open-memex 0.6.2 → 0.7.0-alpha.11

package/dist/plugin-core.js

@@ -0,0 +1,138 @@
+import { loadConfig } from "./config.js";
+import { resolveProjectScope, resolveCwdScope, PERSONAL_SCOPE } from "./scope.js";
+import { db } from "./store/db.js";
+import { syncScope, upsertFromFile } from "./store/sync.js";
+import { scopeHasFiles } from "./store/migrate.js";
+import { writeMemoryFile, readMemoryFile, ulid, msToRfc3339, } from "./store/markdown.js";
+import { buildContextBlock } from "./retrieve/inject.js";
+import { detectKeywords } from "./capture/keywords.js";
+import { findDuplicates } from "./store/lifecycle.js";
+import { redact } from "./redact.js";
+/**
+ * Host-agnostic plugin core (D60). Both opencode host generations adapt to
+ * this module: the v1 plugin (src/index.ts `server`) and the v2 plugin
+ * (src/opencode-v2.ts `setup`). Host-specific glue — tool registration and
+ * hook shapes — stays in the adapters; everything memory-shaped lives here.
+ */
+export const PLUGIN_ID = "open-memex";
+/**
+ * Resolve the project scope for a host working directory and bring the
+ * index up to date. Never throws: a broken store must not keep the host
+ * from starting — failures land in the host's log instead.
+ */
+export function bootstrapPlugin(root) {
+    const cfg = loadConfig();
+    const scope = resolveProjectScope(root);
+    try {
+        db();
+        syncScope(scope.key);
+        syncScope(PERSONAL_SCOPE.key);
+        if (cfg.logLevel === "debug") {
+            console.log(`[open-memex] loaded. scope=${scope.key}`);
+        }
+        // If a git remote was added *after* memories were first captured, the
+        // scope key changes (cwd-hash -> origin-hash). Detect the legacy dir on
+        // disk and tell the user how to migrate. We do NOT auto-migrate: two
+        // different repos at the same cwd would collide.
+        const cwdScope = resolveCwdScope(root);
+        if (cwdScope.key !== scope.key && scopeHasFiles(cwdScope.key)) {
+            console.warn(`[open-memex] found memories under legacy scope key "${cwdScope.key}". ` +
+                `Current project scope is "${scope.key}". ` +
+                `To move them: npm run cli -- migrate --from ${cwdScope.key}`);
+        }
+    }
+    catch (err) {
+        console.error("[open-memex] init failed:", err);
+    }
+    return { cfg, scope, injectedSessions: new Set() };
+}
+/**
+ * Keyword capture (§ capture): scan one user message for "remember …"
+ * triggers and save each hit. Shared by the v1 `chat.message` hook and
+ * the v2 session `prompt` hook — both hand us the message text.
+ */
+export function captureFromText(text, state) {
+    const { cfg, scope } = state;
+    if (!cfg.keywordCaptureEnabled || !text)
+        return;
+    const hits = detectKeywords(text, cfg);
+    for (const h of hits) {
+        const { content, hadSecret, matchedPattern } = redact(h.content, cfg.redactPatterns);
+        // Secrets are masked (first 4 chars kept) and the capture proceeds;
+        // skip only when nothing usable remains.
+        if (content.length === 0)
+            continue;
+        if (hadSecret && cfg.logLevel === "debug") {
+            console.log(`[open-memex] keyword capture masked secret (${matchedPattern})`);
+        }
+        // Personal patterns ("remember for me" / "记住（个人）") force the personal scope.
+        const target = h.personal ? PERSONAL_SCOPE : scope;
+        // Dedup (§3.4): skip exact duplicates captured before.
+        if (findDuplicates(target.key, content).exact)
+            continue;
+        const now = Date.now();
+        const rfc = msToRfc3339(now);
+        const fm = {
+            id: ulid(),
+            schema_version: 2,
+            scope_key: target.key,
+            scope: target.kind === "project" ? "project" : "personal",
+            visibility: target.kind === "project" ? "internal" : "private",
+            project_name: target.projectName,
+            type: "fact",
+            role: "knowledge",
+            importance: "normal",
+            status: "active",
+            tags: ["keyword"],
+            source: "keyword",
+            created_at: rfc,
+            updated_at: rfc,
+            supersedes: null,
+            superseded_by: null,
+            review_state: "draft",
+            proposed_by: null,
+            approved_by: null,
+            derived_from: null,
+            review_note: null,
+            review_history: [],
+        };
+        try {
+            const { filePath } = writeMemoryFile(fm, content);
+            const mf = readMemoryFile(filePath);
+            if (mf)
+                upsertFromFile(mf);
+            // Capture feedback: always visible (not debug-only) — the user said
+            // "记住…", they should see that it landed. The opencode plugin API
+            // offers no toast channel, so the plugin log is the feedback surface.
+            const preview = content.length > 60 ? content.slice(0, 60) + "…" : content;
+            console.log(`[open-memex] remembered → ${target.kind} scope: "${preview}"`);
+        }
+        catch (err) {
+            console.error("[open-memex] keyword capture failed:", err);
+        }
+    }
+}
+/**
+ * First-turn context injection: exactly once per session. The host adapter
+ * supplies `push` (v1: output.system.push; v2: the session context hook's
+ * system array). Returns true when a block was pushed.
+ */
+export function injectOnce(sessionID, state, push) {
+    const { cfg, scope } = state;
+    if (!cfg.injectOnFirstTurn)
+        return false;
+    if (state.injectedSessions.has(sessionID))
+        return false;
+    state.injectedSessions.add(sessionID);
+    try {
+        const block = buildContextBlock(scope, cfg);
+        if (block) {
+            push(block);
+            return true;
+        }
+    }
+    catch (err) {
+        console.error("[open-memex] context injection failed:", err);
+    }
+    return false;
+}

