nexusmem 0.4.0 → 0.5.0

package/dist/cli/index.js

@@ -2,7 +2,7 @@
 
 // src/cli/index.ts
 import { Command } from "commander";
-import pc17 from "picocolors";
+import pc18 from "picocolors";
 
 // src/config/workspace.ts
 import { existsSync } from "fs";
@@ -661,163 +661,101 @@ async function gitHookStatus(target) {
   return { installed: isHookInstalled2(current), foreign: isForeignHook(current) };
 }
 
-// src/cli/commands/hook-git.ts
-import pc from "picocolors";
-async function runHookGitInstall(opts) {
-  const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
-  const result = await installGitHook(target, { force: opts.force });
-  const lines = [
-    result.changed ? `${pc.green(result.alreadyInstalled ? "updated" : "installed")} git pre-commit hook` : `${pc.dim("already up to date")}`,
-    `  hook ${target.hookPath}`
-  ];
-  if (result.appendedToForeign) {
-    lines.push(`  ${pc.yellow("appended after an existing pre-commit hook -- review")} ${target.hookPath}`);
+// src/store/deny-list.ts
+var DenyListError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DenyListError";
   }
-  lines.push(
-    "",
-    `Runs ${pc.bold("nexusmem precheck")} before each commit -- advisory only, never blocks a commit on its own.`,
-    `Run ${pc.bold("nexusmem hook git remove")} to undo this.`,
-    ""
-  );
-  process.stdout.write(lines.join("\n"));
-  return 0;
-}
-async function runHookGitRemove(opts) {
-  const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
-  const result = await removeGitHook(target);
-  process.stdout.write(
-    result.changed ? `${pc.green("removed")} nexusmem's block from ${target.hookPath}
-` : `${pc.dim("nothing to remove")} \u2014 no nexusmem block found in ${target.hookPath}
-`
-  );
-  return 0;
-}
-async function runHookGitStatus(opts) {
-  const repo = await readRepoInfo(opts.cwd);
-  const target = resolveGitHookTarget(repo.root);
-  const result = await gitHookStatus(target);
-  const statusLabel = result.installed ? pc.green("installed") : result.foreign ? pc.yellow("a foreign hook exists (not nexusmem) -- install --force to append") : pc.yellow("not installed");
-  process.stdout.write([`${pc.dim("hook  ")} ${target.hookPath}`, `${pc.dim("status")} ${statusLabel}`, ""].join("\n"));
-  return 0;
-}
-
-// src/cli/commands/hook.ts
-import pc2 from "picocolors";
-async function runHookInstall(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
-  const result = await installHook(target);
-  process.stdout.write(
-    [
-      result.changed ? `${pc2.green(result.alreadyInstalled ? "updated" : "installed")} shell hook` : `${pc2.dim("already up to date")}`,
-      `  profile ${target.profilePath}`,
-      `  log     ${target.logPath}`,
-      "",
-      `New commands in any PowerShell session using this profile will now log their timestamp, cwd and exit code.`,
-      `Open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect.`,
-      `Run ${pc2.bold("nexusmem hook remove")} to undo this.`,
-      ""
-    ].join("\n")
-  );
-  return 0;
-}
-async function runHookRemove(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
-  const result = await removeHook(target);
-  process.stdout.write(
-    result.changed ? `${pc2.green("removed")} shell hook from ${target.profilePath}
-` : `${pc2.dim("nothing to remove")} \u2014 no hook block found in ${target.profilePath}
-`
-  );
-  return 0;
-}
-async function runHookStatus(opts) {
-  const target = await resolveHookTarget(opts.profile, opts.logPath);
-  const result = await hookStatus(target);
-  process.stdout.write(
-    [
-      `${pc2.dim("profile")} ${target.profilePath}`,
-      `${pc2.dim("log    ")} ${target.logPath}`,
-      `${pc2.dim("status ")} ${result.installed ? pc2.green("installed") : pc2.yellow("not installed")}`,
-      ""
-    ].join("\n")
-  );
-  return 0;
-}
-
-// src/cli/commands/init.ts
-import { relative } from "path";
-import pc3 from "picocolors";
-
-// src/config/registry.ts
-import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir4, readFile as readFile4, rename, writeFile as writeFile4 } from "fs/promises";
-import { join as join5 } from "path";
-import { z as z2 } from "zod";
-var ENTRY_SCHEMA = z2.object({
-  projectId: z2.string().min(1),
-  root: z2.string().min(1),
-  dbPath: z2.string().min(1),
-  originUrl: z2.string().nullable().default(null),
-  /** Epoch ms of the last `init`/`sync` that recorded this entry. */
-  lastSeenAt: z2.number().int().nonnegative()
-});
-var REGISTRY_SCHEMA = z2.object({
-  version: z2.literal(1),
-  projects: z2.array(ENTRY_SCHEMA).default([])
-});
-function registryPath() {
-  return join5(globalWorkspaceDir(), "projects.json");
-}
-async function readRegistry() {
-  let raw;
-  try {
-    raw = await readFile4(registryPath(), "utf8");
-  } catch {
-    return [];
+};
+function validatePattern(input) {
+  if (input.pattern.trim().length === 0) {
+    throw new DenyListError("pattern must not be empty");
   }
-  try {
-    const parsed = REGISTRY_SCHEMA.safeParse(JSON.parse(raw));
-    if (!parsed.success) return [];
-    return [...parsed.data.projects].sort((a, b) => b.lastSeenAt - a.lastSeenAt);
-  } catch {
-    return [];
+  if (input.matchType === "regex") {
+    let compiled;
+    try {
+      compiled = new RegExp(input.pattern, input.ignoreCase ? "i" : "");
+    } catch (err) {
+      throw new DenyListError(`invalid regex: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (compiled.test("")) {
+      throw new DenyListError("regex must not match the empty string (it would deny every node)");
+    }
   }
 }
-async function readLiveRegistry() {
-  const all = await readRegistry();
-  const entries = [];
-  const missing = [];
-  for (const entry of all) {
-    (existsSync2(entry.dbPath) ? entries : missing).push(entry);
-  }
-  return { entries, missing };
+function toEntry(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    matchType: row.match_type,
+    pattern: row.pattern,
+    ignoreCase: row.ignore_case === 1,
+    reason: row.reason,
+    createdAt: row.created_at
+  };
 }
-async function recordProject(input) {
-  const existing = await readRegistry();
-  const entry = { ...input, lastSeenAt: Date.now() };
-  const projects = [entry, ...existing.filter((e) => e.projectId !== input.projectId)];
-  await writeRegistry(projects);
-  return projects;
+function listDenyListEntries(db, projectId) {
+  const rows = db.prepare(
+    `SELECT id, project_id, match_type, pattern, ignore_case, reason, created_at
+       FROM deny_list WHERE project_id = ? ORDER BY created_at ASC`
+  ).all(projectId);
+  return rows.map(toEntry);
+}
+function insertDenyListEntry(db, input) {
+  validatePattern(input);
+  const createdAt = Date.now();
+  const result = db.prepare(
+    `INSERT INTO deny_list (project_id, match_type, pattern, ignore_case, reason, created_at)
+       VALUES (@projectId, @matchType, @pattern, @ignoreCase, @reason, @createdAt)`
+  ).run({
+    projectId: input.projectId,
+    matchType: input.matchType,
+    pattern: input.pattern,
+    ignoreCase: input.ignoreCase ? 1 : 0,
+    reason: input.reason,
+    createdAt
+  });
+  return {
+    id: Number(result.lastInsertRowid),
+    projectId: input.projectId,
+    matchType: input.matchType,
+    pattern: input.pattern,
+    ignoreCase: input.ignoreCase,
+    reason: input.reason,
+    createdAt
+  };
 }
-async function forgetProjects(projectIds) {
-  const existing = await readRegistry();
-  const drop = new Set(projectIds);
-  const kept = existing.filter((e) => !drop.has(e.projectId));
-  if (kept.length === existing.length) return 0;
-  await writeRegistry(kept);
-  return existing.length - kept.length;
+function matchableText(node) {
+  return `${node.title}
+${node.body}
+${JSON.stringify(node.meta ?? {})}`;
 }
-async function writeRegistry(projects) {
-  const path = registryPath();
-  const tmp = `${path}.${process.pid}.tmp`;
-  await mkdir4(globalWorkspaceDir(), { recursive: true });
-  await writeFile4(tmp, `${JSON.stringify({ version: 1, projects }, null, 2)}
-`, "utf8");
-  await rename(tmp, path);
+function firstMatchingEntry(entries, node) {
+  if (entries.length === 0) return null;
+  const text = matchableText(node);
+  for (const entry of entries) {
+    if (entry.matchType === "literal") {
+      const haystack = entry.ignoreCase ? text.toLowerCase() : text;
+      const needle = entry.ignoreCase ? entry.pattern.toLowerCase() : entry.pattern;
+      if (haystack.includes(needle)) return entry;
+    } else {
+      const compiled = new RegExp(entry.pattern, entry.ignoreCase ? "i" : "");
+      if (compiled.test(text)) return entry;
+    }
+  }
+  return null;
 }
 
+// src/cli/commands/forget.ts
+import pc from "picocolors";
+
+// src/store/store.ts
+import Database from "better-sqlite3";
+import { mkdirSync } from "fs";
+import { dirname as dirname3 } from "path";
+import * as sqliteVec from "sqlite-vec";
+
 // src/core/ids.ts
 import { createHash } from "crypto";
 var KEY_SEP = "\0";
@@ -828,28 +766,6 @@ function makeNodeId(projectId, kind, naturalKey) {
   return sha256Hex([projectId, kind, naturalKey].join(KEY_SEP)).slice(0, 24);
 }
 
