open-memex 0.1.0 → 0.2.0-alpha

package/scripts/smoke-pure.ts

@@ -1,10 +1,13 @@
 // Quick smoke test — runs the pure-logic modules (no bun:sqlite dependency).
 // Usage:  node --experimental-strip-types scripts\smoke-pure.ts
-import { parse, serialize, ulid, type Frontmatter } from "../src/store/markdown.ts";
+import { parse, serialize, ulid, normalizeFrontmatter, msToRfc3339, timeToMs, parseRawFrontmatter, type Frontmatter } from "../src/store/markdown.ts";
+import { planConversion, isV2File } from "../src/store/v2migrate.ts";
 import { redact, findSecret } from "../src/redact.ts";
 import { detectKeywords } from "../src/capture/keywords.ts";
 import { DEFAULT_CONFIG } from "../src/config.ts";
-import { resolveProjectScope, resolveCwdScope, USER_SCOPE } from "../src/scope.ts";
+import { resolveProjectScope, resolveCwdScope, PERSONAL_SCOPE } from "../src/scope.ts";
+import { cjkIndexText, cjkQueryExpr, hasCjk } from "../src/retrieve/cjk.ts";
+import { contentHash, similarity, NEAR_DUP_THRESHOLD } from "../src/store/lifecycle.ts";
 
 let fails = 0;
 function ok(name: string, cond: boolean, info?: unknown) {
@@ -20,19 +23,28 @@ const a = ulid();
 const b = ulid();
 ok("length is 26", a.length === 26);
 ok("two calls differ", a !== b);
-ok("sortable", a < b || a === b);
+// NOTE: same-ms monotonicity is NOT guaranteed — the 16-char suffix is
+// random by design (timestamp prefix still gives rough ordering).
+ok("time prefix is 10 chars", a.slice(0, 10).length === 10);
 
-console.log("== markdown round-trip ==");
+console.log("== markdown round-trip (v2) ==");
 const fm: Frontmatter = {
   id: a,
+  schema_version: 2,
   scope_key: "project__test__abcdef123456",
-  scope_kind: "project",
+  scope: "project",
+  visibility: "internal",
   project_name: "test",
-  type: "note",
+  type: "fact",
+  role: "knowledge",
+  importance: "normal",
+  status: "active",
   tags: ["hello", "world"],
   source: "test",
-  created_at: 1000,
-  updated_at: 2000,
+  created_at: msToRfc3339(1000),
+  updated_at: msToRfc3339(2000),
+  supersedes: null,
+  superseded_by: null,
 };
 const body = "hello\n\nworld";
 const raw = serialize(fm, body);
@@ -54,6 +66,82 @@ ok("bare secret detected", r2.hadSecret === true);
 const r3 = redact("ghp_" + "a".repeat(36), DEFAULT_CONFIG.redactPatterns);
 ok("github PAT detected", r3.hadSecret === true);
 