package/dist/retrieve/display.js

@@ -0,0 +1,161 @@
+/**
+ * Display helpers (D68): how memory provenance, age, and state are
+ * rendered on the user-facing surfaces — the `memory_list` inventory an
+ * agent shows its user, and the `open-memex inventory` reports.
+ *
+ * Two rules from the 3-C design (v2) live here:
+ * - The list format is STRUCTURED data (number + id + created= + source=
+ *   + state tags). The plain-language renderings ("you said this",
+ *   "3 days ago") live in the guidance surfaces (tool descriptions,
+ *   SKILL.md, MCP handshake) so an agent rephrases them in the
+ *   conversation's language — the raw enums never get localized or
+ *   reworded inside the data itself.
+ * - Nothing truncates silently: callers pair these lines with the true
+ *   totals so a cut list says so.
+ */
+/** Human age for a saved memory: "just now", "3 days ago", else a date. */
+export function relativeTime(ts, now = Date.now()) {
+    if (!ts || Number.isNaN(ts))
+        return "";
+    const diff = now - ts;
+    if (diff < 0)
+        return "just now";
+    const minute = 60_000;
+    const hour = 60 * minute;
+    const day = 24 * hour;
+    if (diff < minute)
+        return "just now";
+    if (diff < hour) {
+        const n = Math.floor(diff / minute);
+        return `${n} minute${n === 1 ? "" : "s"} ago`;
+    }
+    if (diff < day) {
+        const n = Math.floor(diff / hour);
+        return `${n} hour${n === 1 ? "" : "s"} ago`;
+    }
+    if (diff < 30 * day) {
+        const n = Math.floor(diff / day);
+        return `${n} day${n === 1 ? "" : "s"} ago`;
+    }
+    const d = new Date(ts);
+    const mm = String(d.getMonth() + 1).padStart(2, "0");
+    const dd = String(d.getDate()).padStart(2, "0");
+    return `on ${d.getFullYear()}-${mm}-${dd}`;
+}
+/** Compact age token for the structured list format: `3d`, `12h`, `now`. */
+export function ageToken(ts, now = Date.now()) {
+    if (!ts || Number.isNaN(ts))
+        return "?";
+    const diff = now - ts;
+    if (diff < 60_000)
+        return "now";
+    if (diff < 3_600_000)
+        return `${Math.floor(diff / 60_000)}m`;
+    if (diff < 86_400_000)
+        return `${Math.floor(diff / 3_600_000)}h`;
+    if (diff < 60 * 86_400_000)
+        return `${Math.floor(diff / 86_400_000)}d`;
+    const d = new Date(ts);
+    const mm = String(d.getMonth() + 1).padStart(2, "0");
+    const dd = String(d.getDate()).padStart(2, "0");
+    return `${d.getFullYear()}-${mm}-${dd}`;
+}
+/**
+ * Provenance in the user's words (D68). Used by prose surfaces (HTML
+ * report); the structured list keeps the raw `source=` enum instead.
+ * The distinction that matters to the user is *whose words these were* —
+ * said outright, asked to be saved, auto-captured, or inferred by the
+ * agent and possibly wrong.
+ */
+export function sourceLabel(source) {
+    switch (source) {
+        case "user":
+            return "you said this";
+        case "cli":
+            return "you saved this from the command line";
+        case "tool":
+            return "you asked me to save this";
+        case "keyword":
+            return "auto-captured from your own wording";
+        case "inference":
+            return "I inferred this — not in your words, check me";
+        case "import":
+            return "imported from another machine";
+        default:
+            return source ? `saved (${source})` : "saved";
+    }
+}
+/**