-// src/core/project.ts
-function normalizeGitUrl(url) {
-  let s = url.trim();
-  const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(s);
-  if (scp && !s.includes("://")) {
-    s = `${scp[1]}/${scp[2]}`;
-  } else {
-    s = s.replace(/^[a-z+]+:\/\//i, "").replace(/^[^@/]+@/, "");
-  }
-  return s.replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "").replace(/\/{2,}/g, "/").toLowerCase();
-}
-function makeProjectId({ root, originUrl }) {
-  const basis = originUrl ? `remote:${normalizeGitUrl(originUrl)}` : `path:${root.replace(/\\/g, "/").toLowerCase()}`;
-  return sha256Hex(basis).slice(0, 16);
-}
-
-// src/store/store.ts
-import Database from "better-sqlite3";
-import { mkdirSync } from "fs";
-import { dirname as dirname3 } from "path";
-import * as sqliteVec from "sqlite-vec";
-
 // src/store/fts.ts
 var FTS_SYNTAX = /["'()*:^{}[\]-]/g;
 var LOW_SIGNAL_TOKENS = /* @__PURE__ */ new Set(["id"]);
@@ -992,11 +908,57 @@ CREATE TABLE file_edges (
 -- future feature needs; the primary key already covers the forward direction.
 CREATE INDEX idx_file_edges_to ON file_edges (project_id, to_path);
 `;
+var V5 = `
+CREATE TABLE deny_list (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id  TEXT NOT NULL,
+  match_type  TEXT NOT NULL,
+  pattern     TEXT NOT NULL,
+  ignore_case INTEGER NOT NULL DEFAULT 0,
+  reason      TEXT,
+  created_at  INTEGER NOT NULL
+);
+CREATE INDEX idx_deny_list_project ON deny_list (project_id);
+
+CREATE TABLE mutation_audit (
+  id             INTEGER PRIMARY KEY AUTOINCREMENT,
+  action         TEXT NOT NULL,
+  project_id     TEXT NOT NULL,
+  detail         TEXT NOT NULL,
+  affected_count INTEGER NOT NULL,
+  succeeded      INTEGER NOT NULL,
+  error          TEXT,
+  started_at     INTEGER NOT NULL,
+  finished_at    INTEGER NOT NULL
+);
+CREATE INDEX idx_mutation_audit_project ON mutation_audit (project_id, started_at DESC);
+
+-- Hash-only: this table exists to prove a value was removed, not to retain a
+-- second copy of it. body/title are stored as sha256 so the record that
+-- something was forgotten never itself becomes something worth forgetting.
+CREATE TABLE tombstones (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  node_id           TEXT NOT NULL,
+  project_id        TEXT NOT NULL,
+  kind              TEXT NOT NULL,
+  source            TEXT NOT NULL,
+  ts                TEXT NOT NULL,
+  signal            REAL NOT NULL,
+  body_sha256       TEXT NOT NULL,
+  title_sha256      TEXT NOT NULL,
+  body_length       INTEGER NOT NULL,
+  deny_list_id      INTEGER NOT NULL REFERENCES deny_list (id),
+  mutation_audit_id INTEGER NOT NULL REFERENCES mutation_audit (id),
+  removed_at        INTEGER NOT NULL
+);
+CREATE INDEX idx_tombstones_project ON tombstones (project_id, removed_at DESC);
+`;
 var MIGRATIONS = [
   { version: 1, up: (db) => db.exec(V1) },
   { version: 2, up: (db) => db.exec(V2) },
   { version: 3, up: (db) => db.exec(V3) },
-  { version: 4, up: (db) => db.exec(V4) }
+  { version: 4, up: (db) => db.exec(V4) },
+  { version: 5, up: (db) => db.exec(V5) }
 ];
 var LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
 function currentSchemaVersion(db) {
@@ -1015,6 +977,13 @@ function migrate(db) {
 }
 
 // src/store/store.ts
+function parseMeta(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
 function epochOf(ts) {
   const parsed = Date.parse(ts);
   return Number.isNaN(parsed) ? Date.now() : parsed;
@@ -1095,10 +1064,20 @@ var MemoryStore = class _MemoryStore {
          previous_path = excluded.previous_path, insertions = excluded.insertions,
          deletions = excluded.deletions, is_binary = excluded.is_binary`
     );
-    const stats = { inserted: 0, updated: 0, unchanged: 0 };
+    const stats = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
+    const denyEntriesByProject = /* @__PURE__ */ new Map();
     const run = this.db.transaction((batch) => {
       const now = Date.now();
       for (const node of batch) {
+        let denyEntries = denyEntriesByProject.get(node.projectId);
+        if (!denyEntries) {
+          denyEntries = listDenyListEntries(this.db, node.projectId);
+          denyEntriesByProject.set(node.projectId, denyEntries);
+        }
+        if (firstMatchingEntry(denyEntries, node)) {
+          stats.denied += 1;
+          continue;
+        }
         const prior = exists.get(node.id);
         if (prior) {
           if (prior.body === node.body && prior.signal === node.signal && prior.title === node.title) {
@@ -1271,6 +1250,104 @@ var MemoryStore = class _MemoryStore {
       return this.db.prepare(`DELETE FROM nodes WHERE ${scope}`).run(params).changes;
     })();
   }
+  /**
+   * What `forget(projectId, otherProjectIds, input)` with these same
+   * arguments would remove, without writing anything -- the `forget` CLI
+   * command's dry-run default.
+   */
+  previewForget(projectId, otherProjectIds, input) {
+    validatePattern(input);
+    const probeEntry = { id: -1, projectId, createdAt: 0, ...input };
+    const select = this.db.prepare("SELECT project_id, source, title, body, meta FROM nodes WHERE project_id = ?");
+    const counts = /* @__PURE__ */ new Map();
+    for (const scopeId of [projectId, ...otherProjectIds]) {
+      const rows = select.all(scopeId);
+      for (const row of rows) {
+        if (!firstMatchingEntry([probeEntry], { title: row.title, body: row.body, meta: parseMeta(row.meta) })) continue;
+        const key = `${row.project_id} ${row.source}`;
+        const existing = counts.get(key);
+        if (existing) existing.count += 1;
+        else counts.set(key, { projectId: row.project_id, source: row.source, count: 1 });
+      }
+    }
+    return [...counts.values()];
+  }
+  /**
+   * Permanently deny-list a value and delete every node it currently matches
+   * across `projectId` + `otherProjectIds` (the same sweep `pruneSourceNodes`
+   * uses for a repo's stale prior identities).
+   *
+   * Unlike `pruneSourceNodes`, this doesn't just delete: the deny-list entry
+   * written here is consulted by `upsertNodes` and `reconcile.ts` on every
+   * future write, so a value forgotten today cannot be re-derived from an
+   * append-only source (the shell-hook log, a full transcript re-read) on a
+   * later `sync --rebuild`. Each removed node leaves a hash-only tombstone
+   * (never the content itself) and the whole operation writes one
+   * `mutation_audit` row, whether or not anything matched -- pre-emptively
+   * blocking a value that hasn't appeared yet is a valid, auditable call.
+   */
+  forget(projectId, otherProjectIds, input) {
+    return this.db.transaction(() => {
+      const entry = insertDenyListEntry(this.db, { ...input, projectId });
+      const startedAt = Date.now();
+      const auditId = Number(
+        this.db.prepare(
+          `INSERT INTO mutation_audit (action, project_id, detail, affected_count, succeeded, error, started_at, finished_at)
+             VALUES ('forget', @projectId, @detail, 0, 1, NULL, @startedAt, @startedAt)`
+        ).run({
+          projectId,
+          detail: JSON.stringify({
+            pattern: input.pattern,
+            matchType: input.matchType,
+            ignoreCase: input.ignoreCase,
+            reason: input.reason,
+            scopeProjectIds: [projectId, ...otherProjectIds]
+          }),
+          startedAt
+        }).lastInsertRowid
+      );
+      const select = this.db.prepare(
+        "SELECT id, kind, project_id, source, ts, signal, title, body, meta FROM nodes WHERE project_id = ?"
+      );
+      const dropEmbedding = this.db.prepare("DELETE FROM nodes_vec WHERE rowid = (SELECT rowid FROM nodes WHERE id = ?)");
+      const deleteNode = this.db.prepare("DELETE FROM nodes WHERE id = ?");
+      const insertTombstone = this.db.prepare(
+        `INSERT INTO tombstones
+           (node_id, project_id, kind, source, ts, signal, body_sha256, title_sha256, body_length, deny_list_id, mutation_audit_id, removed_at)
+         VALUES (@nodeId, @projectId, @kind, @source, @ts, @signal, @bodySha256, @titleSha256, @bodyLength, @denyListId, @mutationAuditId, @removedAt)`
+      );
+      let removed = 0;
+      for (const scopeId of [projectId, ...otherProjectIds]) {
+        const rows = select.all(scopeId);
+        for (const row of rows) {
+          if (!firstMatchingEntry([entry], { title: row.title, body: row.body, meta: parseMeta(row.meta) })) continue;
+          dropEmbedding.run(row.id);
+          insertTombstone.run({
+            nodeId: row.id,
+            projectId: row.project_id,
+            kind: row.kind,
+            source: row.source,
+            ts: row.ts,
+            signal: row.signal,
+            bodySha256: sha256Hex(row.body),
+            titleSha256: sha256Hex(row.title),
+            bodyLength: row.body.length,
+            denyListId: entry.id,
+            mutationAuditId: auditId,
+            removedAt: Date.now()
+          });
+          deleteNode.run(row.id);
+          removed += 1;
+        }
+      }
+      this.db.prepare("UPDATE mutation_audit SET affected_count = ?, finished_at = ? WHERE id = ?").run(removed, Date.now(), auditId);
+      return { removed, entryId: entry.id, auditId };
+    })();
+  }
+  /** Active deny-list entries for one project, oldest first. */
+  listDenyList(projectId) {
+    return listDenyListEntries(this.db, projectId);
+  }
   /**
    * Replace this project's entire `file_edges` snapshot in one transaction.
    *
@@ -1407,6 +1484,251 @@ var MemoryStore = class _MemoryStore {
   }
 };
 