+console.log("== redact hardening ==");
+import {
+  BUILTIN_SECRET_PATTERNS,
+  findBuiltinSecret,
+  findHighEntropySecret,
+  stripPrivate,
+} from "../src/redact.ts";
+
+// Every builtin pattern fires on a realistic sample, reported by id.
+const builtinSamples: Array<[string, string]> = [
+  ["openai-key", "key=sk-1234567890abcdefghij1234"],
+  ["github-oauth-token", "tok=gho_12345678901234567890123456789012"],
+  ["github-fine-grained-pat", "tok=github_pat_1234567890123456789012345678901234567890"],
+  ["aws-access-key-id", "id=AKIA1234567890ABCDEF"],
+  ["slack-token", "tok=xoxb-123456789012-abcdefghij"],
+  ["google-api-key", "k=AIza12345678901234567890123456789012"],
+  ["npm-token", "t=npm_12345678901234567890123456789012"],
+  ["gitlab-pat", "t=glpat-12345678901234567890ab"],
+  ["stripe-webhook-secret", "s=whsec_12345678901234567890"],
+  ["private-key-block", "-----BEGIN RSA PRIVATE KEY-----"],
+  ["generic-secret-assignment", 'password = "hunter2hunter2hunter2"'],
+];
+for (const [id, sample] of builtinSamples) {
+  const r = redact(`note: ${sample} end`, []);
+  ok(`builtin ${id} detected`, r.hadSecret === true && r.matchedPattern === id, r.matchedPattern);
+}
+// All builtin regexes compile.
+ok(
+  "all builtins compile",
+  BUILTIN_SECRET_PATTERNS.every((p) => {
+    try {
+      new RegExp(p.source, p.flags ?? "");
+      return true;
+    } catch {
+      return false;
+    }
+  }),
+);
+// Non-secrets pass.
+const benign = [
+  "remember that the meeting is at 3pm tomorrow",
+  "the api endpoint is https://api.example.com/v1/users/list",
+  "commit = a3f5c81234abcd1234abcd1234abcd1234abcd12",
+  "version = 1.2.3-alpha.4",
+  "note = aaaaaaaaaaaaaaaaaaaaaaaa",
+  "token: abc",
+  // sk- inside ordinary words must not trip the openai-key pattern
+  // (regression: these were refused as "openai-key" before the boundary guard).
+  "the task-management-system-workflow-2024 document is here",
+  "disk-encryption-key-management-system-v2 rollout notes",
+  "risk-assessment-score-2024-10 update",
+];
+for (const b of benign) {
+  const r = redact(b, []);
+  ok(`benign passes: ${b.slice(0, 40)}`, r.hadSecret === false, r.matchedPattern);
+}
+// High-entropy heuristic.
+const entropic = findHighEntropySecret('deploy_key = "aB3dE5fG7hJ9kL2mN4pQ6rS8tU0vW2xY4zA6bC8dE0"');
+ok("high-entropy assignment caught", entropic === "high-entropy-secret:deploy_key", entropic);
+ok("low-entropy passes", findHighEntropySecret('note = "aaaaaaaaaaaaaaaaaaaaaaaa"') === null);
+ok("hex digest passes", findHighEntropySecret("commit = a3f5c81234abcd1234abcd1234abcd1234abcd12") === null);
+// <private> handling.
+ok(
+  "unclosed private redacts to end",
+  stripPrivate("hello <private>my secret") === "hello [REDACTED]",
+);
+ok(
+  "closed private still stripped",
+  stripPrivate("a <private>x</private> b") === "a [REDACTED] b",
+);
+const r4 = redact("token is <private>sk-1234567890abcdefghij1234</private> ok", []);
+ok("wrapped secret does not trigger", r4.hadSecret === false);
+// User patterns still work, reported verbatim.
+const r5 = redact("foo CUSTOM123 bar", ["CUSTOM\\d+"]);
+ok("user pattern detected", r5.hadSecret === true && r5.matchedPattern === "CUSTOM\\d+", r5.matchedPattern);
+
 console.log("== keywords ==");
 const hits1 = detectKeywords("remember that this repo uses Bun, not Node", DEFAULT_CONFIG);
 ok("basic remember matched", hits1.length === 1);
@@ -74,7 +162,9 @@ ok("kind=project", s.kind === "project");
 ok("key starts with project__", s.key.startsWith("project__"));
 ok("hash length 12", /__[a-f0-9]{12}$/.test(s.key));
 console.log("     scope.key =", s.key);
-console.log("     user.key  =", USER_SCOPE.key);
+console.log("     personal.key =", PERSONAL_SCOPE.key);
+ok("personal scope key", PERSONAL_SCOPE.key === "personal");
+ok("personal scope kind", PERSONAL_SCOPE.kind === "personal");
 
 console.log("== scope (cwd-only legacy) ==");
 const cwdOnly = resolveCwdScope(process.cwd());
@@ -87,5 +177,115 @@ ok("cwd scope deterministic", cwdOnly.key === cwdOnly2.key);
 // (This repo does have an origin after `git push`.)
 console.log("     cwd.key   =", cwdOnly.key);
 