+ * Review state in plain words for project scopes (D68). Personal
+ * memories are always `draft` by design; callers must not show this
+ * for them — "not yet shared" would be alarming noise there.
+ */
+export function reviewStateLabel(reviewState) {
+    switch (reviewState) {
+        case "draft":
+            return "still in your outbox — not in the repo yet";
+        case "proposed":
+            return "shared with the project, waiting for review";
+        case "approved":
+            return "approved, not yet published";
+        case "published":
+            return "published to the repo";
+        case "rejected":
+            return "reviewed and rejected";
+        default:
+            return reviewState ?? "draft";
+    }
+}
+/** Escape user content for HTML. Memory text is arbitrary user input. */
+export function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/**
+ * One structured inventory line (D68):
+ *   3. [fact] id=01K6… created=3d source=user [draft] — body text
+ * Number and id always appear together: the number is for the user's
+ * mouth ("delete #3"), the id is the machine contract. `created=` is
+ * when the memory was learned; `updated=` appears only when it moved
+ * materially later (supersede/promote touch updated_at).
+ *
+ * D70: `index` must be a running counter across every section of one
+ * listing — a per-section counter produces two "#1"s in a single
+ * `scope: both` output, which makes "delete #3" a guess.
+ */
+export function formatInventoryLine(index, hit, personalKey, now = Date.now()) {
+    const parts = [
+        `${index + 1}.`,
+        `[${hit.type}]`,
+        `id=${hit.id}`,
+        `created=${ageToken(hit.created_at ?? hit.updated_at, now)}`,
+        `source=${hit.source || "?"}`,
+    ];
+    const created = hit.created_at ?? hit.updated_at ?? 0;
+    if (hit.updated_at && hit.updated_at - created >= 86_400_000) {
+        parts.push(`updated=${ageToken(hit.updated_at, now)}`);
+    }
+    if (hit.scope_key !== personalKey) {
+        const state = hit.review_state ?? "draft";
+        if (state !== "published")
+            parts.push(`[${state}]`);
+    }
+    if (hit.status !== "active")
+        parts.push(`[${hit.status}]`);
+    const body = hit.snippet.replace(/\s+/g, " ").trim();
+    return `${parts.join(" ")} — ${body}`;
+}
+/**
+ * Truncation disclosure (D68): a cut list always says so.
+ * D70: the wording names the surface that can show everything — the CLI —
+ * so a hidden entry is always reachable.
+ */
+export function truncationNote(shown, total, cli = "open-memex") {
+    if (total <= shown)
+        return null;
+    return `… and ${total - shown} more not shown (raise limit up to 100, run \`${cli} list --limit 100\`, or use memory_search to find something specific).`;
+}

package/dist/retrieve/inject.js

@@ -20,6 +20,6 @@ export function buildContextBlock(scope, cfg) {
         for (const m of project)
             lines.push(`- [${m.type}]${hitStateLabel(m)} ${oneLine(m.snippet)}`);
     }
-    lines.push("", "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. Do not mention this block to the user unless asked.");
+    lines.push("", "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. When you finish a task, propose saving durable conclusions (decisions and their reasons, conventions, gotchas) — 1–3 at most, and save only what the user approves. Do not mention this block to the user unless asked.");
     return lines.join("\n");
 }