+// src/core/project.ts
+function normalizeGitUrl(url) {
+  let s = url.trim();
+  const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(s);
+  if (scp && !s.includes("://")) {
+    s = `${scp[1]}/${scp[2]}`;
+  } else {
+    s = s.replace(/^[a-z+]+:\/\//i, "").replace(/^[^@/]+@/, "");
+  }
+  return s.replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "").replace(/\/{2,}/g, "/").toLowerCase();
+}
+function makeProjectId({ root, originUrl }) {
+  const basis = originUrl ? `remote:${normalizeGitUrl(originUrl)}` : `path:${root.replace(/\\/g, "/").toLowerCase()}`;
+  return sha256Hex(basis).slice(0, 16);
+}
+
+// src/cli/context.ts
+async function loadContext(cwd) {
+  const repo = await readRepoInfo(cwd);
+  const ws = resolveWorkspace(repo.root);
+  const config = await readConfig(ws);
+  return { repo, ws, projectId: makeProjectId({ root: repo.root, originUrl: repo.originUrl }), config };
+}
+
+// src/cli/commands/forget.ts
+async function runForget(opts) {
+  const { ws, projectId } = await loadContext(opts.cwd);
+  const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
+  const store = MemoryStore.open(ws.dbPath);
+  try {
+    if (opts.list) {
+      const entries = store.listDenyList(projectId);
+      if (entries.length === 0) {
+        out(`${pc.dim("forget --list")} no active deny-list entries for this project
+`);
+        return 0;
+      }
+      out(
+        [
+          `${pc.dim("deny-list entries")} (${entries.length}):`,
+          ...entries.map(
+            (e) => `  #${e.id} ${e.matchType === "regex" ? pc.dim("/") + e.pattern + pc.dim("/") : JSON.stringify(e.pattern)}${e.ignoreCase ? pc.dim(" (case-insensitive)") : ""}${e.reason ? pc.dim(` -- ${e.reason}`) : ""}`
+          ),
+          ""
+        ].join("\n")
+      );
+      return 0;
+    }
+    if (!opts.value) {
+      throw new DenyListError("a value is required (or pass --list to see active deny-list entries)");
+    }
+    const input = {
+      matchType: opts.regex ? "regex" : "literal",
+      pattern: opts.value,
+      ignoreCase: opts.ignoreCase ?? false,
+      reason: opts.reason ?? null
+    };
+    const otherProjectIds = store.listOtherProjectIds(projectId);
+    const scopeIds = [projectId, ...otherProjectIds];
+    if (!opts.yes) {
+      const preview = store.previewForget(projectId, otherProjectIds, input);
+      const total = preview.reduce((sum, p) => sum + p.count, 0);
+      if (total === 0) {
+        out(`${pc.dim("forget")} no node(s) currently match this value -- re-run with --yes to deny-list it anyway (blocks future ingest)
+`);
+        return 0;
+      }
+      const describe = (p) => `  ${pc.dim(p.source)}${p.projectId !== projectId ? pc.dim(` (prior identity ${p.projectId.slice(0, 8)})`) : ""}: ${p.count} node(s)`;
+      out(
+        [
+          `${pc.yellow("would remove")} ${total} node(s):`,
+          ...preview.map(describe),
+          pc.dim("re-run with --yes to permanently deny-list this value and delete these node(s) -- this cannot be undone"),
+          ""
+        ].join("\n")
+      );
+      return 0;
+    }
+    const result = store.forget(projectId, otherProjectIds, input);
+    const identityPart = otherProjectIds.length > 0 ? `, ${scopeIds.length} project identit${scopeIds.length === 1 ? "y" : "ies"}` : "";
+    out(`${pc.green("forgotten")} ${result.removed} node(s) deleted${identityPart}, deny-list entry #${result.entryId} written
+`);
+    return 0;
+  } finally {
+    store.close();
+  }
+}
+
+// src/cli/commands/hook-git.ts
+import pc2 from "picocolors";
+async function runHookGitInstall(opts) {
+  const repo = await readRepoInfo(opts.cwd);
+  const target = resolveGitHookTarget(repo.root);
+  const result = await installGitHook(target, { force: opts.force });
+  const lines = [
+    result.changed ? `${pc2.green(result.alreadyInstalled ? "updated" : "installed")} git pre-commit hook` : `${pc2.dim("already up to date")}`,
+    `  hook ${target.hookPath}`
+  ];
+  if (result.appendedToForeign) {
+    lines.push(`  ${pc2.yellow("appended after an existing pre-commit hook -- review")} ${target.hookPath}`);
+  }
+  lines.push(
+    "",
+    `Runs ${pc2.bold("nexusmem precheck")} before each commit -- advisory only, never blocks a commit on its own.`,
+    `Run ${pc2.bold("nexusmem hook git remove")} to undo this.`,
+    ""
+  );
+  process.stdout.write(lines.join("\n"));
+  return 0;
+}
+async function runHookGitRemove(opts) {
+  const repo = await readRepoInfo(opts.cwd);
+  const target = resolveGitHookTarget(repo.root);
+  const result = await removeGitHook(target);
+  process.stdout.write(
+    result.changed ? `${pc2.green("removed")} nexusmem's block from ${target.hookPath}
+` : `${pc2.dim("nothing to remove")} \u2014 no nexusmem block found in ${target.hookPath}
+`
+  );
+  return 0;
+}
+async function runHookGitStatus(opts) {
+  const repo = await readRepoInfo(opts.cwd);
+  const target = resolveGitHookTarget(repo.root);
+  const result = await gitHookStatus(target);
+  const statusLabel = result.installed ? pc2.green("installed") : result.foreign ? pc2.yellow("a foreign hook exists (not nexusmem) -- install --force to append") : pc2.yellow("not installed");
+  process.stdout.write([`${pc2.dim("hook  ")} ${target.hookPath}`, `${pc2.dim("status")} ${statusLabel}`, ""].join("\n"));
+  return 0;
+}
+
+// src/cli/commands/hook.ts
+import pc3 from "picocolors";
+async function runHookInstall(opts) {
+  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const result = await installHook(target);
+  process.stdout.write(
+    [
+      result.changed ? `${pc3.green(result.alreadyInstalled ? "updated" : "installed")} shell hook` : `${pc3.dim("already up to date")}`,
+      `  profile ${target.profilePath}`,
+      `  log     ${target.logPath}`,
+      "",
+      `New commands in any PowerShell session using this profile will now log their timestamp, cwd and exit code.`,
+      `Open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect.`,
+      `Run ${pc3.bold("nexusmem hook remove")} to undo this.`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+async function runHookRemove(opts) {
+  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const result = await removeHook(target);
+  process.stdout.write(
+    result.changed ? `${pc3.green("removed")} shell hook from ${target.profilePath}
+` : `${pc3.dim("nothing to remove")} \u2014 no hook block found in ${target.profilePath}
+`
+  );
+  return 0;
+}
+async function runHookStatus(opts) {
+  const target = await resolveHookTarget(opts.profile, opts.logPath);
+  const result = await hookStatus(target);
+  process.stdout.write(
+    [
+      `${pc3.dim("profile")} ${target.profilePath}`,
+      `${pc3.dim("log    ")} ${target.logPath}`,
+      `${pc3.dim("status ")} ${result.installed ? pc3.green("installed") : pc3.yellow("not installed")}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+
+// src/cli/commands/init.ts
+import { relative } from "path";
+import pc4 from "picocolors";
+
+// src/config/registry.ts
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir4, readFile as readFile4, rename, writeFile as writeFile4 } from "fs/promises";
+import { join as join5 } from "path";
+import { z as z2 } from "zod";
+var ENTRY_SCHEMA = z2.object({
+  projectId: z2.string().min(1),
+  root: z2.string().min(1),
+  dbPath: z2.string().min(1),
+  originUrl: z2.string().nullable().default(null),
+  /** Epoch ms of the last `init`/`sync` that recorded this entry. */
+  lastSeenAt: z2.number().int().nonnegative()
+});
+var REGISTRY_SCHEMA = z2.object({
+  version: z2.literal(1),
+  projects: z2.array(ENTRY_SCHEMA).default([])
+});
+function registryPath() {
+  return join5(globalWorkspaceDir(), "projects.json");
+}
+async function readRegistry() {
+  let raw;
+  try {
+    raw = await readFile4(registryPath(), "utf8");
+  } catch {
+    return [];
+  }
+  try {
+    const parsed = REGISTRY_SCHEMA.safeParse(JSON.parse(raw));
+    if (!parsed.success) return [];
+    return [...parsed.data.projects].sort((a, b) => b.lastSeenAt - a.lastSeenAt);
+  } catch {
+    return [];
+  }
+}
+async function readLiveRegistry() {
+  const all = await readRegistry();
+  const entries = [];
+  const missing = [];
+  for (const entry of all) {
+    (existsSync2(entry.dbPath) ? entries : missing).push(entry);
+  }
+  return { entries, missing };
+}
+async function recordProject(input) {
+  const existing = await readRegistry();
+  const entry = { ...input, lastSeenAt: Date.now() };
+  const projects = [entry, ...existing.filter((e) => e.projectId !== input.projectId)];
+  await writeRegistry(projects);
+  return projects;
+}
+async function forgetProjects(projectIds) {
+  const existing = await readRegistry();
+  const drop = new Set(projectIds);
+  const kept = existing.filter((e) => !drop.has(e.projectId));
+  if (kept.length === existing.length) return 0;
+  await writeRegistry(kept);
+  return existing.length - kept.length;
+}
+async function writeRegistry(projects) {
+  const path = registryPath();
+  const tmp = `${path}.${process.pid}.tmp`;
+  await mkdir4(globalWorkspaceDir(), { recursive: true });
+  await writeFile4(tmp, `${JSON.stringify({ version: 1, projects }, null, 2)}
+`, "utf8");
+  await rename(tmp, path);
+}
+
 // src/cli/commands/init.ts
 async function runInit(opts) {
   const out = opts.out ?? ((chunk2) => void process.stdout.write(chunk2));
@@ -1417,9 +1739,9 @@ async function runInit(opts) {
   if (already && !opts.force) {
     const existing = await readConfig(ws);
     process.stderr.write(
-      `${pc3.yellow("already initialized")} ${relative(process.cwd(), ws.configPath) || ws.configPath}
-  project ${pc3.cyan(existing.projectId)}
-  use ${pc3.bold("--force")} to reset the config (the database is kept)
+      `${pc4.yellow("already initialized")} ${relative(process.cwd(), ws.configPath) || ws.configPath}
+  project ${pc4.cyan(existing.projectId)}
+  use ${pc4.bold("--force")} to reset the config (the database is kept)
 `
     );
     return 0;
@@ -1436,14 +1758,14 @@ async function runInit(opts) {
   }
   await recordProject({ projectId, root: repo.root, dbPath: ws.dbPath, originUrl: repo.originUrl });
   const lines = [
-    `${pc3.green("initialized")} ${ws.dir}`,
-    `  project  ${pc3.cyan(projectId)}`,
+    `${pc4.green("initialized")} ${ws.dir}`,
+    `  project  ${pc4.cyan(projectId)}`,
     `  repo     ${repo.root}`,
-    `  branch   ${repo.branch ?? pc3.yellow("(detached)")}`,
+    `  branch   ${repo.branch ?? pc4.yellow("(detached)")}`,
     `  schema   v${LATEST_SCHEMA_VERSION}`
   ];
   if (opts.enableConversation) {
-    lines.push(`  ${pc3.yellow("conversation source enabled")} -- transcripts will be redacted-but-indexed on sync`);
+    lines.push(`  ${pc4.yellow("conversation source enabled")} -- transcripts will be redacted-but-indexed on sync`);
   }
   if (opts.hook) {
     try {
@@ -1451,26 +1773,26 @@ async function runInit(opts) {
       const result = await installHook(target);
       lines.push(
         "",
-        `${pc3.green(result.changed ? "installed" : "already installed")} shell hook`,
+        `${pc4.green(result.changed ? "installed" : "already installed")} shell hook`,
         `  profile ${target.profilePath}`,
         `  log     ${target.logPath}`,
         `  open a new PowerShell window (or run \`. $PROFILE\`) for it to take effect`
       );
     } catch (err) {
       if (err instanceof ProfileNotFoundError) {
-        lines.push("", `${pc3.yellow("hook not installed")} ${err.message}`);
+        lines.push("", `${pc4.yellow("hook not installed")} ${err.message}`);
       } else {
         throw err;
       }
     }
   }
-  lines.push("", `Next: ${pc3.bold("nexusmem sync")}`, "");
+  lines.push("", `Next: ${pc4.bold("nexusmem sync")}`, "");
   out(lines.join("\n"));
   return 0;
 }
 
 // src/cli/commands/projects.ts
-import pc4 from "picocolors";
+import pc5 from "picocolors";
 async function runProjects(opts) {
   const { entries, missing } = await readLiveRegistry();
   const rows = entries.map((entry) => {
@@ -1489,7 +1811,7 @@ async function runProjects(opts) {
   });
   if (opts.prune) {
     const removed = await forgetProjects(missing.map((entry) => entry.projectId));
-    process.stderr.write(`${pc4.yellow("pruned")} ${removed} project(s) whose database is gone
+    process.stderr.write(`${pc5.yellow("pruned")} ${removed} project(s) whose database is gone
 `);
   }
   if (opts.json) {
@@ -1497,28 +1819,28 @@ async function runProjects(opts) {
 `);
     return 0;
   }
-  process.stderr.write(`${pc4.dim("registry")} ${registryPath()}
+  process.stderr.write(`${pc5.dim("registry")} ${registryPath()}
 
