open-memex 0.6.2 → 0.7.0-alpha.11

package/src/opencode-v2.ts

@@ -0,0 +1,119 @@
+import { z } from "zod";
+import {
+  PLUGIN_ID,
+  bootstrapPlugin,
+  captureFromText,
+  injectOnce,
+  type PluginState,
+} from "./plugin-core.ts";
+import { makeTools } from "./tools/memory.ts";
+
+/**
+ * OpenCode 2 adapter (D60). The v2 host structurally decodes the plugin's
+ * default export as `{ id, setup }` — `Plugin.define` is an identity
+ * wrapper, so a plain object with no runtime import of `@opencode/plugin`
+ * loads identically. Importing the SDK at runtime would repeat the D58
+ * failure (devDependency, unresolvable from a global install, silent
+ * skip); the context is duck-typed here from the 2.0.x surface instead.
+ *
+ * v1/v2 hook mapping used below:
+ *   tool map                          → ctx.tool.transform (JSON Schema in,
+ *                                       { content } out)
+ *   chat.message (keyword capture)    → ctx.session.hook("prompt") — fires
+ *                                       once per submitted prompt
+ *   experimental.chat.system.transform → ctx.session.hook("context") — runs
+ *                                       before each model request; the
+ *                                       system array is mutable
+ *
+ * Tool registration must opt out of code mode (`options.codemode: false`,
+ * verified on 2.0.1): by default the host exposes plugin tools only
+ * through an `execute` meta-tool that runs model-written JS, and a model
+ * that calls the tool by name instead gets "Unknown tool" — flaky,
+ * model-dependent behavior. With the opt-out the five tools are plain
+ * function calls, same as on v1 and MCP.
+ */
+
+interface V2ToolInfo {
+  name: string;
+  description: string;
+  input: unknown;
+  options?: { codemode?: boolean };
+  execute: (input: Record<string, unknown>) => Promise<{ content: string }>;
+}
+
+interface V2Registration {
+  dispose?: () => Promise<void>;
+}
+
+export interface V2PluginContext {
+  app?: { version?: string };
+  location?: { directory?: string; project?: { directory?: string } };
+  tool: {
+    transform: (cb: (editor: { add: (tool: V2ToolInfo) => void }) => void) => Promise<unknown>;
+  };
+  session: {
+    hook: (
+      name: "prompt" | "context",
+      cb: (event: never) => void | Promise<void>,
+    ) => Promise<V2Registration>;
+  };
+}
+
+interface V2PromptEvent {
+  sessionID: string;
+  prompt?: { text?: string };
+}
+
+interface V2ContextEvent {
+  sessionID: string;
+  system: unknown[];
+}
+
+/** Register the five memory tools on a v2 host. */
+async function registerTools(ctx: V2PluginContext, state: PluginState): Promise<void> {
+  const tools = makeTools(() => state.scope, state.cfg);
+  await ctx.tool.transform((editor) => {
+    for (const [name, t] of Object.entries(tools)) {
+      editor.add({
+        name,
+        description: t.description,
+        input: z.toJSONSchema(z.object(t.args)),
+        options: { codemode: false },
+        execute: async (input) => {
+          const r = await t.execute(input as never, undefined as never);
+          const content =
+            typeof r === "string" ? r : ((r as { output?: string }).output ?? JSON.stringify(r));
+          return { content };
+        },
+      });
+    }
+  });
+}
+
+export const v2Plugin = {
+  id: PLUGIN_ID,
+  async setup(ctx: V2PluginContext) {
+    const root = ctx.location?.directory ?? ctx.location?.project?.directory ?? process.cwd();
+    const state = bootstrapPlugin(root);
+    const registrations: V2Registration[] = [];
+
+    await registerTools(ctx, state);
+
+    registrations.push(
+      await ctx.session.hook("prompt", (ev: V2PromptEvent) => {
+        captureFromText(ev.prompt?.text ?? "", state);
+      }),
+    );
+    registrations.push(
+      await ctx.session.hook("context", (ev: V2ContextEvent) => {
+        injectOnce(ev.sessionID ?? "", state, (block) => {
+          ev.system.push({ type: "text", text: block });
+        });
+      }),
+    );
+
+    return () => {
+      for (const r of registrations) void r.dispose?.();
+    };
+  },
+};

package/src/paths.ts

@@ -3,8 +3,23 @@ import fs from "node:fs";
 import os from "node:os";
 import { execFileSync } from "node:child_process";
 
