open-memex 0.6.2 → 0.7.0-alpha.11

package/src/cli.ts

@@ -9,22 +9,76 @@ import { findDuplicates, supersede, setStatus } from "./store/lifecycle.ts";
 import { proposeMemories, promoteMemory, listConflicts, resolveConflict, formatReviewHistory } from "./review.ts";
 import { getSyncStatus, formatSyncStatus, submitMemories } from "./submit.ts";
 import { getPrStatus, formatPrStatus, applyPrStatus } from "./github.ts";
-import { search, list, hitStateLabel } from "./retrieve/search.ts";
+import { search, list, countList, hitStateLabel } from "./retrieve/search.ts";
+import { formatInventoryLine, truncationNote } from "./retrieve/display.ts";
 import {
   writeMemoryFile,
   readMemoryFile,
   ulid,
   msToRfc3339,
+  normalizeAliases,
   type Frontmatter,
 } from "./store/markdown.ts";
-import { loadConfig } from "./config.ts";
-import { paths, projectRoot } from "./paths.ts";
+import { loadConfig, configSource } from "./config.ts";
+import { paths, projectRoot, isInRepoMemoryFile } from "./paths.ts";
 import { redact } from "./redact.ts";
 import { resolveMcpCommand } from "./init.ts";
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `target` sits inside a git working tree (D68 guard).
+ *
+ * D70: resolve the nearest EXISTING ancestor first. `git -C` on a
+ * directory that does not exist throws, and the old code turned that
+ * into "not in a worktree" — a fail-open guard on the one path where
+ * personal memories would ride a commit.
+ */
+function isInsideWorkTree(target: string): boolean {
+  try {
+    let dir = path.dirname(path.resolve(target));
+    while (!fs.existsSync(dir)) {
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    const out = execFileSync("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8",
+    });
+    return out.trim() === "true";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * D70: the one place that decides where a report may be written, for
+ * every `inventory` format. Returns an error message to print, or null
+ * when the path is safe. Kept single so the text/json/html paths cannot
+ * drift apart (they already had two copies, D68).
+ */
+function inventoryWriteRefusal(
+  target: string,
+  includesPersonal: boolean,
+  allowPersonal: boolean,
+): string | null {
+  // Personal content must not ride a commit (the design's hardest rule).
+  if (includesPersonal && !allowPersonal && isInsideWorkTree(target)) {
+    return (
+      `inventory: ${target} is inside a git working tree and this report includes personal memories. ` +
+      `Refusing to write it there. Pass --allow-personal if you really want that, or write outside the repo.`
+    );
+  }
+  const parent = path.dirname(path.resolve(target));
+  if (!fs.existsSync(parent)) {
+    return `inventory: the directory ${parent} does not exist — create it first, or choose another --out path.`;
+  }
+  return null;
+}
+
 /** Per-command help, printed by `open-memex <command> --help`.
     AI assistants discover the CLI through --help, so every command needs one. */
 const COMMAND_HELP: Record<string, string> = {
@@ -35,14 +89,20 @@ Usage: open-memex where
 Example:
   open-memex where`,
 
-  list: `List memories in a scope, newest first.
+  list: `List memories in a scope, newest first, as a numbered inventory.
 
-Usage: open-memex list [--scope project|personal] [--type T] [--limit N]
+Usage: open-memex list [--scope project|personal|both] [--type T] [--limit N] [--include active|all]
 
 Flags:
-  --scope   project (default) or personal
-  --type    filter by memory type
-  --limit   max results
+  --scope    project (default), personal, or both
+  --type     filter by memory type
+  --limit    max results (default 20, max 100)
+  --include  active (default: what is currently remembered) or all (audit
+             view: superseded versions, retracted and archived included)
+
+A cut list says how many entries it left out. Numbers are unique within one
+listing, so "the third one" names exactly one memory - but they are only
+valid for the listing you just ran.
 
 Examples:
   open-memex list
@@ -64,19 +124,26 @@ Example:
 
   add: `Save a fact, preference, decision, or note to local memory.
 