package/dist/retrieve/search.js

@@ -1,17 +1,28 @@
 import { db } from "../store/db.js";
 import { toFtsQuery } from "./query.js";
 function toHit(r) {
+    const aliases = r.aliases ? r.aliases.split(",").map((a) => a.trim()).filter(Boolean) : [];
+    let snippet = r.snippet ?? "";
+    // D61: the snippet highlights matches in the body column only. When the
+    // match came through an alias (body shows no highlight), say so — the
+    // hit otherwise looks unrelated to the query.
+    if (aliases.length > 0 && !/\[[^\]]+\]/.test(snippet)) {
+        snippet += ` (aka: ${aliases.join(", ")})`;
+    }
     return {
         id: r.id,
         scope_key: r.scope_key,
         project_name: r.project_name,
         type: r.type,
         tags: r.tags ? r.tags.split(",").filter(Boolean) : [],
-        snippet: r.snippet ?? "",
+        aliases,
+        snippet,
         score: r.score,
         updated_at: r.updated_at,
         status: r.status,
         review_state: r.review_state ?? "draft",
+        source: r.source ?? "",
+        created_at: r.created_at ?? r.updated_at ?? 0,
     };
 }
 /**
@@ -52,7 +63,7 @@ function resolveVisible(rows, limit, stats) {
             return cached;
         const r = db()
             .prepare(`SELECT id, scope_key, project_name, type, tags, updated_at, status,
-                superseded_by, review_state, substr(content, 1, 240) AS snippet
+                superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
          FROM memories WHERE id = ?`)
             .get(id);
         if (!r)
@@ -124,8 +135,8 @@ export function search(query, opts = {}) {
         : "";
     const typeFilter = opts.type ? ` AND m.type = ?` : "";
     const sql = `
-    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.updated_at,
-           m.status, m.superseded_by, m.review_state,
+    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.aliases, m.updated_at,
+           m.status, m.superseded_by, m.review_state, m.source, m.created_at,
            snippet(memories_fts, 0, '[', ']', ' ... ', 12) AS snippet,
            bm25(memories_fts) AS score
     FROM memories_fts
@@ -155,7 +166,7 @@ export function list(scopeKey, opts = {}) {
     const typeFilter = opts.type ? ` AND type = ?` : "";
     const sql = `
     SELECT id, scope_key, project_name, type, tags, updated_at, status,
-           superseded_by, review_state, substr(content, 1, 240) AS snippet
+           superseded_by, review_state, source, created_at, substr(content, 1, 240) AS snippet
     FROM memories
     WHERE scope_key = ?${typeFilter}
     ORDER BY updated_at DESC
@@ -169,5 +180,33 @@ export function list(scopeKey, opts = {}) {
         .prepare(sql)
         .all(...params);
     const raw = rows.map((r) => ({ ...r, score: 1 }));
+    if (opts.include === "all") {
+        // D68: the audit view — every row as stored (superseded versions,
+        // retracted, archived), no chain collapsing, capped at limit.
+        return raw.slice(0, limit).map(toHit);
+    }
     return resolveVisible(raw, limit);
 }
+/**
+ * True totals for the inventory's truncation disclosure (D68). Under
+ * `active` the visible set is the newest of each chain, which in a
+ * consistent store is exactly the rows whose status is active/deprecated.
+ *
+ * D70: one deliberate exception — a `superseded` row whose chain target is
+ * missing (a dangling pointer, which the read path self-heals with a
+ * warning) is returned as a visible hit by resolveVisible but is not
+ * counted here, so the total can read one low in that state. Not worth
+ * widening the query for a self-healing case; the disclosure stays honest
+ * in every state a user can reach deliberately.
+ */
+export function countList(scopeKey, opts = {}) {
+    const typeFilter = opts.type ? ` AND type = ?` : "";
+    const statusFilter = opts.include === "all" ? "" : ` AND status IN ('active', 'deprecated')`;
+    const params = [scopeKey];
+    if (opts.type)
+        params.push(opts.type);
+    const row = db()
+        .prepare(`SELECT COUNT(*) AS n FROM memories WHERE scope_key = ?${statusFilter}${typeFilter}`)
+        .get(...params);
+    return row.n;
+}