+console.log("== cjk ==");
+ok("detects han", hasCjk("中文记忆"));
+ok("detects mixed", hasCjk("open中文"));
+ok("no cjk in latin", !hasCjk("hello world 123"));
+ok(
+  "index bigrams",
+  cjkIndexText("中文记忆") === "中 文 记 忆 中文 文记 记忆",
+  cjkIndexText("中文记忆"),
+);
+ok("index single char", cjkIndexText("猫") === "猫", cjkIndexText("猫"));
+ok(
+  "index skips latin",
+  cjkIndexText("open中文") === "中 文 中文",
+  cjkIndexText("open中文"),
+);
+ok("index empty", cjkIndexText("hello") === "");
+ok(
+  "query bigrams",
+  cjkQueryExpr("中文记忆") === '"中文" OR "文记" OR "记忆"',
+  cjkQueryExpr("中文记忆"),
+);
+ok("query single char", cjkQueryExpr("猫") === '"猫"', cjkQueryExpr("猫"));
+ok("query no cjk", cjkQueryExpr("hello") === "");
+
+console.log("== v2 times ==");
+ok("epoch 0 → rfc3339", msToRfc3339(0) === "1970-01-01T00:00:00Z", msToRfc3339(0));
+ok("rfc3339 round-trip", timeToMs(msToRfc3339(1758854400000)) === 1758854400000);
+ok("timeToMs accepts epoch", timeToMs(1000) === 1000);
+ok("timeToMs accepts rfc3339", timeToMs("2026-09-26T12:00:00Z") === Date.parse("2026-09-26T12:00:00Z"));
+
+console.log("== v1 → v2 normalize ==");
+const v1raw = {
+  id: "01TESTV1",
+  scope_key: "user",
+  scope_kind: "user",
+  project_name: "user",
+  type: "instruction",
+  priority: 9,
+  tags: ["x"],
+  source: "test",
+  created_at: 1758854400000,
+  updated_at: 1758854400000,
+} as Record<string, unknown>;
+const nfm = normalizeFrontmatter(v1raw);
+ok("scope user→personal", nfm.scope === "personal", nfm.scope);
+ok("scope_key user→personal", nfm.scope_key === "personal", nfm.scope_key);
+ok("visibility private", nfm.visibility === "private", nfm.visibility);
+ok("type instruction→knowledge", nfm.type === "knowledge", nfm.type);
+ok("role →instruction", nfm.role === "instruction", nfm.role);
+ok("priority 9→high", nfm.importance === "high", nfm.importance);
+ok("epoch→rfc3339", nfm.created_at === "2025-09-26T02:40:00Z", nfm.created_at);
+ok("status active", nfm.status === "active");
+ok("schema_version 2", nfm.schema_version === 2);
+
+const v1raw2 = {
+  id: "01TESTV2",
+  scope_key: "project__x__abcdef123456",
+  scope_kind: "project",
+  project_name: "x",
+  type: "error-solution",
+  priority: 2,
+  tags: [],
+  created_at: 1000,
+  updated_at: 1000,
+} as Record<string, unknown>;
+const nfm2 = normalizeFrontmatter(v1raw2);
+ok("project scope kept", nfm2.scope === "project");
+ok("project visibility internal", nfm2.visibility === "internal");
+ok("priority 2→low", nfm2.importance === "low");
+ok("role default knowledge", nfm2.role === "knowledge");
+
+console.log("== v1 → v2 planConversion ==");
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "v2mig-"));
+const memRoot = path.join(tmpRoot, "memories");
+fs.mkdirSync(path.join(memRoot, "user"), { recursive: true });
+const v1file = `---\nid: 01PLANTEST\nscope_key: user\nscope_kind: user\nproject_name: user\ntype: note\npriority: 5\ntags: []\nsource: test\ncreated_at: 1758854400000\nupdated_at: 1758854400000\n---\n\n记得买菜\n`;
+const v1path = path.join(memRoot, "user", "01PLANTEST.md");
+fs.writeFileSync(v1path, v1file, "utf8");
+ok("v1 not v2 file", !isV2File(v1file));
+const plan = planConversion(v1path, memRoot);
+ok("plan exists", plan !== null);
+ok("plan moves to personal/", plan?.toPath === path.join(memRoot, "personal", "01PLANTEST.md"), plan?.toPath);
+ok("plan notes unknown type", plan?.changes.some((c) => c.includes('"note" → knowledge')) ?? false, plan?.changes);
+ok("plan notes scope rename", plan?.changes.some((c) => c.includes("personal")) ?? false);
+ok("plan fm scope personal", plan?.fm.scope === "personal");
+const v2raw = serialize(plan!.fm, plan!.body);
+ok("v2 marker detected", isV2File(v2raw));
+ok("already-v2 → null plan", planConversion(v1path, memRoot) !== null); // file still v1 on disk
+fs.writeFileSync(v1path, v2raw, "utf8");
+const plan2 = planConversion(v1path, memRoot);
+ok("v2 on disk → null plan", plan2 === null);
+fs.rmSync(tmpRoot, { recursive: true, force: true });
+
+console.log("== lifecycle pure: contentHash / similarity ==");
+ok("hash deterministic + whitespace-insensitive", contentHash("hello   world\n") === contentHash("hello world"));
+ok("hash differs on content", contentHash("hello world") !== contentHash("hello mars"));
+ok("hash is sha256 hex", /^[0-9a-f]{64}$/.test(contentHash("x")));
+ok("similarity identical latin = 1", similarity("apple banana", "apple banana") === 1);
+ok("similarity identical CJK = 1", similarity("北京烤鸭好吃", "北京烤鸭好吃") === 1);
+ok("similarity disjoint ≈ 0", similarity("apple banana", "car train") < 0.2);
+const near = similarity(
+  "the meeting notes from tuesday about deployment",
+  "meeting notes from tuesday about deployment",
+);
+ok(`similarity near-dup ${near.toFixed(2)} >= ${NEAR_DUP_THRESHOLD}`, near >= NEAR_DUP_THRESHOLD);
+ok("similarity empty → 0", similarity("", "anything") === 0);
+
 console.log(fails === 0 ? "\nALL PASS" : `\n${fails} FAILURES`);
 process.exit(fails === 0 ? 0 : 1);