-Usage: open-memex add "content" [--scope project|personal] [--type T] [--tag t1,t2]
+Usage: open-memex add "content" [--scope project|personal] [--type T] [--tag t1,t2] [--aliases "a;b"]
 
 Flags:
-  --scope   project (default) or personal (personal never leaves this machine)
-  --type    memory type (default: fact)
-  --tag     comma-separated tags
+  --scope    project (default) or personal (personal never leaves this machine)
+  --type     memory type (default: fact)
+  --tag      comma-separated tags
+  --aliases  alternate phrasings of this fact (up to 4), indexed with the
+             memory so differently-worded searches still match; separate
+             with ; (commas also accepted — use ; when an alias itself
+             contains one). Stored only when capture aliases are enabled
+             (init default)
 
 Example:
   open-memex add "We deploy on Fridays" --scope project --tag process`,
 
   supersede: `Replace a memory with a newer version. The old one is kept as history.
 
-Usage: open-memex supersede <id> "new content" [--type T] [--tag t1,t2]
+Usage: open-memex supersede <id> "new content" [--type T] [--tag t1,t2] [--aliases "a;b"]
+
+Without --aliases, the old memory's aliases carry over.
 
 Example:
   open-memex supersede 01ABC "We deploy on Thursdays now"`,
@@ -85,15 +152,22 @@ Example:
 
 Usage: open-memex status <id> active|deprecated|retracted|archived
 
+Retraction is one-way: a retracted memory cannot be set back to active
+(it was withdrawn on purpose). Save the content as a new memory instead.
+
 Example:
   open-memex status 01ABC deprecated`,
 
-  forget: `Delete a memory by id.
+  forget: `Delete a memory by id. With --soft, hide it instead: the memory
+is retracted (out of lists and search, file kept). Retraction is one-way —
+save the content as a new memory to bring it back. If the memory lives in
+the repo, either action is only local until you commit and push it.
 
-Usage: open-memex forget <id>
+Usage: open-memex forget <id> [--soft]
 
 Example:
-  open-memex forget 01ABC`,
+  open-memex forget 01ABC
+  open-memex forget 01ABC --soft`,
 
   propose: `Copy personal memories into the project outbox as review drafts.
 The personal originals stay put. Nothing enters git at this step.
@@ -145,6 +219,22 @@ Usage: open-memex sync-status
 Example:
   open-memex sync-status`,
 
+  inventory: `Show everything remembered — personal + this project — in the
+open: what each memory says, where it came from, and whether it has reached
+the repo yet. Read-only; deleting stays a confirmed conversation with your
+agent. Formats: text (default, diffable), json (for agents), html (a local
+page for your browser; default writes <data dir>/inventory.html).
+
+Usage: open-memex inventory [--format text|json|html] [--scope project|personal|both] [--out <path>] [--allow-personal]
+
+Default scope: both. Without --out, text/json go to stdout. A report that
+includes personal memories is refused inside a git working tree unless
+--allow-personal is passed — personal content must not ride a commit.
+
+Example:
+  open-memex inventory --format json --out ~/inventory.json
+  open-memex inventory --format html`,
+
   pull: `Pull shared project memories from the git remote: fetch + fast-forward
 only. Never auto-merges — a diverged branch fails with a clear message and is
 left for you to resolve by hand. On success the local index re-syncs.
@@ -359,16 +449,17 @@ function usage(exitCode = 1): never {
 