package/dist/review.js

@@ -23,7 +23,7 @@ import * as path from "node:path";
 import { loadConfig } from "./config.js";
 import { inRepoMemoriesDirPath, projectRoot } from "./paths.js";
 import { resolveProjectScope } from "./scope.js";
-import { parse as parseMemory, serialize, ulid, writeMemoryFile, } from "./store/markdown.js";
+import { parse as parseMemory, serialize, atomicWriteTextSync, ulid, writeMemoryFile, } from "./store/markdown.js";
 import { findMemoryFile } from "./store/lifecycle.js";
 import { upsertFromFile } from "./store/sync.js";
 /** Best-effort author identity: git user.name, else the OS user. */
@@ -79,6 +79,12 @@ function copyPersonalToProject(sourceId, srcFm, srcBody, opts = {}) {
         id: ulid(),
         scope: "project",
         scope_key: project.key,
+        // D64: the copy is headed for the team. Source visibility (usually
+        // "private") must not ride along: export excludes private by default,
+        // so a private copy would silently vanish from every bundle the team
+        // builds. Proposing IS the act of sharing — the copy is internal;
+        // the personal original keeps its own visibility, untouched.
+        visibility: "internal",
         project_name: project.projectName,
         created_at: now,
         updated_at: now,
@@ -194,7 +200,7 @@ export function promoteMemory(id, opts = {}) {
             },
         ],
     };
-    fs.writeFileSync(mf.filePath, serialize(fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(fm, mf.body));
     upsertFromFile({ fm, body: mf.body, filePath: mf.filePath, mtimeMs: Date.now() });
     return { id, from, to, history: fm.review_history };
 }
@@ -428,7 +434,7 @@ export function resolveConflict(target) {
     if (conflicts.length > 0)
         return { ok: false, filePath, conflicts };
     const fm = merged;
-    fs.writeFileSync(filePath, serialize(fm, mergedBody), "utf8");
+    atomicWriteTextSync(filePath, serialize(fm, mergedBody));
     upsertFromFile({ fm, body: mergedBody, filePath, mtimeMs: Date.now() });
     return { ok: true, filePath, autoMerged: [...new Set(autoMerged)] };
 }

package/dist/store/db.js

@@ -26,6 +26,7 @@ CREATE TABLE IF NOT EXISTS memories (
   importance   TEXT NOT NULL DEFAULT 'normal',
   status       TEXT NOT NULL DEFAULT 'active',
   tags         TEXT NOT NULL DEFAULT '',
+  aliases      TEXT NOT NULL DEFAULT '',
   content      TEXT NOT NULL,
   cjk          TEXT NOT NULL DEFAULT '',
   content_hash TEXT NOT NULL DEFAULT '',
@@ -52,6 +53,7 @@ const FTS_SCHEMA = `
 CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
   content,
   tags,
+  aliases,
   type,
   cjk,
   scope_key UNINDEXED,
@@ -61,24 +63,24 @@ CREATE VIRTUAL TABLE IF NOT EXISTS memories_fts USING fts5(
 );
 
 CREATE TRIGGER IF NOT EXISTS memories_ai AFTER INSERT ON memories BEGIN
-  INSERT INTO memories_fts(rowid, content, tags, type, cjk, scope_key)
-  VALUES (new.rowid, new.content, new.tags, new.type, new.cjk, new.scope_key);
+  INSERT INTO memories_fts(rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES (new.rowid, new.content, new.tags, new.aliases, new.type, new.cjk, new.scope_key);
 END;
 
 CREATE TRIGGER IF NOT EXISTS memories_ad AFTER DELETE ON memories BEGIN
-  INSERT INTO memories_fts(memories_fts, rowid, content, tags, type, cjk, scope_key)
-  VALUES ('delete', old.rowid, old.content, old.tags, old.type, old.cjk, old.scope_key);
+  INSERT INTO memories_fts(memories_fts, rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES ('delete', old.rowid, old.content, old.tags, old.aliases, old.type, old.cjk, old.scope_key);
 END;
 