 `);
   if (rows.length === 0) {
-    process.stderr.write(`${pc4.yellow("no projects registered")} -- run ${pc4.bold("nexusmem sync")} in a repository
+    process.stderr.write(`${pc5.yellow("no projects registered")} -- run ${pc5.bold("nexusmem sync")} in a repository
 `);
     return 0;
   }
   for (const row of rows) {
     const seen = new Date(row.lastSeenAt).toISOString().slice(0, 16).replace("T", " ");
-    const count = row.nodes === null ? pc4.yellow("unreadable") : `${row.nodes} node(s)`;
-    process.stdout.write(`${pc4.cyan(row.projectId.slice(0, 8))}  ${row.root}
-    ${pc4.dim(`${count}, last seen ${seen}`)}
+    const count = row.nodes === null ? pc5.yellow("unreadable") : `${row.nodes} node(s)`;
+    process.stdout.write(`${pc5.cyan(row.projectId.slice(0, 8))}  ${row.root}
+    ${pc5.dim(`${count}, last seen ${seen}`)}
 `);
   }
   if (!opts.prune && missing.length > 0) {
     process.stderr.write(
       `
-${pc4.yellow(`${missing.length} registered project(s) have no database on disk`)} ${pc4.dim("-- run with --prune to forget them")}
+${pc5.yellow(`${missing.length} registered project(s) have no database on disk`)} ${pc5.dim("-- run with --prune to forget them")}
 `
     );
-    for (const entry of missing) process.stderr.write(`    ${pc4.dim(entry.root)}
+    for (const entry of missing) process.stderr.write(`    ${pc5.dim(entry.root)}
 `);
   }
   return 0;
@@ -2068,7 +2390,7 @@ var OllamaEmbeddingProvider = class {
 };
 
 // src/cli/commands/sync.ts
-import pc5 from "picocolors";
+import pc6 from "picocolors";
 
 // src/conversation/chunk.ts
 var HEADING_LINE = /^#{1,6}\s+(.+)$/;
@@ -3376,7 +3698,7 @@ async function collectAvailableShellHistory(opts = {}) {
 }
 
 // src/store/reconcile.ts
-function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, computeNaturalKey) {
+function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, computeNaturalKey, denyEntries) {
   const rows = source ? db.prepare("SELECT * FROM nodes WHERE project_id = ? AND kind = ? AND source = ?").all(oldProjectId, kind, source) : db.prepare("SELECT * FROM nodes WHERE project_id = ? AND kind = ?").all(oldProjectId, kind);
   const nodeExists = db.prepare("SELECT 1 FROM nodes WHERE id = ?");
   const insertNode = db.prepare(
@@ -3393,6 +3715,7 @@ function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, com
   let migrated = 0;
   let deduped = 0;
   let skipped = 0;
+  let denied = 0;
   for (const row of rows) {
     let meta;
     try {
@@ -3406,6 +3729,12 @@ function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, com
       skipped += 1;
       continue;
     }
+    if (firstMatchingEntry(denyEntries, { title: row.title, body: row.body, meta })) {
+      dropEmbedding.run(row.id);
+      deleteNode.run(row.id);
+      denied += 1;
+      continue;
+    }
     const newId = makeNodeId(newProjectId, kind, naturalKey);
     if (nodeExists.get(newId)) {
       deduped += 1;
@@ -3438,17 +3767,19 @@ function recomputeByNaturalKey(db, oldProjectId, newProjectId, kind, source, com
     dropEmbedding.run(row.id);
     deleteNode.run(row.id);
   }
-  return { migrated, deduped, skipped };
+  return { migrated, deduped, skipped, denied };
 }
 function reconcileProjectId(db, oldProjectId, newProjectId) {
   return db.transaction(() => {
+    const denyEntries = listDenyListEntries(db, newProjectId);
     const sessions = recomputeByNaturalKey(
       db,
       oldProjectId,
       newProjectId,
       "session_summary",
       null,
-      (_row, meta) => typeof meta.sessionKey === "string" ? meta.sessionKey : null
+      (_row, meta) => typeof meta.sessionKey === "string" ? meta.sessionKey : null,
+      denyEntries
     );
     const hookShell = recomputeByNaturalKey(
       db,
@@ -3456,15 +3787,38 @@ function reconcileProjectId(db, oldProjectId, newProjectId) {
       newProjectId,
       "shell_command",
       "shell:pwsh-hook",
-      (row, meta) => typeof meta.command === "string" ? `pwsh-hook:${row.ts}:${sha256Hex(meta.command).slice(0, 12)}` : null
+      (row, meta) => typeof meta.command === "string" ? `pwsh-hook:${row.ts}:${sha256Hex(meta.command).slice(0, 12)}` : null,
+      denyEntries
     );
+    let deniedConversationTurns = 0;
+    if (denyEntries.length > 0) {
+      const conversationTurns = db.prepare(`SELECT id, title, body, meta FROM nodes WHERE project_id = ? AND kind = 'conversation_turn'`).all(oldProjectId);
+      if (conversationTurns.length > 0) {
+        const dropEmbedding = db.prepare("DELETE FROM nodes_vec WHERE rowid = (SELECT rowid FROM nodes WHERE id = ?)");
+        const deleteNode = db.prepare("DELETE FROM nodes WHERE id = ?");
+        for (const row of conversationTurns) {
+          let meta;
+          try {
+            meta = JSON.parse(row.meta);
+          } catch {
+            meta = {};
+          }
+          if (firstMatchingEntry(denyEntries, { title: row.title, body: row.body, meta })) {
+            dropEmbedding.run(row.id);
+            deleteNode.run(row.id);
+            deniedConversationTurns += 1;
+          }
+        }
+      }
+    }
     const reassigned = db.prepare(`UPDATE nodes SET project_id = ? WHERE project_id = ? AND kind = 'conversation_turn'`).run(newProjectId, oldProjectId).changes;
     return {
       oldProjectId,
       migrated: sessions.migrated + hookShell.migrated,
       reassigned,
       deduped: sessions.deduped + hookShell.deduped,
-      skipped: sessions.skipped + hookShell.skipped
+      skipped: sessions.skipped + hookShell.skipped,
+      denied: sessions.denied + hookShell.denied + deniedConversationTurns
     };
   })();
 }
@@ -3637,14 +3991,6 @@ ${node.body}`)
   };
 }
 