 Usage:
   open-memex where
-  open-memex list [--scope project|personal] [--type T] [--limit N]
+  open-memex list [--scope project|personal|both] [--type T] [--limit N] [--include active|all]
   open-memex search "query" [--scope project|personal|both] [--type T] [--limit N] [--explain]
   open-memex add "content" [--scope project|personal] [--type T] [--tag t1,t2]
   open-memex supersede <id> "new content" [--type T] [--tag t1,t2]
   open-memex status <id> active|deprecated|retracted|archived
-  open-memex forget <id>
+  open-memex forget <id> [--soft]
   open-memex propose <id...> --to project [--local-approve]
   open-memex promote <id> [--reject] [--resubmit] [--note "..."] [--by NAME]
   open-memex resolve [id-or-path]
   open-memex sync-status
+  open-memex inventory [--format text|json|html] [--scope project|personal|both] [--out <path>] [--allow-personal]
   open-memex pull
   open-memex push
   open-memex export [--scope project|personal|both] [--type T] [--tag t] [--all] [-o <file>]
@@ -795,12 +886,13 @@ async function main() {
       process.exit(1);
     }
     const cfg = loadConfig();
-    const { detectKeywords } = await import("./capture/keywords.ts");
+    const { scanKeywords, MIN_CAPTURE_CHARS, MAX_CAPTURE_CHARS } = await import(
+      "./capture/keywords.ts"
+    );
     const text = rest.slice(1).join(" ");
-    const hits = detectKeywords(text, cfg);
+    const { hits, dropped } = scanKeywords(text, cfg);
     if (hits.length === 0) {
-      console.log("no keyword triggers — nothing would be captured.");
-      return;
+      console.log("no keyword triggers - nothing would be captured.");
     }
     for (const h of hits) {
       const r = redact(h.content, cfg.redactPatterns);
@@ -811,6 +903,15 @@ async function main() {
         `  body:         ${r.content.slice(0, 160)}${r.content.length > 160 ? "…" : ""}`,
       );
     }
+    // D67: a trigger that matched but produced a fragment is reported, not
+    // silently dropped - otherwise "记住：这个" just looks broken.
+    for (const d of dropped) {
+      console.log(
+        d.reason === "too-short"
+          ? `! matched but NOT captured: body "${d.content}" is ${d.content.length} chars (floor: ${MIN_CAPTURE_CHARS}). A trigger alone isn't a memory - write the fact: "记住：<fact>".`
+          : `! matched but NOT captured: body is ${d.content.length} chars (ceiling: ${MAX_CAPTURE_CHARS}) - save it with memory_add instead.`,
+      );
+    }
     return;
   }
 
@@ -832,6 +933,7 @@ async function main() {
   if (cmd === "where") {
     const p = paths();
     console.log(`root:      ${p.root}`);
+    console.log(`config:    ${configSource() ?? "(built-in defaults)"}`);
     console.log(`memories:  ${p.memories}`);
     console.log(`index:     ${p.indexDb}`);
     console.log(`project:   ${project.key}`);
@@ -850,20 +952,44 @@ async function main() {
 