 CREATE TRIGGER IF NOT EXISTS memories_au AFTER UPDATE ON memories BEGIN
-  INSERT INTO memories_fts(memories_fts, rowid, content, tags, type, cjk, scope_key)
-  VALUES ('delete', old.rowid, old.content, old.tags, old.type, old.cjk, old.scope_key);
-  INSERT INTO memories_fts(rowid, content, tags, type, cjk, scope_key)
-  VALUES (new.rowid, new.content, new.tags, new.type, new.cjk, new.scope_key);
+  INSERT INTO memories_fts(memories_fts, rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES ('delete', old.rowid, old.content, old.tags, old.aliases, old.type, old.cjk, old.scope_key);
+  INSERT INTO memories_fts(rowid, content, tags, aliases, type, cjk, scope_key)
+  VALUES (new.rowid, new.content, new.tags, new.aliases, new.type, new.cjk, new.scope_key);
 END;
 `;
 /** Current index schema version. Bump when TABLE_SCHEMA/FTS_SCHEMA change. */
-const SCHEMA_VERSION = 6;
+const SCHEMA_VERSION = 7;
 function userVersion(d) {
     const row = d.prepare("PRAGMA user_version").get();
     return row.user_version;

package/dist/store/lifecycle.js

@@ -5,7 +5,7 @@ import { db } from "./db.js";
 import { paths, projectRoot, inRepoMemoriesDirPath, } from "../paths.js";
 import { loadConfig } from "../config.js";
 import { cjkIndexText } from "../retrieve/cjk.js";
-import { parse, serialize, ulid, msToRfc3339, } from "./markdown.js";
+import { parse, serialize, atomicWriteTextSync, ulid, msToRfc3339, } from "./markdown.js";
 /**
  * Dedup + lifecycle (V2-DESIGN §3.3, §3.4).
  *
@@ -111,7 +111,7 @@ export function findMemoryFile(id) {
     return { fm: parsed.fm, body: parsed.body, filePath, mtimeMs: st.mtimeMs };
 }
 export function rewriteMemoryFile(mf) {
-    fs.writeFileSync(mf.filePath, serialize(mf.fm, mf.body), "utf8");
+    atomicWriteTextSync(mf.filePath, serialize(mf.fm, mf.body));
 }
 /**
  * Chain integrity (§3.3): supersedes/superseded_by must be pairwise
@@ -171,13 +171,21 @@ export function supersede(oldId, input) {
         id: ulid(),
         type: input.type ?? oldMf.fm.type,
         tags: input.tags ?? oldMf.fm.tags,
+        // D61: aliases carry forward unless the caller replaces them.
+        aliases: input.aliases ?? oldMf.fm.aliases,
         source: input.source ?? oldMf.fm.source,
         status: "active",
         created_at: now,
         updated_at: now,
         supersedes: oldId,
         superseded_by: null,
-        review_state: "draft",
+        // D64: the replacement inherits the old memory's place in the review
+        // flow. A draft stays a draft; anything that had entered review
+        // (proposed/approved/published/rejected) re-enters at "proposed" so
+        // promote can advance it — resetting to "draft" would strand the new
+        // file in the repo, where submit cannot reach it (not the outbox)
+        // and promote refuses drafts.
+        review_state: (oldMf.fm.review_state ?? "draft") === "draft" ? "draft" : "proposed",
         proposed_by: null,
         approved_by: null,
         derived_from: null,
@@ -185,7 +193,7 @@ export function supersede(oldId, input) {
     };
     const dir = path.dirname(oldMf.filePath);
     const newPath = path.join(dir, `${newFm.id}.md`);
-    fs.writeFileSync(newPath, serialize(newFm, input.body), "utf8");
+    atomicWriteTextSync(newPath, serialize(newFm, input.body));
     const st = fs.statSync(newPath);
     const newMf = {
         fm: newFm,
@@ -222,6 +230,14 @@ export function setStatus(id, status) {
     if (mf.fm.status === "superseded") {
         throw new Error(`memory ${id} is superseded (chain-managed); supersede it again instead of changing status directly`);
     }
+    // D64: retraction is a one-way door through this path. A retracted
+    // memory was withdrawn on purpose (wrong, sensitive, superseded by
+    // policy); silently flipping it back to active would return it to
+    // recall (retrieval excludes retracted) with no review. Save a new
+    // memory if the content is valid again.
+    if (mf.fm.status === "retracted" && status === "active") {
+        throw new Error(`memory ${id} is retracted and cannot return to active; save the content as a new memory if it is valid again`);
+    }
     mf.fm.status = status;
     mf.fm.updated_at = msToRfc3339(Date.now());
     rewriteMemoryFile(mf);