+/**
+ * D62: the data-root override env var. `OPEN_MEMEX_HOME` is the current
+ * name; `MY_O_MEMORY_HOME` (pre-rename package name) is still honored as a
+ * fallback so existing setups and scripts keep working. New name wins
+ * when both are set.
+ */
+export function homeOverride(): { dir: string; via: "OPEN_MEMEX_HOME" | "MY_O_MEMORY_HOME" } | null {
+  if (process.env.OPEN_MEMEX_HOME)
+    return { dir: path.resolve(process.env.OPEN_MEMEX_HOME), via: "OPEN_MEMEX_HOME" };
+  if (process.env.MY_O_MEMORY_HOME)
+    return { dir: path.resolve(process.env.MY_O_MEMORY_HOME), via: "MY_O_MEMORY_HOME" };
+  return null;
+}
+
 function dataRoot(): string {
-  if (process.env.MY_O_MEMORY_HOME) return path.resolve(process.env.MY_O_MEMORY_HOME);
+  const override = homeOverride();
+  if (override) return override.dir;
   if (process.platform === "win32") {
     const appData = process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
     return path.join(appData, "open-memex");
@@ -81,6 +96,25 @@ export function inRepoMemoriesDir(root: string, memoryDir: string): string {
 }
 
 /** Same as `inRepoMemoriesDir` but never creates the directory. */
+/**
+ * True when a memory file lives inside the user's git working tree (the
+ * in-repo `.ai/open-memex/` copy) rather than in the local data root.
+ *
+ * D70: both destructive/corrective surfaces need this — the hard delete
+ * already said "commit the deletion so the team sees it" (D64), and the
+ * soft hide has to say the same, because a retraction that never gets
+ * committed leaves the memory standing on every teammate's clone.
+ */
+export function isInRepoMemoryFile(filePath: string): boolean {
+  if (!filePath) return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  return normalized.includes("/.ai/open-memex/") && !normalized.startsWith(root());
+}
+
+function root(): string {
+  return paths().root.replace(/\\/g, "/");
+}
+
 export function inRepoMemoriesDirPath(root: string, memoryDir: string): string {
   return path.join(root, memoryDir);
 }