   if (cmd === "list") {
     const flags = parseFlags(rest);
-    const s = resolveCliScope(flags, project);
-    syncScope(s.key, "cli");
-    const hits = list(s.key, {
-      type: flags.type,
-      limit: flags.limit ? Number(flags.limit) : undefined,
-    });
-    if (hits.length === 0) {
-      console.log(`(no memories in ${s.key})`);
-      return;
-    }
-    for (const h of hits) {
-      const dep = h.status === "deprecated" ? " [deprecated]" : "";
-      const rev = hitStateLabel(h);
-      console.log(`[${h.type}]${dep}${rev} ${h.id}  ${h.snippet.replace(/\s+/g, " ").trim()}`);
+    // D66: --scope both, on par with the memory_list tool — prints each
+    // scope's newest under its own header.
+    const scopes =
+      flags.scope === "both" ? [PERSONAL_SCOPE, project] : [resolveCliScope(flags, project)];
+    const include = flags.include === "all" ? "all" : "active";
+    // D70: the CLI renders the SAME structured inventory the agent sees,
+    // numbering runs across the whole listing, and a cut list says how
+    // many entries it dropped — `open-memex list` is the surface a
+    // sceptical user runs first, so it may not look complete when it isn't.
+    let seq = 0;
+    for (const s of scopes) {
+      syncScope(s.key, "cli");
+      const hits = list(s.key, {
+        type: flags.type,
+        limit: flags.limit ? Number(flags.limit) : undefined,
+        include,
+      });
+      const total = countList(s.key, { type: flags.type, include });
+      if (scopes.length > 1) {
+        console.log(
+          s.key === PERSONAL_SCOPE.key
+            ? "## About you (personal — stays on this machine, applies everywhere)"
+            : `## This project (${s.projectName || s.key})`,
+        );
+      }
+      if (hits.length === 0) {
+        console.log(
+          scopes.length > 1
+            ? "(nothing remembered in this scope yet)"
+            : `(no memories in ${s.key})`,
+        );
+        continue;
+      }
+      for (const h of hits) {
+        console.log(formatInventoryLine(seq++, h, PERSONAL_SCOPE.key));
+      }
+      const note = truncationNote(hits.length, total);
+      if (note) console.log(note);
     }
     return;
   }
@@ -943,6 +1069,20 @@ async function main() {
             .map((t) => t.trim())
             .filter(Boolean)
         : [],
+      // D61: --aliases "phrase one; phrase two" (comma also accepted; use
+      // ; when an alias itself contains a comma). A bare --aliases with no
+      // value makes parseFlags yield "true" — treat that as absent. Stored
+      // only when the install enables capture aliases, redacted like content.
+      ...(typeof flags.aliases === "string" && flags.aliases !== "true" && cfg.captureAliases
+        ? {
+            aliases: normalizeAliases(
+              flags.aliases
+                .split(/[;,]/)
+                .map((a) => redact(a.trim(), cfg.redactPatterns).content)
+                .filter(Boolean),
+            ),
+          }
+        : {}),
       source: "cli",
       created_at: rfc,
       updated_at: rfc,
@@ -985,6 +1125,15 @@ async function main() {
         tags: flags.tag
           ? flags.tag.split(",").map((t) => t.trim()).filter(Boolean)
           : undefined,
+        aliases:
+          typeof flags.aliases === "string" && flags.aliases !== "true" && cfg.captureAliases
+            ? normalizeAliases(
+                flags.aliases
+                  .split(/[;,]/)
+                  .map((a) => redact(a.trim(), cfg.redactPatterns).content)
+                  .filter(Boolean),
+              )
+            : undefined,
         source: "cli",
       });
       upsertFromFile(oldMf);
@@ -1020,6 +1169,29 @@ async function main() {
   if (cmd === "forget") {
     const id = rest[0];
     if (!id) usage();
+    // D68: --soft hides (retracts) instead of deleting — same action as
+    // the memory_forget tool's soft flag. One-way (D64).
+    if (rest.includes("--soft")) {
+      const target = db().prepare(`SELECT file_path FROM memories WHERE id = ?`).get(id) as
+        | { file_path: string }
+        | undefined;
+      try {
+        const mf = setStatus(id, "retracted");
+        upsertFromFile(mf);
+        console.log(`hidden ${id} (retracted — out of lists and search; save it again as a new memory to bring it back)`);
+        // D70: same honesty as the hard delete — a retraction of an in-repo
+        // memory is a local working-tree edit until it is committed and pushed.
+        if (target && isInRepoMemoryFile(target.file_path)) {
+          console.log(
+            `note: that memory lives in the repo (.ai/open-memex/) — the retraction is only local until you commit and push it; until then the team still sees it.`,
+          );
+        }
+      } catch (e) {
+        console.error(`hide failed: ${(e as Error).message}`);
+        process.exit(1);
+      }
+      return;
+    }
     const row = db().prepare(`SELECT file_path FROM memories WHERE id = ?`).get(id) as
       | { file_path: string }
       | undefined;
@@ -1028,11 +1200,17 @@ async function main() {
       process.exit(1);
     }
     // Delete by indexed file_path — location-agnostic (appdata or in-repo, 2B/D24).
+    // Only ENOENT = success; anything else means the file survives and
+    // would be re-indexed — fail loudly (P0 review, 2026-10-03).
     if (row.file_path) {
       try {
         fs.unlinkSync(row.file_path);
-      } catch {
-        /* already gone */
+      } catch (e) {
+        const code = (e as NodeJS.ErrnoException).code;
+        if (code !== "ENOENT") {
+          console.error(`could not delete ${row.file_path} (${code ?? "error"}) — memory not forgotten`);
+          process.exit(1);
+        }
       }
     }
     deleteFromIndex(id);
@@ -1147,11 +1325,73 @@ function positionalArgs(argv: string[]): string[] {
     return;
   }
 