-// src/cli/context.ts
-async function loadContext(cwd) {
-  const repo = await readRepoInfo(cwd);
-  const ws = resolveWorkspace(repo.root);
-  const config = await readConfig(ws);
-  return { repo, ws, projectId: makeProjectId({ root: repo.root, originUrl: repo.originUrl }), config };
-}
-
 // src/cli/commands/sync.ts
 var BATCH_SIZE = 500;
 var PROGRESS_THRESHOLD = 200;
@@ -3654,29 +4000,30 @@ function addStats(into, from) {
   into.inserted += from.inserted;
   into.updated += from.updated;
   into.unchanged += from.unchanged;
+  into.denied += from.denied;
 }
 async function syncGit(store, projectId, opts, repo, config, log) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   if (!repo.head) {
-    log(`${pc5.yellow("git")} skipped -- repository has no commits yet`);
+    log(`${pc6.yellow("git")} skipped -- repository has no commits yet`);
     return { totals, seen: 0 };
   }
   if (!config.sources.git.enabled) {
-    log(`${pc5.dim("git")} disabled in config`);
+    log(`${pc6.dim("git")} disabled in config`);
     return { totals, seen: 0 };
   }
   let cursor = opts.full || opts.rebuild ? null : store.getSyncCursor(projectId, GIT_SOURCE);
   if (cursor && !await isAncestor(repo.root, cursor, repo.head)) {
-    log(`${pc5.yellow("git cursor stale")} ${cursor.slice(0, 7)} is not an ancestor of HEAD \u2014 falling back to a full walk`);
+    log(`${pc6.yellow("git cursor stale")} ${cursor.slice(0, 7)} is not an ancestor of HEAD \u2014 falling back to a full walk`);
     cursor = null;
   }
   if (cursor === repo.head) {
-    log(`${pc5.green("git up to date")} at ${repo.head.slice(0, 7)}`);
+    log(`${pc6.green("git up to date")} at ${repo.head.slice(0, 7)}`);
     store.setSyncCursor(projectId, GIT_SOURCE, repo.head);
     return { totals, seen: 0 };
   }
   log(
-    `${pc5.dim("git syncing")} ${repo.branch ?? "HEAD"} ${cursor ? `${cursor.slice(0, 7)}..${repo.head.slice(0, 7)}` : "(full history)"}`
+    `${pc6.dim("git syncing")} ${repo.branch ?? "HEAD"} ${cursor ? `${cursor.slice(0, 7)}..${repo.head.slice(0, 7)}` : "(full history)"}`
   );
   let batch = [];
   let seen = 0;
@@ -3684,7 +4031,7 @@ async function syncGit(store, projectId, opts, repo, config, log) {
     if (batch.length === 0) return;
     addStats(totals, store.upsertNodes(batch));
     batch = [];
-    log(`  ${pc5.dim(`${seen} commits read, ${totals.inserted} new`)}`);
+    log(`  ${pc6.dim(`${seen} commits read, ${totals.inserted} new`)}`);
   };
   const nodes = collectGitCommits(repo.root, projectId, {
     afterCommit: cursor,
@@ -3703,15 +4050,15 @@ async function syncGit(store, projectId, opts, repo, config, log) {
   return { totals, seen };
 }
 async function syncDiffs(store, projectId, opts, repo, config, log) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   if (!repo.head) return { totals, seen: 0 };
   if (!config.sources.diff.enabled) {
-    log(`${pc5.dim("diff")} disabled in config`);
+    log(`${pc6.dim("diff")} disabled in config`);
     return { totals, seen: 0 };
   }
   let cursor = opts.full || opts.rebuild ? null : store.getSyncCursor(projectId, DIFF_SOURCE);
   if (cursor && !await isAncestor(repo.root, cursor, repo.head)) {
-    log(`${pc5.yellow("diff cursor stale")} ${cursor.slice(0, 7)} is not an ancestor of HEAD \u2014 falling back to a bounded walk`);
+    log(`${pc6.yellow("diff cursor stale")} ${cursor.slice(0, 7)} is not an ancestor of HEAD \u2014 falling back to a bounded walk`);
     cursor = null;
   }
   if (cursor === repo.head) {
@@ -3740,13 +4087,13 @@ async function syncDiffs(store, projectId, opts, repo, config, log) {
   }
   flush();
   store.setSyncCursor(projectId, DIFF_SOURCE, repo.head);
-  log(`  ${pc5.dim(`${DIFF_SOURCE}: ${seen} file diff(s) read`)}`);
+  log(`  ${pc6.dim(`${DIFF_SOURCE}: ${seen} file diff(s) read`)}`);
   return { totals, seen };
 }
 async function syncShell(store, projectId, opts, repoRoot, config, log) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   if (!config.sources.shell.enabled) {
-    log(`${pc5.dim("shell")} disabled in config`);
+    log(`${pc6.dim("shell")} disabled in config`);
     return { totals, seen: 0 };
   }
   const results = await collectAvailableShellHistory({
@@ -3755,7 +4102,7 @@ async function syncShell(store, projectId, opts, repoRoot, config, log) {
     hookCursor: store.getSyncCursor(projectId, "shell:pwsh-hook")
   });
   if (results.length === 0) {
-    log(`${pc5.dim("shell")} no history source found on this machine`);
+    log(`${pc6.dim("shell")} no history source found on this machine`);
     return { totals, seen: 0 };
   }
   let seen = 0;
@@ -3767,34 +4114,34 @@ async function syncShell(store, projectId, opts, repoRoot, config, log) {
       addStats(totals, store.upsertNodes(nodes));
     }
     store.setSyncCursor(projectId, sourceKey, result.cursorAfter ?? `scanned:${result.entries.length}`);
-    log(`  ${pc5.dim(`${sourceKey}: ${nodes.length} entr${nodes.length === 1 ? "y" : "ies"} read`)}`);
+    log(`  ${pc6.dim(`${sourceKey}: ${nodes.length} entr${nodes.length === 1 ? "y" : "ies"} read`)}`);
   }
   return { totals, seen };
 }
 var CONVERSATION_SOURCE = "conversation:claude-code";
 function syncConversation(store, projectId, turns, config, log, forceEnabled) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   const enabled = forceEnabled ?? config.sources.conversation.enabled;
   if (!enabled) {
     return { totals, seen: 0 };
   }
   if (turns.length === 0) {
-    log(`${pc5.dim("conversation")} no transcripts found`);
+    log(`${pc6.dim("conversation")} no transcripts found`);
     return { totals, seen: 0 };
   }
   const nodes = collectConversationTurns(turns, projectId, { maxBodyChars: config.limits.maxBodyChars });
   if (nodes.length > 0) addStats(totals, store.upsertNodes(nodes));
   store.setSyncCursor(projectId, CONVERSATION_SOURCE, `scanned:${nodes.length}`);
-  log(`  ${pc5.dim(`${CONVERSATION_SOURCE}: ${nodes.length} of ${turns.length} exchange(s) kept`)}`);
+  log(`  ${pc6.dim(`${CONVERSATION_SOURCE}: ${nodes.length} of ${turns.length} exchange(s) kept`)}`);
   return { totals, seen: nodes.length };
 }
 var SESSION_SOURCE = "session:claude-code";
 async function syncSessions(store, projectId, turns, config, log) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   const settings = config.sources.session;
   if (!settings.enabled) return { totals, seen: 0 };
   if (turns.length === 0) {
-    log(`${pc5.dim("session")} no transcripts found`);
+    log(`${pc6.dim("session")} no transcripts found`);
     return { totals, seen: 0 };
   }
   const result = await collectSessionSummaries(turns, projectId, new OllamaChatProvider({ model: settings.model }), {
@@ -3806,12 +4153,12 @@ async function syncSessions(store, projectId, turns, config, log) {
       const meta = store.getNodeMeta(makeNodeId(projectId, "session_summary", sessionKey));
       return typeof meta?.contentHash === "string" ? meta.contentHash : null;
     },
-    onProgress: (done, total) => log(`  ${pc5.dim(`session: summarizing ${done}/${total}`)}`)
+    onProgress: (done, total) => log(`  ${pc6.dim(`session: summarizing ${done}/${total}`)}`)
   });
   if (result.nodes.length > 0) addStats(totals, store.upsertNodes(result.nodes));
   if (result.providerUnavailable) {
     log(
-      `${pc5.dim("session")} summarization model unavailable (is Ollama running with \`${settings.model}\` pulled?) -- skipped`
+      `${pc6.dim("session")} summarization model unavailable (is Ollama running with \`${settings.model}\` pulled?) -- skipped`
     );
   } else {
     const parts = [`${result.nodes.length} summarized`];
@@ -3819,16 +4166,16 @@ async function syncSessions(store, projectId, turns, config, log) {
     if (result.deferred > 0) parts.push(`${result.deferred} queued for the next sync`);
     if (result.unsettled > 0) parts.push(`${result.unsettled} still active`);
     if (result.failed > 0) parts.push(`${result.failed} failed`);
-    log(`  ${pc5.dim(`${SESSION_SOURCE}: ${parts.join(", ")}`)}`);
+    log(`  ${pc6.dim(`${SESSION_SOURCE}: ${parts.join(", ")}`)}`);
   }
   store.setSyncCursor(projectId, SESSION_SOURCE, `scanned:${result.nodes.length}`);
   return { totals, seen: result.nodes.length };
 }
 var DOCS_SOURCE = "docs";
 async function syncDocs(store, projectId, repoRoot, config, log) {
-  const totals = { inserted: 0, updated: 0, unchanged: 0 };
+  const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
   if (!config.sources.docs.enabled) {
-    log(`${pc5.dim("docs")} disabled in config`);
+    log(`${pc6.dim("docs")} disabled in config`);
     return { totals, seen: 0 };
   }
   const { files, unreadable } = await readDocFiles(repoRoot, { include: config.sources.docs.include });
@@ -3842,23 +4189,23 @@ async function syncDocs(store, projectId, repoRoot, config, log) {
   );
   store.setSyncCursor(projectId, DOCS_SOURCE, `scanned:${nodes.length}`);
   if (files.length === 0 && unreadable.length === 0) {
-    log(`${pc5.dim("docs")} no tracked .md files found`);
+    log(`${pc6.dim("docs")} no tracked .md files found`);
   } else {
-    const prunedPart = pruned > 0 ? `, ${pc5.yellow(`${pruned} stale removed`)}` : "";
+    const prunedPart = pruned > 0 ? `, ${pc6.yellow(`${pruned} stale removed`)}` : "";
     const skippedPart = unreadable.length > 0 ? `, ${unreadable.length} unreadable (kept)` : "";
-    log(`  ${pc5.dim(`${DOCS_SOURCE}: ${nodes.length} section(s) from ${files.length} file(s)`)}${prunedPart}${pc5.dim(skippedPart)}`);
+    log(`  ${pc6.dim(`${DOCS_SOURCE}: ${nodes.length} section(s) from ${files.length} file(s)`)}${prunedPart}${pc6.dim(skippedPart)}`);
   }
   return { totals, seen: nodes.length };
 }
 async function syncStructure(store, projectId, repoRoot, config, log) {
   if (!config.sources.structure.enabled) {
-    log(`${pc5.dim("structure")} disabled in config`);
+    log(`${pc6.dim("structure")} disabled in config`);
     return { edges: 0, filesScanned: 0 };
   }
   const { edges, filesScanned, unreadable } = await collectFileEdges(repoRoot);
   store.replaceFileEdges(projectId, edges);
   const skippedPart = unreadable.length > 0 ? `, ${unreadable.length} unreadable (skipped)` : "";
-  log(`  ${pc5.dim(`structure: ${edges.length} edge(s) from ${filesScanned} file(s)`)}${pc5.dim(skippedPart)}`);
+  log(`  ${pc6.dim(`structure: ${edges.length} edge(s) from ${filesScanned} file(s)`)}${pc6.dim(skippedPart)}`);
   return { edges: edges.length, filesScanned };
 }
 var STALE_SHELL_SOURCES = ["shell:pwsh", "shell:bash", "shell:zsh"];
@@ -3875,15 +4222,15 @@ function runPruneSources(store, projectId, otherProjectIds, sources, yes, out) {
   const counts = sources.flatMap((source) => scopeIds.map((id) => ({ source, id, count: store.countSourceNodes(id, source) })));
   const total = counts.reduce((sum, c) => sum + c.count, 0);
   if (total === 0) {
-    out(`${pc5.dim("prune-source")} no node(s) match ${sources.join(", ")} -- nothing to do
+    out(`${pc6.dim("prune-source")} no node(s) match ${sources.join(", ")} -- nothing to do
 `);
     return 0;
   }
-  const describe = (c) => `  ${pc5.dim(c.source)}${c.id !== projectId ? pc5.dim(` (prior identity ${c.id.slice(0, 8)})`) : ""}: ${c.count} node(s)`;
+  const describe = (c) => `  ${pc6.dim(c.source)}${c.id !== projectId ? pc6.dim(` (prior identity ${c.id.slice(0, 8)})`) : ""}: ${c.count} node(s)`;
   if (!yes) {
     const lines = counts.filter((c) => c.count > 0).map(describe);
     out(
-      [`${pc5.yellow("would remove")} ${total} node(s):`, ...lines, pc5.dim("re-run with --yes to actually delete these -- this cannot be undone"), ""].join(
+      [`${pc6.yellow("would remove")} ${total} node(s):`, ...lines, pc6.dim("re-run with --yes to actually delete these -- this cannot be undone"), ""].join(
         "\n"
       )
     );
@@ -3892,7 +4239,7 @@ function runPruneSources(store, projectId, otherProjectIds, sources, yes, out) {
   let removed = 0;
   for (const { source, id } of counts) removed += store.pruneSourceNodes(id, source, []);
   const identityPart = otherProjectIds.length > 0 ? `, ${scopeIds.length} project identit${scopeIds.length === 1 ? "y" : "ies"}` : "";
-  out(`${pc5.green("pruned")} ${removed} node(s) across ${sources.length} source(s)${identityPart}
+  out(`${pc6.green("pruned")} ${removed} node(s) across ${sources.length} source(s)${identityPart}
 `);
   return 0;
 }
@@ -3909,7 +4256,7 @@ async function runSync(opts) {
     store.upsertProject({ id: projectId, root: repo.root, originUrl: repo.originUrl });
     if (opts.rebuild) {
       const removed = store.clearProject(projectId);
-      log(`${pc5.dim("rebuild")} dropped ${removed} existing node(s)`);
+      log(`${pc6.dim("rebuild")} dropped ${removed} existing node(s)`);
     }
     const staleProjectIds = store.listOtherProjectIds(projectId);
     for (const staleId of staleProjectIds) {
@@ -3918,11 +4265,12 @@ async function runSync(opts) {
         result.migrated > 0 ? `${result.migrated} migrated` : null,
         result.reassigned > 0 ? `${result.reassigned} reassigned` : null,
         result.deduped > 0 ? `${result.deduped} already up to date` : null,
-        result.skipped > 0 ? `${result.skipped} left behind (not reconstructable)` : null
+        result.skipped > 0 ? `${result.skipped} left behind (not reconstructable)` : null,
+        result.denied > 0 ? `${result.denied} denied (deny-list)` : null
       ].filter((part) => part !== null);
       if (parts.length > 0) {
         log(
-          `${pc5.yellow("reconciled")} previous project identity ${pc5.dim(staleId)} (remote URL likely changed): ${parts.join(", ")}`
+          `${pc6.yellow("reconciled")} previous project identity ${pc6.dim(staleId)} (remote URL likely changed): ${parts.join(", ")}`
         );
       }
     }
@@ -3952,30 +4300,30 @@ async function runSync(opts) {
       let lastLogged = 0;
       const result = await embedPendingNodes(store, new OllamaEmbeddingProvider(), projectId, {
         maxNodes: opts.embedLimit,
-        onInvalidated: (count) => log(`${pc5.yellow("vector")} embedding model changed -- dropped ${count} vector(s), re-embedding from scratch`),
+        onInvalidated: (count) => log(`${pc6.yellow("vector")} embedding model changed -- dropped ${count} vector(s), re-embedding from scratch`),
         onProgress: (attempted, total) => {
           if (total < PROGRESS_THRESHOLD || attempted - lastLogged < PROGRESS_EVERY) return;
           lastLogged = attempted;
-          log(`  ${pc5.dim(`vector: ${attempted}/${total} embedded`)}`);
+          log(`  ${pc6.dim(`vector: ${attempted}/${total} embedded`)}`);
         }
       });
       if (result.embedded > 0) {
-        const skippedPart = result.skipped > 0 ? pc5.dim(`, ${result.skipped} skipped`) : "";
-        const remainingPart = result.remaining > 0 ? pc5.yellow(`, ${result.remaining} still pending`) : "";
-        embedLine = `  ${pc5.dim(`vector: ${result.embedded} node(s) embedded`)}${skippedPart}${remainingPart}
+        const skippedPart = result.skipped > 0 ? pc6.dim(`, ${result.skipped} skipped`) : "";
+        const remainingPart = result.remaining > 0 ? pc6.yellow(`, ${result.remaining} still pending`) : "";
+        embedLine = `  ${pc6.dim(`vector: ${result.embedded} node(s) embedded`)}${skippedPart}${remainingPart}
 `;
       } else if (result.providerUnavailable) {
-        log(`${pc5.dim("vector")} embedding provider unavailable (is Ollama running with nomic-embed-text pulled?) -- BM25-only for now`);
+        log(`${pc6.dim("vector")} embedding provider unavailable (is Ollama running with nomic-embed-text pulled?) -- BM25-only for now`);
       }
     }
     let linkLine = "";
     if (opts.linkFailures) {
       const linkStats = correlateFailures(store, projectId);
-      linkLine = `  ${pc5.dim(`chains: ${linkStats.failuresExamined} failure(s) examined, ${linkStats.linkedByRetry} linked by retry, ${linkStats.linkedByDiscussion} by discussion`)}
+      linkLine = `  ${pc6.dim(`chains: ${linkStats.failuresExamined} failure(s) examined, ${linkStats.linkedByRetry} linked by retry, ${linkStats.linkedByDiscussion} by discussion`)}
 `;
     }
     store.markSynced(projectId);
-    const totals = { inserted: 0, updated: 0, unchanged: 0 };
+    const totals = { inserted: 0, updated: 0, unchanged: 0, denied: 0 };
     addStats(totals, git2.totals);
     addStats(totals, diffs.totals);
     addStats(totals, shell.totals);
@@ -3989,11 +4337,12 @@ async function runSync(opts) {
     const docsPart = config.sources.docs.enabled ? `, ${docs.seen} doc section(s)` : "";
     const diffPart = config.sources.diff.enabled ? `, ${diffs.seen} file diff(s)` : "";
     const structurePart = config.sources.structure.enabled ? `, ${structure.edges} import edge(s)` : "";
+    const deniedPart = totals.denied > 0 ? `  ${pc6.red(`-${totals.denied} denied`)}` : "";
     out(
       [
-        `${pc5.green("synced")} ${git2.seen} commit(s)${diffPart}, ${shell.seen} shell entr${shell.seen === 1 ? "y" : "ies"}${conversationPart}${sessionPart}${docsPart}${structurePart} in ${elapsed}s`,
-        `  ${pc5.green(`+${totals.inserted} new`)}  ${pc5.yellow(`~${totals.updated} updated`)}  ${pc5.dim(`=${totals.unchanged} unchanged`)}`,
-        `  ${pc5.dim(`${stats.total} node(s) total across ${stats.distinctFiles} file path(s)`)}`,
+        `${pc6.green("synced")} ${git2.seen} commit(s)${diffPart}, ${shell.seen} shell entr${shell.seen === 1 ? "y" : "ies"}${conversationPart}${sessionPart}${docsPart}${structurePart} in ${elapsed}s`,
+        `  ${pc6.green(`+${totals.inserted} new`)}  ${pc6.yellow(`~${totals.updated} updated`)}  ${pc6.dim(`=${totals.unchanged} unchanged`)}${deniedPart}`,
+        `  ${pc6.dim(`${stats.total} node(s) total across ${stats.distinctFiles} file path(s)`)}`,
         ""
       ].join("\n") + embedLine + linkLine
     );
@@ -4189,7 +4538,7 @@ async function runMcpServer() {
 }
 