package/src/plugin-core.ts

@@ -0,0 +1,152 @@
+import { loadConfig, type MyOMemoryConfig } from "./config.ts";
+import { resolveProjectScope, resolveCwdScope, PERSONAL_SCOPE, type Scope } from "./scope.ts";
+import { db } from "./store/db.ts";
+import { syncScope, upsertFromFile } from "./store/sync.ts";
+import { scopeHasFiles } from "./store/migrate.ts";
+import {
+  writeMemoryFile,
+  readMemoryFile,
+  ulid,
+  msToRfc3339,
+  type Frontmatter,
+} from "./store/markdown.ts";
+import { buildContextBlock } from "./retrieve/inject.ts";
+import { detectKeywords } from "./capture/keywords.ts";
+import { findDuplicates } from "./store/lifecycle.ts";
+import { redact } from "./redact.ts";
+
+/**
+ * Host-agnostic plugin core (D60). Both opencode host generations adapt to
+ * this module: the v1 plugin (src/index.ts `server`) and the v2 plugin
+ * (src/opencode-v2.ts `setup`). Host-specific glue — tool registration and
+ * hook shapes — stays in the adapters; everything memory-shaped lives here.
+ */
+export const PLUGIN_ID = "open-memex";
+
+export interface PluginState {
+  cfg: MyOMemoryConfig;
+  scope: Scope;
+  /** Sessions that already received the one-time context injection. */
+  injectedSessions: Set<string>;
+}
+
+/**
+ * Resolve the project scope for a host working directory and bring the
+ * index up to date. Never throws: a broken store must not keep the host
+ * from starting — failures land in the host's log instead.
+ */
+export function bootstrapPlugin(root: string): PluginState {
+  const cfg = loadConfig();
+  const scope = resolveProjectScope(root);
+  try {
+    db();
+    syncScope(scope.key);
+    syncScope(PERSONAL_SCOPE.key);
+    if (cfg.logLevel === "debug") {
+      console.log(`[open-memex] loaded. scope=${scope.key}`);
+    }
+    // If a git remote was added *after* memories were first captured, the
+    // scope key changes (cwd-hash -> origin-hash). Detect the legacy dir on
+    // disk and tell the user how to migrate. We do NOT auto-migrate: two
+    // different repos at the same cwd would collide.
+    const cwdScope = resolveCwdScope(root);
+    if (cwdScope.key !== scope.key && scopeHasFiles(cwdScope.key)) {
+      console.warn(
+        `[open-memex] found memories under legacy scope key "${cwdScope.key}". ` +
+          `Current project scope is "${scope.key}". ` +
+          `To move them: npm run cli -- migrate --from ${cwdScope.key}`,
+      );
+    }
+  } catch (err) {
+    console.error("[open-memex] init failed:", err);
+  }
+  return { cfg, scope, injectedSessions: new Set<string>() };
+}
+
+/**
+ * Keyword capture (§ capture): scan one user message for "remember …"
+ * triggers and save each hit. Shared by the v1 `chat.message` hook and
+ * the v2 session `prompt` hook — both hand us the message text.
+ */
+export function captureFromText(text: string, state: PluginState): void {
+  const { cfg, scope } = state;
+  if (!cfg.keywordCaptureEnabled || !text) return;
+  const hits = detectKeywords(text, cfg);
+  for (const h of hits) {
+    const { content, hadSecret, matchedPattern } = redact(h.content, cfg.redactPatterns);
+    // Secrets are masked (first 4 chars kept) and the capture proceeds;
+    // skip only when nothing usable remains.
+    if (content.length === 0) continue;
+    if (hadSecret && cfg.logLevel === "debug") {
+      console.log(`[open-memex] keyword capture masked secret (${matchedPattern})`);
+    }
+    // Personal patterns ("remember for me" / "记住（个人）") force the personal scope.
+    const target = h.personal ? PERSONAL_SCOPE : scope;
+    // Dedup (§3.4): skip exact duplicates captured before.
+    if (findDuplicates(target.key, content).exact) continue;
+    const now = Date.now();
+    const rfc = msToRfc3339(now);
+    const fm: Frontmatter = {
+      id: ulid(),
+      schema_version: 2,
+      scope_key: target.key,
+      scope: target.kind === "project" ? "project" : "personal",
+      visibility: target.kind === "project" ? "internal" : "private",
+      project_name: target.projectName,
+      type: "fact",
+      role: "knowledge",
+      importance: "normal",
+      status: "active",
+      tags: ["keyword"],
+      source: "keyword",
+      created_at: rfc,
+      updated_at: rfc,
+      supersedes: null,
+      superseded_by: null,
+      review_state: "draft",
+      proposed_by: null,
+      approved_by: null,
+      derived_from: null,
+      review_note: null,
+      review_history: [],
+    };
+    try {
+      const { filePath } = writeMemoryFile(fm, content);
+      const mf = readMemoryFile(filePath);
+      if (mf) upsertFromFile(mf);
+      // Capture feedback: always visible (not debug-only) — the user said
+      // "记住…", they should see that it landed. The opencode plugin API
+      // offers no toast channel, so the plugin log is the feedback surface.
+      const preview = content.length > 60 ? content.slice(0, 60) + "…" : content;
+      console.log(`[open-memex] remembered → ${target.kind} scope: "${preview}"`);
+    } catch (err) {
+      console.error("[open-memex] keyword capture failed:", err);
+    }
+  }
+}
+
+/**
+ * First-turn context injection: exactly once per session. The host adapter
+ * supplies `push` (v1: output.system.push; v2: the session context hook's
+ * system array). Returns true when a block was pushed.
+ */
+export function injectOnce(
+  sessionID: string,
+  state: PluginState,
+  push: (block: string) => void,
+): boolean {
+  const { cfg, scope } = state;
+  if (!cfg.injectOnFirstTurn) return false;
+  if (state.injectedSessions.has(sessionID)) return false;
+  state.injectedSessions.add(sessionID);
+  try {
+    const block = buildContextBlock(scope, cfg);
+    if (block) {
+      push(block);
+      return true;
+    }
+  } catch (err) {
+    console.error("[open-memex] context injection failed:", err);
+  }
+  return false;
+}