package/src/cli.ts

@@ -1,15 +1,18 @@
 #!/usr/bin/env node
 // Run with:  node --experimental-strip-types src/cli.ts <command>
-import { resolveProjectScope, resolveCwdScope, USER_SCOPE } from "./scope.ts";
+import { resolveProjectScope, resolveCwdScope, PERSONAL_SCOPE, type Scope } from "./scope.ts";
 import { db, closeDb } from "./store/db.ts";
 import { syncScope, upsertFromFile, deleteFromIndex } from "./store/sync.ts";
 import { migrateScope, scopeHasFiles, type ConflictStrategy } from "./store/migrate.ts";
+import { migrateV2 } from "./store/v2migrate.ts";
+import { findDuplicates, supersede, setStatus } from "./store/lifecycle.ts";
 import { search, list } from "./retrieve/search.ts";
 import {
   writeMemoryFile,
   readMemoryFile,
   deleteMemoryFile,
   ulid,
+  msToRfc3339,
   type Frontmatter,
 } from "./store/markdown.ts";
 import { loadConfig } from "./config.ts";
@@ -22,20 +25,27 @@ function usage(): never {
 
 Usage:
   node --experimental-strip-types src/cli.ts where
-  node --experimental-strip-types src/cli.ts list [--scope project|user] [--type T] [--limit N]
-  node --experimental-strip-types src/cli.ts search "query" [--scope project|user|both] [--type T] [--limit N]
-  node --experimental-strip-types src/cli.ts add "content" [--scope project|user] [--type T] [--tag t1,t2]
+  node --experimental-strip-types src/cli.ts list [--scope project|personal] [--type T] [--limit N]
+  node --experimental-strip-types src/cli.ts search "query" [--scope project|personal|both] [--type T] [--limit N]
+  node --experimental-strip-types src/cli.ts add "content" [--scope project|personal] [--type T] [--tag t1,t2]
+  node --experimental-strip-types src/cli.ts supersede <id> "new content" [--type T] [--tag t1,t2]
+  node --experimental-strip-types src/cli.ts status <id> active|deprecated|retracted|archived
   node --experimental-strip-types src/cli.ts forget <id>
   node --experimental-strip-types src/cli.ts reindex
   node --experimental-strip-types src/cli.ts scopes
   node --experimental-strip-types src/cli.ts migrate [--from <key>] [--to <key>]
                                           [--dry-run] [--on-conflict newer|overwrite|skip]
+  node --experimental-strip-types src/cli.ts migrate --to-v2 [--dry-run]
 
 Scope defaults to \`project\` (derived from cwd's git remote or path).
+\`user\` is accepted as a deprecated alias of \`personal\`.
 \`scopes\` lists every project scope dir with its file count — use it to find
 the \`--from\` key when migrating.
 \`migrate\` moves memories between scope keys — useful when a repo gains a
-git remote after memories were already stored under the cwd-based key.`);
+git remote after memories were already stored under the cwd-based key.
+\`migrate --to-v2\` converts v1 memory files to the v2 format (§19):
+user→personal scope rename, epoch→RFC 3339 times, priority→importance,
+type: instruction→role split. Always preview with --dry-run first.`);
   process.exit(1);
 }
 