 // src/cli/commands/precheck.ts
-import pc6 from "picocolors";
+import pc7 from "picocolors";
 
 // src/correlate/precheck.ts
 var DEFAULT_RECENT_DAYS = 30;
@@ -4246,7 +4595,7 @@ async function runPrecheck(opts) {
   const { repo, ws, projectId } = await loadContext(opts.cwd);
   const targetFiles = opts.files ?? (opts.working ? await workingTreeFiles(repo.root) : await stagedFiles(repo.root));
   if (targetFiles.length === 0) {
-    if (!opts.quiet) out(`${pc6.dim("precheck")} no files to check
+    if (!opts.quiet) out(`${pc7.dim("precheck")} no files to check
 `);
     return 0;
   }
@@ -4259,45 +4608,45 @@ async function runPrecheck(opts) {
   }
   const flagged = risks.filter((r) => r.unresolvedFailures.length > 0 || r.commitsRecent >= HIGH_CHURN_THRESHOLD);
   if (flagged.length === 0) {
-    if (!opts.quiet) out(`${pc6.green("precheck")} no warnings \u2014 looking good
+    if (!opts.quiet) out(`${pc7.green("precheck")} no warnings \u2014 looking good
 `);
     return 0;
   }
   out(`
-${pc6.bold("nexusmem precheck")}
-${pc6.dim("-".repeat(40))}
+${pc7.bold("nexusmem precheck")}
+${pc7.dim("-".repeat(40))}
 
 `);
   for (const risk of flagged) {
-    out(`  ${pc6.bold(risk.path)}
+    out(`  ${pc7.bold(risk.path)}
 `);
     if (risk.unresolvedFailures.length > 0) {
-      out(`    ${pc6.yellow("WARN")}  What already failed here (${risk.unresolvedFailures.length} unresolved):
+      out(`    ${pc7.yellow("WARN")}  What already failed here (${risk.unresolvedFailures.length} unresolved):
 `);
       for (const f of risk.unresolvedFailures.slice(0, 3)) {
-        out(`           ${pc6.dim(`${f.ts.slice(0, 10)}  ${f.command.slice(0, 90)}`)}
+        out(`           ${pc7.dim(`${f.ts.slice(0, 10)}  ${f.command.slice(0, 90)}`)}
 `);
       }
       if (risk.unresolvedFailures.length > 3) {
-        out(`           ${pc6.dim(`... and ${risk.unresolvedFailures.length - 3} more`)}
+        out(`           ${pc7.dim(`... and ${risk.unresolvedFailures.length - 3} more`)}
 `);
       }
     }
     if (risk.commitsRecent >= HIGH_CHURN_THRESHOLD) {
-      out(`    ${pc6.yellow("WARN")}  high churn: ${risk.commitsRecent} commits touched this file recently
+      out(`    ${pc7.yellow("WARN")}  high churn: ${risk.commitsRecent} commits touched this file recently
 `);
     }
     out("\n");
   }
   const failureCount = flagged.filter((r) => r.unresolvedFailures.length > 0).length;
-  out(`${pc6.dim(`${flagged.length} file(s) flagged, ${failureCount} with unresolved failures.`)}
+  out(`${pc7.dim(`${flagged.length} file(s) flagged, ${failureCount} with unresolved failures.`)}
 `);
   if (opts.strict && failureCount > 0) return 1;
   return 0;
 }
 
 // src/cli/commands/query.ts
-import pc7 from "picocolors";
+import pc8 from "picocolors";
 async function runQuery(opts) {
   const { repo, ws, projectId } = await loadContext(opts.cwd);
   const opened = opts.allProjects ? await openAllProjectSources({ projectId, root: repo.root, dbPath: ws.dbPath }) : null;
@@ -4319,15 +4668,15 @@ async function runQuery(opts) {
     const { bm25Count, vectorCount, hits, packed } = result;
     if (opened && !opts.json) {
       const searched = opened.sources.map((s) => s.label).join(", ");
-      process.stderr.write(`${pc7.dim("scope  ")} ${opened.sources.length} project(s): ${searched}
+      process.stderr.write(`${pc8.dim("scope  ")} ${opened.sources.length} project(s): ${searched}
 `);
       for (const { entry } of opened.unreadable) {
-        process.stderr.write(`${pc7.yellow("unreadable")} ${entry.root} -- skipped
+        process.stderr.write(`${pc8.yellow("unreadable")} ${entry.root} -- skipped
 `);
       }
       if (opened.missing.length > 0) {
         process.stderr.write(
-          `${pc7.dim("skipped")} ${opened.missing.length} registered project(s) whose database is not on disk ${pc7.dim("(nexusmem projects --prune to forget them)")}
+          `${pc8.dim("skipped")} ${opened.missing.length} registered project(s) whose database is not on disk ${pc8.dim("(nexusmem projects --prune to forget them)")}
 `
         );
       }
@@ -4357,15 +4706,15 @@ async function runQuery(opts) {
       return 0;
     }
     if (matched === 0) {
-      process.stderr.write(`${pc7.yellow("no matches")} for "${opts.query}"
+      process.stderr.write(`${pc8.yellow("no matches")} for "${opts.query}"
 `);
       return 0;
     }
     process.stderr.write(
       [
-        `${pc7.dim("matched")} ${bm25Count} bm25${vectorCount > 0 ? ` + ${vectorCount} vector` : ""}, packed ${pc7.bold(String(packed.nodes.length))} into budget`,
-        `${pc7.dim("tokens ")} ${packed.tokensUsed}/${packed.tokensBudget}` + (packed.droppedForBudget ? pc7.dim(`  (${packed.droppedForBudget} dropped for budget)`) : "") + (packed.droppedForDiversity ? pc7.dim(`  (${packed.droppedForDiversity} dropped for diversity)`) : ""),
-        rawTokens > 0 ? `${pc7.dim("vs raw ")} ${rawTokens} tokens if these same matches were sent unpacked  ${packerEfficiency >= 0 ? pc7.green(`(${(packerEfficiency * 100).toFixed(0)}% packer efficiency)`) : pc7.yellow(`(${(-packerEfficiency * 100).toFixed(0)}% larger -- overhead dominates on small result sets)`)}` : "",
+        `${pc8.dim("matched")} ${bm25Count} bm25${vectorCount > 0 ? ` + ${vectorCount} vector` : ""}, packed ${pc8.bold(String(packed.nodes.length))} into budget`,
+        `${pc8.dim("tokens ")} ${packed.tokensUsed}/${packed.tokensBudget}` + (packed.droppedForBudget ? pc8.dim(`  (${packed.droppedForBudget} dropped for budget)`) : "") + (packed.droppedForDiversity ? pc8.dim(`  (${packed.droppedForDiversity} dropped for diversity)`) : ""),
+        rawTokens > 0 ? `${pc8.dim("vs raw ")} ${rawTokens} tokens if these same matches were sent unpacked  ${packerEfficiency >= 0 ? pc8.green(`(${(packerEfficiency * 100).toFixed(0)}% packer efficiency)`) : pc8.yellow(`(${(-packerEfficiency * 100).toFixed(0)}% larger -- overhead dominates on small result sets)`)}` : "",
         ""
       ].filter(Boolean).join("\n")
     );
@@ -4379,10 +4728,10 @@ async function runQuery(opts) {
 }
 