package/src/retrieve/display.ts

@@ -0,0 +1,174 @@
+/**
+ * Display helpers (D68): how memory provenance, age, and state are
+ * rendered on the user-facing surfaces — the `memory_list` inventory an
+ * agent shows its user, and the `open-memex inventory` reports.
+ *
+ * Two rules from the 3-C design (v2) live here:
+ * - The list format is STRUCTURED data (number + id + created= + source=
+ *   + state tags). The plain-language renderings ("you said this",
+ *   "3 days ago") live in the guidance surfaces (tool descriptions,
+ *   SKILL.md, MCP handshake) so an agent rephrases them in the
+ *   conversation's language — the raw enums never get localized or
+ *   reworded inside the data itself.
+ * - Nothing truncates silently: callers pair these lines with the true
+ *   totals so a cut list says so.
+ */
+
+/** Human age for a saved memory: "just now", "3 days ago", else a date. */
+export function relativeTime(ts: number, now = Date.now()): string {
+  if (!ts || Number.isNaN(ts)) return "";
+  const diff = now - ts;
+  if (diff < 0) return "just now";
+  const minute = 60_000;
+  const hour = 60 * minute;
+  const day = 24 * hour;
+  if (diff < minute) return "just now";
+  if (diff < hour) {
+    const n = Math.floor(diff / minute);
+    return `${n} minute${n === 1 ? "" : "s"} ago`;
+  }
+  if (diff < day) {
+    const n = Math.floor(diff / hour);
+    return `${n} hour${n === 1 ? "" : "s"} ago`;
+  }
+  if (diff < 30 * day) {
+    const n = Math.floor(diff / day);
+    return `${n} day${n === 1 ? "" : "s"} ago`;
+  }
+  const d = new Date(ts);
+  const mm = String(d.getMonth() + 1).padStart(2, "0");
+  const dd = String(d.getDate()).padStart(2, "0");
+  return `on ${d.getFullYear()}-${mm}-${dd}`;
+}
+
+/** Compact age token for the structured list format: `3d`, `12h`, `now`. */
+export function ageToken(ts: number | undefined, now = Date.now()): string {
+  if (!ts || Number.isNaN(ts)) return "?";
+  const diff = now - ts;
+  if (diff < 60_000) return "now";
+  if (diff < 3_600_000) return `${Math.floor(diff / 60_000)}m`;
+  if (diff < 86_400_000) return `${Math.floor(diff / 3_600_000)}h`;
+  if (diff < 60 * 86_400_000) return `${Math.floor(diff / 86_400_000)}d`;
+  const d = new Date(ts);
+  const mm = String(d.getMonth() + 1).padStart(2, "0");
+  const dd = String(d.getDate()).padStart(2, "0");
+  return `${d.getFullYear()}-${mm}-${dd}`;
+}
+
+/**
+ * Provenance in the user's words (D68). Used by prose surfaces (HTML
+ * report); the structured list keeps the raw `source=` enum instead.
+ * The distinction that matters to the user is *whose words these were* —
+ * said outright, asked to be saved, auto-captured, or inferred by the
+ * agent and possibly wrong.
+ */
+export function sourceLabel(source: string | undefined): string {
+  switch (source) {
+    case "user":
+      return "you said this";
+    case "cli":
+      return "you saved this from the command line";
+    case "tool":
+      return "you asked me to save this";
+    case "keyword":
+      return "auto-captured from your own wording";
+    case "inference":
+      return "I inferred this — not in your words, check me";