+  if (cmd === "inventory") {
+    // D68: refresh both scopes first so the report matches the markdown
+    // on disk. Default scope: personal + this project.
+    syncScope(project.key, "cli");
+    syncScope(PERSONAL_SCOPE.key, "cli");
+    const flags = parseFlags(rest);
+    const format = flags.format ?? "text";
+    if (format !== "text" && format !== "json" && format !== "html") {
+      console.error(`inventory: unknown --format '${format}' (text|json|html)`);
+      process.exit(2);
+    }
+    const scopeKeys =
+      flags.scope === "personal"
+        ? [PERSONAL_SCOPE.key]
+        : flags.scope === "project"
+          ? [project.key]
+          : [PERSONAL_SCOPE.key, project.key];
+    const outPath = flags["out"] ?? flags["output"];
+    const includesPersonal = scopeKeys.includes(PERSONAL_SCOPE.key);
+    const allowPersonal = flags["allow-personal"] === "true";
+    try {
+      const { loadInventory, renderInventoryText, renderInventoryJson } = await import("./inventory.ts");
+      if (format === "html") {
+        const { renderInventoryHtml, defaultHtmlOutPath } = await import("./inventory-html.ts");
+        const target = outPath ?? defaultHtmlOutPath(paths().root);
+        // D70: one guard for every format (this path had its own copy).
+        const refusal = inventoryWriteRefusal(target, includesPersonal, allowPersonal);
+        if (refusal) {
+          console.error(refusal);
+          process.exit(2);
+        }
+        // D70: only the audit surface needs the hidden rows themselves;
+        // text/json report counts, so they must not pay to load them.
+        const data = loadInventory(scopeKeys, { hidden: "entries" });
+        fs.writeFileSync(target, renderInventoryHtml(data), "utf8");
+        console.log(`inventory: ${data.total} memories → ${target}`);
+        console.log(`open it in any browser; the report is read-only.`);
+        return;
+      }
+      const data = loadInventory(scopeKeys);
+      const rendered = format === "json" ? renderInventoryJson(data) : renderInventoryText(data);
+      if (outPath) {
+        // D68/3-C v2: the report contains personal content. Writing it into
+        // a git working tree would ride the next commit off this machine —
+        // refuse unless the user explicitly accepts that.
+        const refusal = inventoryWriteRefusal(outPath, includesPersonal, allowPersonal);
+        if (refusal) {
+          console.error(refusal);
+          process.exit(2);
+        }
+        fs.writeFileSync(outPath, rendered, "utf8");
+        console.log(`inventory: ${data.total} memories → ${outPath}`);
+      } else {
+        process.stdout.write(rendered);
+      }
+    } catch (e) {
+      console.error(`inventory failed: ${(e as Error).message}`);
+      process.exit(2);
+    }
+    return;
+  }
+
   if (cmd === "sync-status") {
     syncScope(project.key, "cli");
     syncScope(PERSONAL_SCOPE.key, "cli");
     try {
-      console.log(formatSyncStatus(getSyncStatus()));
+      console.log(formatSyncStatus(getSyncStatus(), { cap: Number.POSITIVE_INFINITY }));
     } catch (e) {
       console.error(`sync-status failed: ${(e as Error).message}`);
       process.exit(2);
@@ -1250,6 +1490,9 @@ function positionalArgs(argv: string[]): string[] {
       console.log(
         `${dryRun ? "DRY RUN: " : ""}imported ${r.imported}, skipped ${r.skippedIdentical} identical`,
       );
+      for (const rp of r.rejectedPaths) {
+        console.log(`  rejected: ${rp} (path outside the bundle)`);
+      }
       for (const c of r.skippedConflict) {
         console.log(`  conflict (kept existing): ${c.id} from ${c.file}`);
       }

