nexusmem 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -9,6 +9,38 @@ built from, matched by publish timestamp: `v0.1.0` → `67a4776`, `v0.1.1` → `
 
 ## [Unreleased]
 
+## [0.5.1] — 2026-08-17
+
+### Added
+
+- **`nexusmem forget --export <path>` / `forget --import <path>`: carry a deny-list across a clone or
+  restore.** `.nexusmem/` is gitignored by design, so `deny_list` never traveled with `git clone`/
+  `git push` — confirmed live 2026-08-17 that a fresh clone of the exact same repo resurrected a value
+  already forgotten elsewhere, with zero deny-list protection, because git history (what a fresh `sync`
+  re-derives from) is fully portable while the deny-list that would have blocked it was not. `--export`
+  writes the active entries to a plaintext JSON file (loudly warned as exactly as sensitive as the
+  values it holds — never meant for git, moved through whatever secure channel the user already
+  trusts); `--import` re-applies each new entry through `forget` itself, so an imported value is
+  deleted from the new checkout's nodes too, not just blocked going forward. Same dry-run-by-default /
+  `--yes` convention as the rest of `forget`. See `docs/forget-mechanism.md`.
+
+## [0.5.0] — 2026-08-17
+
+### Added
+
+- **`nexusmem forget <value>`: permanent, value-keyed deletion.** The finer-grained complement to
+  `sync --prune-source` (which only deletes at the whole-collector-source granularity): forgets one
+  exact string or `--regex` pattern, deleting every node it currently matches *and* writing a
+  standing deny-list entry so the value can never be re-ingested — closing the one gap an external
+  source-level review flagged as its most serious finding: the append-only shell-hook log (and a
+  full transcript re-read) are untouched by any prune, so `sync --rebuild` used to resurrect exactly
+  what had just been deleted. Every removal leaves a hash-only tombstone (never the forgotten
+  content itself — `body`/`title` are stored as sha256 only) and the whole operation writes one
+  `mutation_audit` row, whether or not anything matched. Dry-run by default, matching
+  `--prune-source`'s convention exactly; `--yes` confirms; `--list` shows active entries. Permanent
+  in v0 — no `--remove`, matching the existing irreversible framing of `--prune-source`/`--rebuild`.
+  See `docs/forget-mechanism.md`.
+
 ## [0.4.0] — 2026-08-16
 
 ### Added
@@ -320,7 +352,9 @@ First public release.
   there is no local-model summarization pass, and the conversation collector has never been audited
   for the stale-node bug that was found and fixed in the docs collector.
 
-[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/yaminbkk/NexusMem/compare/v0.5.1...HEAD
+[0.5.1]: https://github.com/yaminbkk/NexusMem/compare/v0.5.0...v0.5.1
+[0.5.0]: https://github.com/yaminbkk/NexusMem/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/yaminbkk/NexusMem/compare/v0.3.3...v0.4.0
 [0.3.3]: https://github.com/yaminbkk/NexusMem/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/yaminbkk/NexusMem/compare/v0.3.1...v0.3.2

package/README.md

@@ -318,10 +318,24 @@ optimizing, and it is somebody else's process.
   against this repo's own memory, switching to the joint cap moved the section that answered the
   question up in three of them (the rationale section for "why BM25 before vector search" went from
   rank 4 to rank 1) and displaced no query's correct top hit.
+- **`forget` is per-repository, not global.** Its deny-list lives in the one `.nexusmem/memory.db` it
+  ran against (plus that repo's stale prior identities, same scope `--prune-source` already uses). A
+  value that leaked into shell history from several repositories needs `forget` run once per repo —
+  there is no shared, machine-wide deny-list across every project you have synced.
+- **A deny-list doesn't survive a clone or restore on its own.** `.nexusmem/` is gitignored by design,
+  so `deny_list` never travels with `git clone`/`git push` — while git history itself, the thing a
+  fresh `sync` re-derives from, is fully portable and copied by every clone. A teammate's fresh
+  checkout, a new machine, or a restored backup starts with zero protection: the forgotten value comes
+  right back on the first sync. Confirmed live 2026-08-17, not just a theoretical read of the code.
+  `forget --export <path>` / `forget --import <path>` close this: export writes the active entries to
+  a plaintext JSON file you move through a channel you control (never git — the file is exactly as
+  sensitive as the value it holds), and import re-applies them in the new checkout, deleting any
+  copies that already synced back in. It is deliberately manual, not automatic on every `sync`.
 
 ## Commands
 
-`init`, `sync`, `query <text>`, `status`, `projects`, `mcp`, and `hook install|remove|status`.
+`init`, `sync`, `query <text>`, `status`, `projects`, `mcp`, `forget <value>`, and
+`hook install|remove|status`.
 
 There are also five dry-run previews (`scan-git`, `scan-diff`, `scan-shell`, `scan-docs`,
 `scan-conversation`)
@@ -334,6 +348,15 @@ transcript source in for one run without persisting it, `--no-embed` skips the v
 `--link-failures` builds the failure → fix chains described above, and `--rebuild` drops the
 project's nodes and re-ingests from scratch.
 
+`sync --prune-source <name>` deletes an entire collector source (e.g. `shell:pwsh`); `forget <value>`
+is the finer-grained complement — it deletes every node matching one exact string (or `--regex`
+pattern) *and* writes a standing deny-list entry so the value can never be re-ingested, even by a
+later `sync --rebuild` re-reading the append-only shell-hook log or a full transcript scan. Every
+removal leaves a hash-only tombstone, never the forgotten content itself. Both are dry-run by
+default; `--yes` confirms. `forget --list` shows active entries; `forget --export <path>` /
+`forget --import <path>` carry them to another checkout of the same repo (see the limitation above).
+See [`docs/forget-mechanism.md`](docs/forget-mechanism.md) for why this exists.
+
 ## Recall across projects
 
 `query --all-projects` searches every repository you have run NexusMem in, not just the current one,