@@ -57,12 +67,52 @@ function parseFlags(argv: string[]): Record<string, string> {
   return out;
 }
 
+/** CLI `--scope` flag → Scope. `user` is a deprecated alias of `personal`. */
+function resolveCliScope(flags: Record<string, string>, project: Scope): Scope {
+  return flags.scope === "personal" || flags.scope === "user"
+    ? PERSONAL_SCOPE
+    : project;
+}
+
 async function main() {
   const [cmd, ...rest] = process.argv.slice(2);
   if (!cmd) usage();
 
   const cfg = loadConfig();
   const project = resolveProjectScope(process.cwd());
+
+  // `migrate --to-v2` is a pure file operation (V2-DESIGN §19) — it runs
+  // before the index is opened so it also works where the DB driver
+  // isn't available.
+  if (cmd === "migrate" && rest.includes("--to-v2")) {
+    const flags = parseFlags(rest);
+    const dryRun = flags["dry-run"] === "true";
+    const stats = migrateV2({ dryRun });
+    console.log(
+      `${dryRun ? "DRY RUN: " : ""}scanned ${stats.scanned} files: ` +
+        `${stats.converted} to convert, ${stats.skippedV2} already v2`,
+    );
+    for (const p of stats.plans) {
+      console.log(`\n${p.fm.id}`);
+      console.log(
+        `  ${p.fromPath}${p.toPath !== p.fromPath ? `\n  → ${p.toPath}` : ""}`,
+      );
+      for (const c of p.changes) console.log(`  - ${c}`);
+    }
+    if (stats.legacyBackup) {
+      console.log(
+        `\nlegacy my-o-memory data dir merged; backup kept at:\n  ${stats.legacyBackup}`,
+      );
+    }
+    if (!dryRun && stats.converted > 0) {
+      console.log(
+        `\nindex schema will rebuild automatically on next run; ` +
+          `run \`open-memex reindex\` to verify.`,
+      );
+    }
+    return;
+  }
+
   db();
 
   if (cmd === "where") {
@@ -71,22 +121,22 @@ async function main() {
     console.log(`memories:  ${p.memories}`);
     console.log(`index:     ${p.indexDb}`);
     console.log(`project:   ${project.key}`);
-    console.log(`user:      ${USER_SCOPE.key}`);
+    console.log(`personal:  ${PERSONAL_SCOPE.key}`);
     return;
   }
 
   if (cmd === "reindex") {
     const a = syncScope(project.key);
-    const b = syncScope(USER_SCOPE.key);
+    const b = syncScope(PERSONAL_SCOPE.key);
     console.log(
-      `reindexed. project: +${a.added} ~${a.updated} -${a.removed} (scanned ${a.scanned}), user: +${b.added} ~${b.updated} -${b.removed} (scanned ${b.scanned})`,
+      `reindexed. project: +${a.added} ~${a.updated} -${a.removed} (scanned ${a.scanned}), personal: +${b.added} ~${b.updated} -${b.removed} (scanned ${b.scanned})`,
     );
     return;
   }
 