package/src/config.ts

@@ -7,6 +7,14 @@ export interface MyOMemoryConfig {
   maxProfileItems: number;
   injectOnFirstTurn: boolean;
   keywordCaptureEnabled: boolean;
+  /**
+   * D61: capture-time aliasing (retrieval layer 3). When on, agents are
+   * asked to attach 2–4 aliases (alternate phrasings, other-language
+   * equivalents) to each memory they save; ops stores them and the index
+   * searches them, so differently-worded questions still hit. Asked once
+   * at init, default on; off = aliases passed by agents are dropped.
+   */
+  captureAliases: boolean;
   /** Patterns whose capture group 1 becomes the memory body; saved to the current scope. */
   keywordPatterns: string[];
   /** Same shape, but hits are forced into the personal scope (e.g. "remember for me"). */
@@ -34,26 +42,41 @@ export const DEFAULT_CONFIG: MyOMemoryConfig = {
   maxProfileItems: 5,
   injectOnFirstTurn: true,
   keywordCaptureEnabled: true,
+  captureAliases: true,
   keywordPatterns: [
-    "^\\s*remember(?!\\s+for\\s+me)(?:\\s+that)?[:,]?\\s+(.+)$",
-    "^\\s*(?:please\\s+)?(?:note|don'?t\\s+forget)(?:\\s+that)?[:,]?\\s+(.+)$",
+    "^\\s*remember(?!\\s+for\\s+me)(?:\\s+that|\\s+to)?[:,]?\\s+(.+)$",
+    "^\\s*(?:please\\s+)?note(?:\\s+that)?[:,]?\\s+(.+)$",
+    // D67: "don't forget the wifi password" is narration addressed to the
+    // agent, not a statement to the store. An explicit marker - "that" or a
+    // colon - makes it an instruction ("don't forget that ..." / "don't
+    // forget: ..."). Mirrors 别忘了 below; see D67.
+    "^\\s*(?:please\\s+)?don'?t\\s+forget(?:\\s+that\\s+|[:,]\\s+)(.+)$",
     "^\\s*TIL[:,]?\\s+(.+)$",
     "^\\s*save\\s+(?:this|to\\s+memory)[:,]?\\s+(.+)$",
     // Chinese equivalents
-    "^\\s*记住(?!（个人）)[：:,，]?\\s*(.+)$",
+    "^\\s*(?:请)?记住(?!（个人）)[：:,，]?\\s*(.+)$",
     "^\\s*(?:请)?(?:记一下|记录一下)[：:,，]?\\s*(.+)$",
-    "^\\s*别忘了[：:,，]?\\s*(.+)$",
+    // D67: separator required. "别忘了带伞" is narration ("don't forget your
+    // umbrella"); "别忘了：周五不发布" is an instruction to the store. Same
+    // rule as the English "don't forget" above.
+    "^\\s*别忘了[：:,，]\\s*(.+)$",
     // First-person plural: team/project context, NOT personal
     "^\\s*我们认为[：:,，]?\\s*(.+)$",
     "^\\s*我们决定[：:,，]?\\s*(.+)$",
-    "^\\s*帮我们记(?:住|一下)?[：:,，]?\\s*(.+)$",
+    // D67: the boundary applies to the BARE verb only. 记 + (住|录) + 一下 is a
+    // complete verb phrase, so the noun may follow directly ("帮我记住这个配置",
+    // "记一下这个约定"); only a bare 记 needs a separator, otherwise 帮我记得…
+    // would capture mid-word garbage. See D67.
+    "^\\s*(?:请)?帮我们记(?:(?:住|录)(?!得|着)(?:一下)?|一下|(?=[：:,，\\s]|$))[：:,，]?\\s*(.+)$",
   ],
   keywordPersonalPatterns: [
     "^\\s*remember\\s+for\\s+me(?:\\s+that)?[:,]?\\s+(.+)$",
-    "^\\s*记住（个人）[：:,，]?\\s*(.+)$",
+    "^\\s*(?:请)?记住（个人）[：:,，]?\\s*(.+)$",
     // First-person singular: personal scope ("我" → 个人, "我们" → 项目)
-    "^\\s*记住我(?!们)[：:,，]?\\s*(.+)$",
-    "^\\s*替我记(?:住|一下)?[：:,，]?\\s*(.+)$",
+    "^\\s*(?:请)?记住我(?!们)[：:,，]?\\s*(.+)$",
+    "^\\s*(?:请)?替我记(?:(?:住|录)(?!得|着)(?:一下)?|一下|(?=[：:,，\\s]|$))[：:,，]?\\s*(.+)$",
+    "^\\s*(?:请)?帮我记(?:(?:住|录)(?!得|着)(?:一下)?|一下|(?=[：:,，\\s]|$))[：:,，]?\\s*(.+)$",
+    "^\\s*help\\s+me\\s+remember(?:\\s+that)?[:,]?\\s+(.+)$",
     "^\\s*我觉得[：:,，]?\\s*(.+)$",
     "^\\s*我喜欢[：:,，]?\\s*(.+)$",
   ],
@@ -65,19 +88,68 @@ export const DEFAULT_CONFIG: MyOMemoryConfig = {
   sync: { autoPull: false },
 };
 
