRegistry(registry) {
+    ensureGlobalDir();
+    writeFileSync(registryPath(), JSON.stringify(registry, null, 2) + '\n');
+}
+export function upsertRegistryEntry(projectRoot) {
+    if (!readGlobalSettings().dashboardEnabled)
+        return;
+    const registry = readRegistry();
+    const now = new Date().toISOString();
+    const existing = registry[projectRoot];
+    registry[projectRoot] = {
+        path: projectRoot,
+        initializedAt: existing?.initializedAt ?? now,
+        lastSessionAt: now,
+        toolsWired: detectToolsWired(projectRoot)
+    };
+    writeRegistry(registry);
+}

package/dist/daemon/server.js

@@ -0,0 +1,92 @@
+import { createServer } from 'node:http';
+import { readRegistry } from './registry.js';
+import { renderRegistryPage } from './views/registryPage.js';
+import { renderProjectPage } from './views/projectPage.js';
+import { pageShell } from './views/layout.js';
+import { pickFreePort, writeDaemonHandle, clearDaemonHandle } from './daemonHandle.js';
+import { readGlobalSettings, writeGlobalSettings } from './settings.js';
+// Loopback binding alone isn't enough for a mutating route: any browser tab already open on
+// this machine can still address 127.0.0.1:<port> regardless of which site served that tab (the
+// DNS-rebinding class of attack) - only a page's own JS can be forced to send a real Origin
+// header, a CLI caller like curl simply never sets one. Block only when Origin is present and
+// doesn't match, never on its absence alone - that would reject every legitimate non-browser
+// caller over a header browsers alone are trusted to set honestly.
+const ALLOWED_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+function isSameOriginRequest(req) {
+    const origin = req.headers.origin;
+    if (!origin)
+        return true;
+    try {
+        const originUrl = new URL(origin);
+        if (!ALLOWED_HOSTNAMES.has(originUrl.hostname))
+            return false;
+        return originUrl.host === req.headers.host;
+    }
+    catch {
+        return false;
+    }
+}
+function renderStoppedPage() {
+    return pageShell('Memory Intel — dashboard stopped', `
+<div class="eyebrow">Memory Intel</div>
+<h1>Dashboard stopped</h1>
+<p>The shared dashboard is stopped and disabled for every Memory Intel project on this machine. Run <code>memoryintel dashboard enable</code> to turn it back on, or run any <code>memoryintel</code> command and it starts itself again the next time a project needs it.</p>
+`);
+}
+export function createRequestHandler(server) {
+    return (req, res) => {
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if (req.method === 'POST' && url.pathname === '/stop') {
+            if (!isSameOriginRequest(req)) {
+                res.writeHead(403, { 'Content-Type': 'text/plain' });
+                res.end('Forbidden: Origin does not match this server');
+                return;
+            }
+            writeGlobalSettings({ ...readGlobalSettings(), dashboardEnabled: false });
+            clearDaemonHandle();
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(renderStoppedPage(), () => {
+                // Closing here, not process.exit(): this lets the response above actually finish
+                // flushing to the client first, and a process.exit() call would be untestable in-process
+                // (the daemon in a real deployment has nothing else keeping the event loop alive, so it
+                // exits on its own once the server stops accepting connections and this request
+                // completes - no explicit exit needed, and nothing abruptly drops the in-flight response
+                // the way process.exit() would).
+                server?.close();
+            });
+            return;
+        }
+        if (url.pathname === '/') {
+            const html = renderRegistryPage(readRegistry());
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(html);
+            return;
+        }
+        if (url.pathname === '/project') {
+            const path = url.searchParams.get('path');
+            if (!path) {
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end('Missing ?path=');
+                return;
+            }
+            const typeFilter = url.searchParams.get('type') ?? undefined;
+            const html = renderProjectPage(path, { typeFilter });
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(html);
+            return;
+        }
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('Not found');
+    };
+}
+export async function startDaemon(preferredPort = 4390) {
+    const port = await pickFreePort(preferredPort);
+    const server = createServer();
+    server.on('request', createRequestHandler(server));
+    await new Promise((resolve) => server.listen(port, '127.0.0.1', resolve));
+    writeDaemonHandle({ port, pid: process.pid });
+    const cleanup = () => { clearDaemonHandle(); process.exit(0); };
+    process.on('SIGTERM', cleanup);
+    process.on('SIGINT', cleanup);
+    return { port, server };
+}

package/dist/daemon/settings.js

@@ -0,0 +1,13 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { ensureGlobalDir, settingsPath } from './globalPaths.js';
+const DEFAULT_SETTINGS = { dashboardEnabled: true };
+export function readGlobalSettings() {
+    const path = settingsPath();
+    if (!existsSync(path))
+        return { ...DEFAULT_SETTINGS };
+    return JSON.parse(readFileSync(path, 'utf-8'));
+}
+export function writeGlobalSettings(settings) {
+    ensureGlobalDir();
+    writeFileSync(settingsPath(), JSON.stringify(settings, null, 2) + '\n');
+}