+    case "import":
+      return "imported from another machine";
+    default:
+      return source ? `saved (${source})` : "saved";
+  }
+}
+
+/**
+ * Review state in plain words for project scopes (D68). Personal
+ * memories are always `draft` by design; callers must not show this
+ * for them — "not yet shared" would be alarming noise there.
+ */
+export function reviewStateLabel(reviewState: string | undefined): string {
+  switch (reviewState) {
+    case "draft":
+      return "still in your outbox — not in the repo yet";
+    case "proposed":
+      return "shared with the project, waiting for review";
+    case "approved":
+      return "approved, not yet published";
+    case "published":
+      return "published to the repo";
+    case "rejected":
+      return "reviewed and rejected";
+    default:
+      return reviewState ?? "draft";
+  }
+}
+
+/** Escape user content for HTML. Memory text is arbitrary user input. */
+export function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+export interface InventoryHit {
+  id: string;
+  type: string;
+  snippet: string;
+  source?: string;
+  created_at?: number;
+  updated_at?: number;
+  status: string;
+  review_state?: string;
+  scope_key: string;
+}
+
+/**
+ * One structured inventory line (D68):
+ *   3. [fact] id=01K6… created=3d source=user [draft] — body text
+ * Number and id always appear together: the number is for the user's
+ * mouth ("delete #3"), the id is the machine contract. `created=` is
+ * when the memory was learned; `updated=` appears only when it moved
+ * materially later (supersede/promote touch updated_at).
+ *
+ * D70: `index` must be a running counter across every section of one
+ * listing — a per-section counter produces two "#1"s in a single
+ * `scope: both` output, which makes "delete #3" a guess.
+ */
+export function formatInventoryLine(
+  index: number,
+  hit: InventoryHit,
+  personalKey: string,
+  now = Date.now(),
+): string {
+  const parts = [
+    `${index + 1}.`,
+    `[${hit.type}]`,
+    `id=${hit.id}`,
+    `created=${ageToken(hit.created_at ?? hit.updated_at, now)}`,
+    `source=${hit.source || "?"}`,
+  ];
+  const created = hit.created_at ?? hit.updated_at ?? 0;
+  if (hit.updated_at && hit.updated_at - created >= 86_400_000) {
+    parts.push(`updated=${ageToken(hit.updated_at, now)}`);
+  }
+  if (hit.scope_key !== personalKey) {
+    const state = hit.review_state ?? "draft";
+    if (state !== "published") parts.push(`[${state}]`);
+  }
+  if (hit.status !== "active") parts.push(`[${hit.status}]`);
+  const body = hit.snippet.replace(/\s+/g, " ").trim();
+  return `${parts.join(" ")} — ${body}`;
+}
+
+/**
+ * Truncation disclosure (D68): a cut list always says so.
+ * D70: the wording names the surface that can show everything — the CLI —
+ * so a hidden entry is always reachable.
+ */
+export function truncationNote(shown: number, total: number, cli = "open-memex"): string | null {
+  if (total <= shown) return null;
+  return `… and ${total - shown} more not shown (raise limit up to 100, run \`${cli} list --limit 100\`, or use memory_search to find something specific).`;
+}