-function stripJsonComments(raw: string): string {
-  // Line comments
-  let out = raw.replace(/^\s*\/\/.*$/gm, "");
-  // Block comments (non-greedy)
-  out = out.replace(/\/\*[\s\S]*?\*\//g, "");
-  // Trailing commas before closing brackets
-  out = out.replace(/,(\s*[}\]])/g, "$1");
+/**
+ * Strip JSONC comments and trailing commas with a string-aware scanner.
+ * The previous regex version was not string-aware: a config value like
+ * "src/**\/secrets" had its `/**…*\/` eaten as a block comment, silently
+ * corrupting the user's redact pattern (P0 review, 2026-10-03). Shared
+ * with doctor.ts — one parser, not two.
+ */
+export function stripJsonComments(raw: string): string {
+  let out = "";
+  let i = 0;
+  let inStr = false;
+  let esc = false;
+  while (i < raw.length) {
+    const c = raw[i]!;
+    const n = raw[i + 1];
+    if (inStr) {
+      out += c;
+      if (esc) esc = false;
+      else if (c === "\\") esc = true;
+      else if (c === '"') inStr = false;
+      i++;
+      continue;
+    }
+    if (c === '"') {
+      inStr = true;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "/" && n === "/") {
+      while (i < raw.length && raw[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && n === "*") {
+      i += 2;
+      while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    if (c === ",") {
+      // Trailing comma: drop it when the next significant char closes a
+      // container. Whitespace/comments between are tolerated.
+      let j = i + 1;
+      while (j < raw.length && /\s/.test(raw[j]!)) j++;
+      if (raw[j] === "}" || raw[j] === "]") {
+        i++;
+        continue;
+      }
+    }
+    out += c;
+    i++;
+  }
   return out;
 }
 
-/** Where `config set` / interactive `init` persist. Respects MY_O_MEMORY_CONFIG. */
+/**
+ * Where `config set` / interactive `init` persist. Respects OPEN_MEMEX_CONFIG
+ * (D62); MY_O_MEMORY_CONFIG is the pre-rename fallback, still honored.
+ */
 export function configFilePath(): string {
   return (
+    process.env.OPEN_MEMEX_CONFIG ??
     process.env.MY_O_MEMORY_CONFIG ??
     path.join(os.homedir(), ".config", "opencode", "open-memex.jsonc")
   );
@@ -110,6 +182,7 @@ export const SETTABLE_KEYS: Record<string, (v: unknown) => unknown> = {
   maxProfileItems: toNonNegInt,
   injectOnFirstTurn: toBool,
   keywordCaptureEnabled: toBool,
+  captureAliases: toBool,
   memoryDir: toRelativeDir,
   "sync.autoPull": toBool,
   logLevel: (v) => {
@@ -146,6 +219,7 @@ export function saveConfig(patch: Record<string, unknown>): string {
 /** Path of the config file in effect, or null when using built-in defaults. */
 export function configSource(): string | null {
   const candidates = [
+    process.env.OPEN_MEMEX_CONFIG,
     process.env.MY_O_MEMORY_CONFIG,
     path.join(os.homedir(), ".config", "opencode", "open-memex.jsonc"),
     path.join(os.homedir(), ".config", "opencode", "open-memex.json"),
@@ -162,7 +236,20 @@ export function loadConfig(): MyOMemoryConfig {
     try {
       const raw = fs.readFileSync(p, "utf8");
       const parsed = JSON.parse(stripJsonComments(raw)) as Partial<MyOMemoryConfig>;
-      return { ...DEFAULT_CONFIG, ...parsed };
+      const merged = { ...DEFAULT_CONFIG, ...parsed };
+      // The config file is hand-editable, so the load path must enforce
+      // the same invariants `config set` does (P0 review, 2026-10-03):
+      // an unvalidated memoryDir like "../../shared" would put
+      // committed project memories outside the repo.
+      try {
+        merged.memoryDir = toRelativeDir(merged.memoryDir);
+      } catch {
+        console.error(
+          `[open-memex] invalid memoryDir "${merged.memoryDir}" in ${p} — using default "${DEFAULT_CONFIG.memoryDir}"`,
+        );
+        merged.memoryDir = DEFAULT_CONFIG.memoryDir;
+      }
+      return merged;
     } catch (err) {
       console.error(`[open-memex] failed to parse ${p}:`, err);
     }