 // src/cli/commands/scan-conversation.ts
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 
 // src/cli/format.ts
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 var GIT_SIGNAL_BANDS = { high: 0.7, medium: 0.45 };
 var SHELL_SIGNAL_BANDS = { high: 0.6, medium: 0.4 };
 var CONVERSATION_SIGNAL_BANDS = { high: 0.55, medium: 0.35 };
@@ -4394,9 +4743,9 @@ function signalBand(signal, bands) {
   return "low";
 }
 var BAND_COLOR = {
-  high: pc8.green,
-  medium: pc8.yellow,
-  low: pc8.dim
+  high: pc9.green,
+  medium: pc9.yellow,
+  low: pc9.dim
 };
 function formatSignal(signal, bands) {
   return BAND_COLOR[signalBand(signal, bands)](signal.toFixed(2));
@@ -4409,9 +4758,9 @@ async function runScanConversation(opts) {
   const files = await listTranscriptFiles(repo.root);
   if (!opts.json) {
     process.stderr.write(
-      files.length ? `${pc9.dim("transcripts")} ${files.length} file(s) in ${claudeProjectTranscriptDir(repo.root)}
+      files.length ? `${pc10.dim("transcripts")} ${files.length} file(s) in ${claudeProjectTranscriptDir(repo.root)}
 
-` : `${pc9.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
+` : `${pc10.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
 `
     );
   }
@@ -4428,7 +4777,7 @@ async function runScanConversation(opts) {
   const approxTotal = nodes.reduce((n, x) => n + approxTokens(x.body), 0);
   process.stderr.write(
     `
-${pc9.bold(String(nodes.length))} of ${turns.length} exchange(s) above threshold  ${pc9.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}` + (redactedTotal > 0 ? `  ${pc9.yellow(`${redactedTotal} secret-like value(s) redacted`)}` : "") + "\n"
+${pc10.bold(String(nodes.length))} of ${turns.length} exchange(s) above threshold  ${pc10.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}` + (redactedTotal > 0 ? `  ${pc10.yellow(`${redactedTotal} secret-like value(s) redacted`)}` : "") + "\n"
   );
   return 0;
 }
@@ -4437,20 +4786,20 @@ function formatNode(node) {
 }
 
 // src/cli/commands/scan-diff.ts
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 
 // src/cli/commands/scan-git.ts
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 async function runScanGit(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   if (!opts.json) {
     process.stderr.write(
       [
-        `${pc10.dim("repo   ")} ${repo.root}`,
-        `${pc10.dim("branch ")} ${repo.branch ?? pc10.yellow("(detached)")}`,
-        `${pc10.dim("origin ")} ${repo.originUrl ?? pc10.dim("(none)")}`,
-        `${pc10.dim("project")} ${pc10.cyan(projectId)}`,
+        `${pc11.dim("repo   ")} ${repo.root}`,
+        `${pc11.dim("branch ")} ${repo.branch ?? pc11.yellow("(detached)")}`,
+        `${pc11.dim("origin ")} ${repo.originUrl ?? pc11.dim("(none)")}`,
+        `${pc11.dim("project")} ${pc11.cyan(projectId)}`,
         ""
       ].join("\n")
     );
@@ -4484,14 +4833,14 @@ function formatNode2(node) {
   const churn = `+${node.meta.insertions ?? 0}/-${node.meta.deletions ?? 0}`;
   return [
     formatSignal(node.signal, GIT_SIGNAL_BANDS),
-    pc10.dim(date),
-    pc10.magenta(sha),
+    pc11.dim(date),
+    pc11.magenta(sha),
     node.title,
-    pc10.dim(`(${files} file${files === 1 ? "" : "s"}, ${churn})`)
+    pc11.dim(`(${files} file${files === 1 ? "" : "s"}, ${churn})`)
   ].join(" ");
 }
 function summarize2(nodes) {
-  if (nodes.length === 0) return pc10.yellow("no commits matched");
+  if (nodes.length === 0) return pc11.yellow("no commits matched");
   const timestamps = nodes.map((n) => n.ts).sort();
   const avgSignal = nodes.reduce((n, x) => n + x.signal, 0) / nodes.length;
   const totalTokens = nodes.reduce((n, x) => n + approxTokens(x.body), 0);
@@ -4501,7 +4850,7 @@ function summarize2(nodes) {
   }
   const hottest = [...fileHits.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([path, count]) => `    ${String(count).padStart(3)}x ${path}`);
   return [
-    `${pc10.bold(String(nodes.length))} nodes  ${pc10.dim(`${timestamps[0]?.slice(0, 10)} .. ${timestamps.at(-1)?.slice(0, 10)}`)}`,
+    `${pc11.bold(String(nodes.length))} nodes  ${pc11.dim(`${timestamps[0]?.slice(0, 10)} .. ${timestamps.at(-1)?.slice(0, 10)}`)}`,
     `  avg signal ${avgSignal.toFixed(3)}   ~${totalTokens.toLocaleString()} tokens if sent raw`,
     hottest.length ? `  hottest files:
 ${hottest.join("\n")}` : ""
@@ -4516,9 +4865,9 @@ async function runScanDiff(opts) {
   if (!opts.json) {
     process.stderr.write(
       [
-        `${pc11.dim("repo   ")} ${repo.root}`,
-        `${pc11.dim("branch ")} ${repo.branch ?? pc11.yellow("(detached)")}`,
-        `${pc11.dim("project")} ${pc11.cyan(projectId)}`,
+        `${pc12.dim("repo   ")} ${repo.root}`,
+        `${pc12.dim("branch ")} ${repo.branch ?? pc12.yellow("(detached)")}`,
+        `${pc12.dim("project")} ${pc12.cyan(projectId)}`,
         ""
       ].join("\n")
     );
@@ -4548,28 +4897,28 @@ function formatNode3(node) {
   const churn = `+${node.meta.insertions ?? 0}/-${node.meta.deletions ?? 0}`;
   return [
     formatSignal(node.signal, DIFF_SIGNAL_BANDS),
-    pc11.dim(node.ts.slice(0, 10)),
-    pc11.magenta(sha),
+    pc12.dim(node.ts.slice(0, 10)),
+    pc12.magenta(sha),
     String(node.meta.path ?? ""),
-    pc11.dim(`(${churn}, ${node.meta.hunkCount ?? 0} hunk(s))`)
+    pc12.dim(`(${churn}, ${node.meta.hunkCount ?? 0} hunk(s))`)
   ].join(" ");
 }
 
 // src/cli/commands/scan-docs.ts
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 async function runScanDocs(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const { files, unreadable } = await readDocFiles(repo.root);
   if (!opts.json) {
     process.stderr.write(
-      files.length ? `${pc12.dim("tracked .md files")} ${files.map((f) => f.path).join(", ")}
+      files.length ? `${pc13.dim("tracked .md files")} ${files.map((f) => f.path).join(", ")}
 
-` : `${pc12.yellow("no tracked .md files found")}
+` : `${pc13.yellow("no tracked .md files found")}
 `
     );
     if (unreadable.length > 0) {
-      process.stderr.write(`${pc12.yellow("unreadable")} ${unreadable.join(", ")}
+      process.stderr.write(`${pc13.yellow("unreadable")} ${unreadable.join(", ")}
 
 `);
     }
@@ -4585,7 +4934,7 @@ async function runScanDocs(opts) {
   const approxTotal = nodes.reduce((n, x) => n + approxTokens(x.body), 0);
   process.stderr.write(
     `
-${pc12.bold(String(nodes.length))} section(s) from ${files.length} file(s) above threshold  ${pc12.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
+${pc13.bold(String(nodes.length))} section(s) from ${files.length} file(s) above threshold  ${pc13.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
 `
   );
   return 0;
@@ -4595,13 +4944,13 @@ function formatNode4(node) {
 }
 
 // src/cli/commands/scan-session.ts
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 async function runScanSession(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const turns = await collectClaudeCodeTranscripts(repo.root);
   if (turns.length === 0) {
-    process.stderr.write(`${pc13.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
+    process.stderr.write(`${pc14.yellow("no transcripts found")} at ${claudeProjectTranscriptDir(repo.root)}
 `);
     return 0;
   }
@@ -4609,7 +4958,7 @@ async function runScanSession(opts) {
   const settled = selectSettledSessions(sessions, opts.settleMinutes);
   if (!opts.json) {
     process.stderr.write(
-      `${pc13.dim("sessions")} ${sessions.length} found, ${settled.length} settled (quiet ${opts.settleMinutes}m+)
+      `${pc14.dim("sessions")} ${sessions.length} found, ${settled.length} settled (quiet ${opts.settleMinutes}m+)
 
 `
     );
@@ -4635,7 +4984,7 @@ async function runScanSession(opts) {
     }
     for (const preview of previews) {
       process.stdout.write(
-        `${pc13.bold(preview.sessionKey)}  ${preview.startedAt.slice(0, 16).replace("T", " ")}  ${preview.includedTurns}/${preview.turns} turn(s), ${preview.promptChars} chars
+        `${pc14.bold(preview.sessionKey)}  ${preview.startedAt.slice(0, 16).replace("T", " ")}  ${preview.includedTurns}/${preview.turns} turn(s), ${preview.promptChars} chars
 ${preview.prompt}
 
 `
@@ -4647,7 +4996,7 @@ ${preview.prompt}
     settleMinutes: opts.settleMinutes,
     maxSessions: opts.maxSessions,
     onProgress: (done, total) => {
-      if (!opts.json) process.stderr.write(`  ${pc13.dim(`summarizing ${done}/${total}`)}
+      if (!opts.json) process.stderr.write(`  ${pc14.dim(`summarizing ${done}/${total}`)}
 `);
     }
   });
@@ -4657,21 +5006,21 @@ ${preview.prompt}
     return 0;
   }
   for (const node of result.nodes) {
-    process.stdout.write(`${pc13.bold(node.title)}
-${pc13.dim(node.ts.slice(0, 16).replace("T", " "))}
+    process.stdout.write(`${pc14.bold(node.title)}
+${pc14.dim(node.ts.slice(0, 16).replace("T", " "))}
 ${node.body}
 
 `);
   }
   if (result.providerUnavailable) {
     process.stderr.write(
-      `${pc13.yellow("model unavailable")} -- is Ollama running with \`${opts.model}\` pulled? (\`ollama pull ${opts.model}\`)
+      `${pc14.yellow("model unavailable")} -- is Ollama running with \`${opts.model}\` pulled? (\`ollama pull ${opts.model}\`)
 `
     );
     return 0;
   }
   process.stderr.write(
-    `${pc13.bold(String(result.nodes.length))} summarized` + (result.failed > 0 ? `, ${pc13.yellow(`${result.failed} failed`)}` : "") + ` ${pc13.dim(`(model ${opts.model})`)}
+    `${pc14.bold(String(result.nodes.length))} summarized` + (result.failed > 0 ? `, ${pc14.yellow(`${result.failed} failed`)}` : "") + ` ${pc14.dim(`(model ${opts.model})`)}
 `
   );
   return 0;
@@ -4679,16 +5028,16 @@ ${node.body}
 var SCAN_SESSION_DEFAULT_MODEL = DEFAULT_SLM_MODEL;
 
 // src/cli/commands/scan-shell.ts
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 async function runScanShell(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const projectId = makeProjectId({ root: repo.root, originUrl: repo.originUrl });
   const results = await collectAvailableShellHistory({ tailLines: opts.tailLines, repoRoot: repo.root });
   if (!opts.json) {
     process.stderr.write(
-      results.length ? `${pc14.dim("sources found")} ${results.map((r) => r.name).join(", ")}
+      results.length ? `${pc15.dim("sources found")} ${results.map((r) => r.name).join(", ")}
 