package/src/retrieve/inject.ts

@@ -28,7 +28,7 @@ export function buildContextBlock(scope: Scope, cfg: MyOMemoryConfig): string |
 
   lines.push(
     "",
-    "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. Do not mention this block to the user unless asked.",
+    "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. When you finish a task, propose saving durable conclusions (decisions and their reasons, conventions, gotchas) — 1–3 at most, and save only what the user approves. Do not mention this block to the user unless asked.",
   );
 
   return lines.join("\n");

package/src/retrieve/search.ts

@@ -7,11 +7,16 @@ export interface SearchHit {
   project_name: string;
   type: string;
   tags: string[];
+  /** D61: capture-time aliases stored on this memory (search hits only). */
+  aliases: string[];
   snippet: string;
   score: number;
   updated_at: number;
   status: string;
   review_state: string;
+  /** D68: provenance + creation time for the plain-language inventory. */
+  source: string;
+  created_at: number;
 }
 
 interface RawRow {
@@ -20,26 +25,40 @@ interface RawRow {
   project_name: string;
   type: string;
   tags: string;
+  aliases?: string;
   updated_at: number;
   snippet: string;
   score: number;
   status: string;
   superseded_by: string | null;
   review_state: string;
+  source?: string;
+  created_at?: number;
 }
 
 function toHit(r: RawRow): SearchHit {
+  const aliases = r.aliases ? r.aliases.split(",").map((a) => a.trim()).filter(Boolean) : [];
+  let snippet = r.snippet ?? "";
+  // D61: the snippet highlights matches in the body column only. When the
+  // match came through an alias (body shows no highlight), say so — the
+  // hit otherwise looks unrelated to the query.
+  if (aliases.length > 0 && !/\[[^\]]+\]/.test(snippet)) {
+    snippet += ` (aka: ${aliases.join(", ")})`;
+  }
   return {
     id: r.id,
     scope_key: r.scope_key,
     project_name: r.project_name,
     type: r.type,
     tags: r.tags ? r.tags.split(",").filter(Boolean) : [],
-    snippet: r.snippet ?? "",
+    aliases,
+    snippet,
     score: r.score,
     updated_at: r.updated_at,
     status: r.status,
     review_state: r.review_state ?? "draft",
+    source: r.source ?? "",
+    created_at: r.created_at ?? r.updated_at ?? 0,
   };
 }
 
@@ -87,7 +106,7 @@ function resolveVisible(rows: RawRow[], limit: number, stats?: SearchStats): Sea
     const r = db()
       .prepare(
         `SELECT id, scope_key, project_name, type, tags, updated_at, status,
-                superseded_by, review_state, substr(content, 1, 240) AS snippet
+                superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
          FROM memories WHERE id = ?`,
       )
       .get(id) as
@@ -161,8 +180,8 @@ export function search(
   const typeFilter = opts.type ? ` AND m.type = ?` : "";
 
   const sql = `
-    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.updated_at,
-           m.status, m.superseded_by, m.review_state,
+    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.aliases, m.updated_at,
+           m.status, m.superseded_by, m.review_state, m.source, m.created_at,
            snippet(memories_fts, 0, '[', ']', ' ... ', 12) AS snippet,
            bm25(memories_fts) AS score
     FROM memories_fts
@@ -188,6 +207,8 @@ export function search(
     status: string;
     superseded_by: string | null;
     review_state: string;
+    source: string;
+    created_at: number;
     snippet: string;
     score: number;
   }>;
@@ -200,14 +221,14 @@ export function search(
 