   if (cmd === "list") {
     const flags = parseFlags(rest);
-    const s = flags.scope === "user" ? USER_SCOPE : project;
+    const s = resolveCliScope(flags, project);
     syncScope(s.key);
     const hits = list(s.key, {
       type: flags.type,
@@ -97,7 +147,8 @@ async function main() {
       return;
     }
     for (const h of hits) {
-      console.log(`[${h.type}] ${h.id}  ${h.snippet.replace(/\s+/g, " ").trim()}`);
+      const dep = h.status === "deprecated" ? " [deprecated]" : "";
+      console.log(`[${h.type}]${dep} ${h.id}  ${h.snippet.replace(/\s+/g, " ").trim()}`);
     }
     return;
   }
@@ -107,13 +158,13 @@ async function main() {
     if (!query || query.startsWith("--")) usage();
     const flags = parseFlags(rest.slice(1));
     syncScope(project.key);
-    syncScope(USER_SCOPE.key);
+    syncScope(PERSONAL_SCOPE.key);
     const keys =
-      flags.scope === "user"
-        ? [USER_SCOPE.key]
+      flags.scope === "personal" || flags.scope === "user"
+        ? [PERSONAL_SCOPE.key]
         : flags.scope === "project"
           ? [project.key]
-          : [project.key, USER_SCOPE.key];
+          : [project.key, PERSONAL_SCOPE.key];
     const hits = search(query, {
       scopeKeys: keys,
       limit: flags.limit ? Number(flags.limit) : undefined,
@@ -124,8 +175,9 @@ async function main() {
       return;
     }
     for (const h of hits) {
-      const tag = h.scope_key === USER_SCOPE.key ? "user" : "project";
-      console.log(`[${tag}/${h.type}] ${h.id}  ${h.snippet.replace(/\s+/g, " ").trim()}`);
+      const tag = h.scope_key === PERSONAL_SCOPE.key ? "personal" : "project";
+      const dep = h.status === "deprecated" ? " [deprecated]" : "";
+      console.log(`[${tag}/${h.type}]${dep} ${h.id}  ${h.snippet.replace(/\s+/g, " ").trim()}`);
     }
     return;
   }
@@ -134,19 +186,32 @@ async function main() {
     const content = rest[0];
     if (!content || content.startsWith("--")) usage();
     const flags = parseFlags(rest.slice(1));
-    const s = flags.scope === "user" ? USER_SCOPE : project;
+    const s = resolveCliScope(flags, project);
     const { content: red, hadSecret, matchedPattern } = redact(content, cfg.redactPatterns);
     if (hadSecret) {
       console.error(`refused: content matched secret pattern (${matchedPattern}).`);
       process.exit(2);
     }
+    // Dedup on write (§3.4): identical content is idempotent; near-duplicates
+    // warn but still save (use `supersede` when this replaces the old one).
+    const dups = findDuplicates(s.key, red);
+    if (dups.exact) {
+      console.log(`already exists: id=${dups.exact.id} (identical content — not duplicated)`);
+      return;
+    }
     const now = Date.now();
+    const rfc = msToRfc3339(now);
     const fm: Frontmatter = {
       id: ulid(),
+      schema_version: 2,
       scope_key: s.key,
-      scope_kind: s.kind,
+      scope: s.kind === "project" ? "project" : "personal",
+      visibility: s.kind === "project" ? "internal" : "private",
       project_name: s.projectName,
-      type: flags.type ?? "note",
+      type: flags.type ?? "fact",
+      role: "knowledge",
+      importance: "normal",
+      status: "active",
       tags: flags.tag
         ? flags.tag
             .split(",")
@@ -154,13 +219,64 @@ async function main() {
             .filter(Boolean)
         : [],
       source: "cli",
-      created_at: now,
-      updated_at: now,
+      created_at: rfc,
+      updated_at: rfc,
+      supersedes: null,
+      superseded_by: null,
     };
     const { filePath } = writeMemoryFile(fm, red);
     const mf = readMemoryFile(filePath);
     if (mf) upsertFromFile(mf);
     console.log(`saved ${fm.id} -> ${filePath}`);
+    for (const n of dups.near) {
+      console.log(
+        `warning: similar memory exists (score ${n.score.toFixed(2)}): id=${n.id}\n  ${n.snippet}\n  use \`open-memex supersede ${n.id} "new content"\` if this replaces it.`,
+      );
+    }
+    return;
+  }
+
+  if (cmd === "supersede") {
+    const id = rest[0];
+    const content = rest[1];
+    if (!id || !content || content.startsWith("--")) usage();
+    const flags = parseFlags(rest.slice(2));
+    const { content: red, hadSecret, matchedPattern } = redact(content, cfg.redactPatterns);
+    if (hadSecret) {
+      console.error(`refused: content matched secret pattern (${matchedPattern}).`);
+      process.exit(2);
+    }
+    try {
+      const { oldMf, newMf } = supersede(id, {
+        body: red,
+        type: flags.type,
+        tags: flags.tag
+          ? flags.tag.split(",").map((t) => t.trim()).filter(Boolean)
+          : undefined,
+        source: "cli",
+      });
+      upsertFromFile(oldMf);
+      upsertFromFile(newMf);
+      console.log(`superseded ${oldMf.fm.id} → ${newMf.fm.id}`);
+    } catch (e) {
+      console.error(`supersede failed: ${(e as Error).message}`);
+      process.exit(2);
+    }
+    return;
+  }
+
+  if (cmd === "status") {
+    const id = rest[0];
+    const st = rest[1];
+    if (!id || !st) usage();
+    try {
+      const mf = setStatus(id, st as "active" | "deprecated" | "retracted" | "archived");
+      upsertFromFile(mf);
+      console.log(`status ${id} → ${mf.fm.status}`);
+    } catch (e) {
+      console.error(`status failed: ${(e as Error).message}`);
+      process.exit(2);
+    }
     return;
   }
 