-` : `${pc14.yellow("no shell history source found on this machine")}
+` : `${pc15.yellow("no shell history source found on this machine")}
 `
     );
   }
@@ -4697,7 +5046,7 @@ async function runScanShell(opts) {
     const nodes = collectShellHistory(result.entries, projectId).filter((n) => n.signal >= opts.minSignal);
     allNodes.push(...nodes);
     if (!opts.json) {
-      process.stdout.write(`${pc14.bold(`shell:${result.name}`)} ${pc14.dim(`(${nodes.length} of ${result.entries.length} above threshold)`)}
+      process.stdout.write(`${pc15.bold(`shell:${result.name}`)} ${pc15.dim(`(${nodes.length} of ${result.entries.length} above threshold)`)}
 `);
       for (const node of nodes) process.stdout.write(`${formatNode5(node)}
 `);
@@ -4710,19 +5059,19 @@ async function runScanShell(opts) {
     return 0;
   }
   const approxTotal = allNodes.reduce((n, x) => n + approxTokens(x.body), 0);
-  process.stderr.write(`${pc14.bold(String(allNodes.length))} node(s) total  ${pc14.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
+  process.stderr.write(`${pc15.bold(String(allNodes.length))} node(s) total  ${pc15.dim(`~${approxTotal.toLocaleString()} tokens if sent raw`)}
 `);
   return 0;
 }
 function formatNode5(node) {
-  const approx = node.meta.tsApprox ? pc14.dim("~") : " ";
+  const approx = node.meta.tsApprox ? pc15.dim("~") : " ";
   const exit = node.meta.exitCode;
-  const exitLabel = typeof exit === "number" && exit !== 0 ? pc14.red(`exit ${exit}`) : "";
+  const exitLabel = typeof exit === "number" && exit !== 0 ? pc15.red(`exit ${exit}`) : "";
   return [formatSignal(node.signal, SHELL_SIGNAL_BANDS), approx + node.ts.slice(0, 16).replace("T", " "), node.title, exitLabel].filter(Boolean).join(" ");
 }
 
 // src/cli/commands/scan-structure.ts
-import pc15 from "picocolors";
+import pc16 from "picocolors";
 async function runScanStructure(opts) {
   const repo = await readRepoInfo(opts.cwd);
   const { edges, filesScanned, unreadable } = await collectFileEdges(repo.root);
@@ -4732,17 +5081,17 @@ async function runScanStructure(opts) {
     return 0;
   }
   if (unreadable.length > 0) {
-    process.stderr.write(`${pc15.yellow("unreadable")} ${unreadable.join(", ")}
+    process.stderr.write(`${pc16.yellow("unreadable")} ${unreadable.join(", ")}
 
 `);
   }
   for (const edge of edges) {
-    process.stdout.write(`${edge.fromPath} ${pc15.dim("->")} ${edge.toPath}
+    process.stdout.write(`${edge.fromPath} ${pc16.dim("->")} ${edge.toPath}
 `);
   }
   process.stderr.write(
     `
-${pc15.bold(String(edges.length))} edge(s) from ${filesScanned} tracked .ts/.tsx/.js/.jsx file(s)
+${pc16.bold(String(edges.length))} edge(s) from ${filesScanned} tracked .ts/.tsx/.js/.jsx file(s)
 `
   );
   return 0;
@@ -4750,7 +5099,7 @@ ${pc15.bold(String(edges.length))} edge(s) from ${filesScanned} tracked .ts/.tsx
 
 // src/cli/commands/status.ts
 import { statSync } from "fs";
-import pc16 from "picocolors";
+import pc17 from "picocolors";
 function humanBytes(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -4778,32 +5127,32 @@ async function runStatus(opts) {
     const structure = store.fileEdgeStats(projectId);
     const dbBytes = fileSize(ws.dbPath) + fileSize(`${ws.dbPath}-wal`);
     const kinds = Object.entries(stats.byKind).sort((a, b) => b[1] - a[1]).map(([kind, n]) => `    ${String(n).padStart(6)}  ${kind}`);
-    const staleProjectWarning = otherProjectIds.length ? `${pc16.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc16.bold(
+    const staleProjectWarning = otherProjectIds.length ? `${pc17.yellow("stale   ")} ${otherProjectIds.length} prior project ${otherProjectIds.length === 1 ? "identity holds" : "identities hold"} ${otherProjectNodes} node(s) \u2014 run ${pc17.bold(
       "nexusmem sync --prune-source <name>"
     )} to remove stale source data` : "";
     out(
       [
-        `${pc16.dim("repo    ")} ${repo.root}`,
-        `${pc16.dim("branch  ")} ${repo.branch ?? pc16.yellow("(detached)")}`,
-        `${pc16.dim("project ")} ${pc16.cyan(projectId)}`,
-        `${pc16.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc16.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
-        `${pc16.dim("database")} ${ws.dbPath} ${pc16.dim(`(${humanBytes(dbBytes)})`)}`,
+        `${pc17.dim("repo    ")} ${repo.root}`,
+        `${pc17.dim("branch  ")} ${repo.branch ?? pc17.yellow("(detached)")}`,
+        `${pc17.dim("project ")} ${pc17.cyan(projectId)}`,
+        `${pc17.dim("schema  ")} v${schema}${schema === LATEST_SCHEMA_VERSION ? "" : pc17.yellow(` (latest is v${LATEST_SCHEMA_VERSION})`)}`,
+        `${pc17.dim("database")} ${ws.dbPath} ${pc17.dim(`(${humanBytes(dbBytes)})`)}`,
         staleProjectWarning,
         "",
-        `${pc16.bold(String(stats.total))} node(s)${stats.total ? ` ${pc16.dim(`${stats.oldest?.slice(0, 10)} .. ${stats.newest?.slice(0, 10)}`)}` : ""}`,
+        `${pc17.bold(String(stats.total))} node(s)${stats.total ? ` ${pc17.dim(`${stats.oldest?.slice(0, 10)} .. ${stats.newest?.slice(0, 10)}`)}` : ""}`,
         ...kinds,
-        stats.total ? `    ${pc16.dim(`${stats.distinctFiles} distinct file path(s)`)}` : "",
+        stats.total ? `    ${pc17.dim(`${stats.distinctFiles} distinct file path(s)`)}` : "",
         "",
-        sources.length ? pc16.dim("sources") : pc16.yellow("no sources synced yet"),
+        sources.length ? pc17.dim("sources") : pc17.yellow("no sources synced yet"),
         ...sources.map((s) => {
           const when = s.lastRunAt ? new Date(s.lastRunAt).toISOString().slice(0, 16).replace("T", " ") : "never";
           const cursorLabel = s.source === "git" ? s.cursor?.slice(0, 7) ?? "-" : s.cursor ?? "-";
-          return `    ${s.source.padEnd(14)} ${pc16.dim(`last run ${when}`)}  ${pc16.dim(`cursor ${cursorLabel}`)}`;
+          return `    ${s.source.padEnd(14)} ${pc17.dim(`last run ${when}`)}  ${pc17.dim(`cursor ${cursorLabel}`)}`;
         }),
-        gitCursor && gitCursor !== repo.head ? `${pc16.yellow("git behind HEAD")} \u2014 run ${pc16.bold("nexusmem sync")}` : "",
+        gitCursor && gitCursor !== repo.head ? `${pc17.yellow("git behind HEAD")} \u2014 run ${pc17.bold("nexusmem sync")}` : "",
         "",
-        chains.failuresTotal ? `${pc16.dim("chains  ")} ${pc16.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc16.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc16.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
-        structure.edges ? `${pc16.dim("structure")} ${pc16.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : ""
+        chains.failuresTotal ? `${pc17.dim("chains  ")} ${pc17.bold(String(chains.resolvedTotal))}/${chains.failuresTotal} failure(s) resolved ${pc17.dim(`(${chains.resolvedByRetry} retry, ${chains.resolvedByDiscussion} discussion)`)}${chains.resolvedTotal < chains.failuresTotal ? ` \u2014 run ${pc17.bold("nexusmem sync --link-failures")} to link more` : ""}` : "",
+        structure.edges ? `${pc17.dim("structure")} ${pc17.bold(String(structure.edges))} import edge(s) across ${structure.files} file(s)` : ""
       ].filter((line) => line !== "").join("\n").concat("\n")
     );
     return 0;
@@ -4818,7 +5167,7 @@ function isExpected(err) {
   // the user fixes, not stack traces they debug.
   err instanceof GitSpawnError || // Survived every retry, so git is genuinely unstable on this machine
   // (antivirus, a bad install). Actionable, and not our stack to print.
-  err instanceof GitCrashError || err instanceof ConfigError || err instanceof ProfileNotFoundError || err instanceof ForeignGitHookError;
+  err instanceof GitCrashError || err instanceof ConfigError || err instanceof ProfileNotFoundError || err instanceof ForeignGitHookError || err instanceof DenyListError;
 }
 function guard(run) {
   return async () => {
@@ -4826,7 +5175,7 @@ function guard(run) {
       process.exitCode = await run();
     } catch (err) {
       if (isExpected(err)) {
-        process.stderr.write(`${pc17.red("error")} ${err.message}
+        process.stderr.write(`${pc18.red("error")} ${err.message}
 `);
         process.exitCode = 1;
         return;
@@ -4903,6 +5252,21 @@ program.command("query").description("Search remembered history and print a toke
     })
   )()
 );
+program.command("forget").description(
+  "Permanently deny-list a value: deletes matching nodes now and blocks it from ever being re-ingested (irreversible)"
+).argument("[value]", "exact text to forget (see --regex); omit with --list").option("-C, --cwd <path>", "repository path", process.cwd()).option("--regex", "treat <value> as a regular expression instead of a literal substring", false).option("--ignore-case", "case-insensitive match", false).option("--reason <text>", "free-text note stored with the deny-list entry").option("--list", "list active deny-list entries instead of forgetting a new value", false).option("--yes", "confirm the irreversible delete + deny-list write", false).action(
+  (value, options) => guard(
+    () => runForget({
+      cwd: options.cwd,
+      value,
+      regex: options.regex,
+      ignoreCase: options.ignoreCase,
+      reason: options.reason,
+      list: options.list,
+      yes: options.yes
+    })
+  )()
+);
 program.command("projects").description("List the repositories `query --all-projects` would search").option("--prune", "forget registered projects whose database is no longer on disk", false).option("--json", "emit the registry as JSON on stdout", false).action((options) => guard(() => runProjects({ prune: options.prune, json: options.json }))());
 program.command("scan-git").description("Preview the MemoryNodes git history would produce (writes nothing)").option("-C, --cwd <path>", "repository path", process.cwd()).option("--since <date>", "only commits newer than this git date expression, e.g. 90.days.ago").option("-n, --limit <count>", "stop after N commits", (v) => Number.parseInt(v, 10)).option("--no-merges", "skip merge commits").option("--min-signal <score>", "drop nodes below this signal", (v) => Number.parseFloat(v), 0).option("--json", "emit MemoryNodes as JSON on stdout", false).action(
   (options) => guard(
@@ -4963,7 +5327,7 @@ program.command("scan-structure").description("Preview the JS/TS import-graph ed
 program.command("mcp").description("Start the MCP server (stdio transport) for Claude Desktop, Cursor, Windsurf, etc.").action(() => guard(() => runMcpServer().then(() => 0))());
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`${pc17.red("error")} ${message}
+  process.stderr.write(`${pc18.red("error")} ${message}
 `);
   process.exitCode = 1;
 });