 export function list(
   scopeKey: string,
-  opts: { type?: string; limit?: number } = {},
+  opts: { type?: string; limit?: number; include?: "active" | "all" } = {},
 ): SearchHit[] {
   const limit = Math.max(1, Math.min(opts.limit ?? 20, 100));
   const fetchLimit = Math.min(limit * 3 + 10, 150);
   const typeFilter = opts.type ? ` AND type = ?` : "";
   const sql = `
     SELECT id, scope_key, project_name, type, tags, updated_at, status,
-           superseded_by, review_state, substr(content, 1, 240) AS snippet
+           superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
     FROM memories
     WHERE scope_key = ?${typeFilter}
     ORDER BY updated_at DESC
@@ -229,9 +250,45 @@ export function list(
     status: string;
     superseded_by: string | null;
     review_state: string;
+    source: string;
+    created_at: number;
     snippet: string;
   }>;
 
   const raw: RawRow[] = rows.map((r) => ({ ...r, score: 1 }));
+  if (opts.include === "all") {
+    // D68: the audit view — every row as stored (superseded versions,
+    // retracted, archived), no chain collapsing, capped at limit.
+    return raw.slice(0, limit).map(toHit);
+  }
   return resolveVisible(raw, limit);
 }
+
+/**
+ * True totals for the inventory's truncation disclosure (D68). Under
+ * `active` the visible set is the newest of each chain, which in a
+ * consistent store is exactly the rows whose status is active/deprecated.
+ *
+ * D70: one deliberate exception — a `superseded` row whose chain target is
+ * missing (a dangling pointer, which the read path self-heals with a
+ * warning) is returned as a visible hit by resolveVisible but is not
+ * counted here, so the total can read one low in that state. Not worth
+ * widening the query for a self-healing case; the disclosure stays honest
+ * in every state a user can reach deliberately.
+ */
+export function countList(
+  scopeKey: string,
+  opts: { type?: string; include?: "active" | "all" } = {},
+): number {
+  const typeFilter = opts.type ? ` AND type = ?` : "";
+  const statusFilter =
+    opts.include === "all" ? "" : ` AND status IN ('active', 'deprecated')`;
+  const params: unknown[] = [scopeKey];
+  if (opts.type) params.push(opts.type);
+  const row = db()
+    .prepare(
+      `SELECT COUNT(*) AS n FROM memories WHERE scope_key = ?${statusFilter}${typeFilter}`,
+    )
+    .get(...(params as any[])) as { n: number };
+  return row.n;
+}

package/src/review.ts

@@ -27,6 +27,7 @@ import { resolveProjectScope } from "./scope.ts";
 import {
   parse as parseMemory,
   serialize,
+  atomicWriteTextSync,
   ulid,
   writeMemoryFile,
   type Frontmatter,
@@ -107,6 +108,12 @@ function copyPersonalToProject(
     id: ulid(),
     scope: "project",
     scope_key: project.key,
+    // D64: the copy is headed for the team. Source visibility (usually
+    // "private") must not ride along: export excludes private by default,
+    // so a private copy would silently vanish from every bundle the team
+    // builds. Proposing IS the act of sharing — the copy is internal;
+    // the personal original keeps its own visibility, untouched.
+    visibility: "internal",
     project_name: project.projectName,
     created_at: now,
     updated_at: now,
@@ -240,7 +247,7 @@ export function promoteMemory(
       },
     ],
   };
-  fs.writeFileSync(mf.filePath, serialize(fm, mf.body), "utf8");
+  atomicWriteTextSync(mf.filePath, serialize(fm, mf.body));
   upsertFromFile({ fm, body: mf.body, filePath: mf.filePath, mtimeMs: Date.now() });
   return { id, from, to, history: fm.review_history };
 }
@@ -494,7 +501,7 @@ export function resolveConflict(target: string): ResolveOutcome {
   if (conflicts.length > 0) return { ok: false, filePath, conflicts };
 
   const fm = merged as unknown as Frontmatter;
-  fs.writeFileSync(filePath, serialize(fm, mergedBody), "utf8");
+  atomicWriteTextSync(filePath, serialize(fm, mergedBody));
   upsertFromFile({ fm, body: mergedBody, filePath, mtimeMs: Date.now() });
   return { ok: true, filePath, autoMerged: [...new Set(autoMerged)] };
 }