@@ -193,7 +309,7 @@ async function main() {
       const files = fs.readdirSync(dir).filter((f) => f.endsWith(".md")).length;
       const marker =
         name === project.key ? " <- current project"
-        : name === USER_SCOPE.key ? " <- user"
+        : name === PERSONAL_SCOPE.key ? " <- personal"
         : "";
       entries.push({ key: name, files, marker });
     }

package/src/config.ts

@@ -23,16 +23,9 @@ export const DEFAULT_CONFIG: MyOMemoryConfig = {
     "^\\s*TIL[:,]?\\s+(.+)$",
     "^\\s*save\\s+(?:this|to\\s+memory)[:,]?\\s+(.+)$",
   ],
-  redactPatterns: [
-    "sk-[A-Za-z0-9_-]{20,}",
-    "sm_[A-Za-z0-9_-]{20,}",
-    "ghp_[A-Za-z0-9]{30,}",
-    "gho_[A-Za-z0-9]{30,}",
-    "github_pat_[A-Za-z0-9_]{40,}",
-    "AKIA[0-9A-Z]{16}",
-    "xox[baprs]-[A-Za-z0-9-]{10,}",
-    "AIza[0-9A-Za-z_-]{30,}",
-  ],
+  // Built-in provider patterns now live in src/redact.ts (always on).
+  // Add only your own extra patterns here.
+  redactPatterns: [],
   logLevel: "info",
 };
 

package/src/index.ts

@@ -1,6 +1,6 @@
 import type { Plugin } from "@opencode-ai/plugin";
 import { loadConfig } from "./config.ts";
-import { resolveProjectScope, resolveCwdScope, USER_SCOPE, type Scope } from "./scope.ts";
+import { resolveProjectScope, resolveCwdScope, PERSONAL_SCOPE, type Scope } from "./scope.ts";
 import { db } from "./store/db.ts";
 import { syncScope, upsertFromFile } from "./store/sync.ts";
 import { scopeHasFiles } from "./store/migrate.ts";
@@ -8,10 +8,12 @@ import {
   writeMemoryFile,
   readMemoryFile,
   ulid,
+  msToRfc3339,
   type Frontmatter,
 } from "./store/markdown.ts";
 import { buildContextBlock } from "./retrieve/inject.ts";
 import { detectKeywords } from "./capture/keywords.ts";
+import { findDuplicates } from "./store/lifecycle.ts";
 import { redact } from "./redact.ts";
 import { makeTools } from "./tools/memory.ts";
 
@@ -24,7 +26,7 @@ const plugin: Plugin = async ({ worktree, directory }) => {
   try {
     db();
     syncScope(scope.key);
-    syncScope(USER_SCOPE.key);
+    syncScope(PERSONAL_SCOPE.key);
     if (cfg.logLevel === "debug") {
       console.log(`[open-memex] loaded. scope=${scope.key}`);
     }
@@ -63,17 +65,27 @@ const plugin: Plugin = async ({ worktree, directory }) => {
       for (const h of hits) {
         const { content, hadSecret } = redact(h.content, cfg.redactPatterns);
         if (hadSecret || content.length === 0) continue;
+        // Dedup (§3.4): skip exact duplicates captured before.
+        if (findDuplicates(scope.key, content).exact) continue;
         const now = Date.now();
+        const rfc = msToRfc3339(now);
         const fm: Frontmatter = {
           id: ulid(),
+          schema_version: 2,
           scope_key: scope.key,
-          scope_kind: scope.kind,
+          scope: scope.kind === "project" ? "project" : "personal",
+          visibility: scope.kind === "project" ? "internal" : "private",
           project_name: scope.projectName,
-          type: "note",
+          type: "fact",
+          role: "knowledge",
+          importance: "normal",
+          status: "active",
           tags: ["keyword"],
           source: "keyword",
-          created_at: now,
-          updated_at: now,
+          created_at: rfc,
+          updated_at: rfc,
+          supersedes: null,
+          superseded_by: null,
         };
         try {
           const { filePath } = writeMemoryFile(fm, content);