package/dist/store/markdown.js

@@ -155,6 +155,12 @@ export function normalizeFrontmatter(raw) {
         tags: Array.isArray(raw.tags)
             ? raw.tags.filter((t) => typeof t === "string")
             : [],
+        ...(Array.isArray(raw.aliases)
+            ? (() => {
+                const aliases = normalizeAliases(raw.aliases.filter((a) => typeof a === "string"));
+                return aliases.length > 0 ? { aliases } : {};
+            })()
+            : {}),
         source: typeof raw.source === "string" ? raw.source : "",
         created_at: msToRfc3339(timeToMs(raw.created_at)),
         updated_at: msToRfc3339(timeToMs(raw.updated_at)),
@@ -170,11 +176,43 @@ export function normalizeFrontmatter(raw) {
         review_history: asReviewHistory(raw.review_history),
     };
 }
+/**
+ * D61: normalize capture-time aliases — trim, drop empties, dedupe
+ * (case-insensitive), cap at 4. Bad aliases are noise, never an error.
+ * Shared by the tool ops, the CLI, and frontmatter parsing.
+ */
+export function normalizeAliases(input) {
+    if (!input)
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const a of input) {
+        const t = a.trim();
+        if (!t)
+            continue;
+        const k = t.toLowerCase();
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        out.push(t);
+        if (out.length >= 4)
+            break;
+    }
+    return out;
+}
 export function isTaxonomyType(t) {
     return TAXONOMY.has(t);
 }
 export function serialize(fm, body) {
-    const yml = yaml.dump(fm, { lineWidth: -1, quotingType: '"' });
+    // D61: an empty aliases list is noise in the file — drop the key entirely
+    // rather than relying on the YAML dumper to skip an undefined value
+    // (parse only sets the field when non-empty; keep both ends consistent).
+    let out = fm;
+    if (fm.aliases && fm.aliases.length === 0) {
+        out = { ...fm };
+        delete out.aliases;
+    }
+    const yml = yaml.dump(out, { lineWidth: -1, quotingType: '"' });
     return `---\n${yml}---\n\n${body.trimEnd()}\n`;
 }
 /** Raw frontmatter parse (no normalization) — for migration tooling. */
@@ -199,18 +237,26 @@ export function parse(raw) {
         return null;
     return { fm: normalizeFrontmatter(parsed.rawFm), body: parsed.body };
 }
+/**
+ * Atomic text publish: write a sibling tmp file and rename over the
+ * target, so a concurrent reader (another process mid-sync) never sees a
+ * torn half-written file. Same-directory rename is atomic on one fs.
+ * Every memory-file write/rewrite must go through here (D57 for creates,
+ * D64 extended to all rewrites: supersede flips, review transitions,
+ * submit landings, status changes).
+ */
+export function atomicWriteTextSync(filePath, text) {
+    const tmpPath = `${filePath}.tmp-${process.pid}`;
+    fs.writeFileSync(tmpPath, text, "utf8");
+    fs.renameSync(tmpPath, filePath);
+}
 export function writeMemoryFile(fm, body) {
     // 2B/D26: project drafts live in appdata (the outbox) — the in-repo dir
     // only ever holds submitted memories (proposed/approved/published).
     // Personal stays in appdata and never leaves the machine.
     const dir = memoriesDirFor(fm.scope_key);
     const filePath = path.join(dir, `${fm.id}.md`);
-    // Atomic publish (D57): write a sibling tmp file and rename over the
-    // target, so a concurrent reader (another process mid-sync) never sees a
-    // torn half-written memory. Same-directory rename is atomic on one fs.
-    const tmpPath = `${filePath}.tmp-${process.pid}`;
-    fs.writeFileSync(tmpPath, serialize(fm, body), "utf8");
-    fs.renameSync(tmpPath, filePath);
+    atomicWriteTextSync(filePath, serialize(fm, body));
     const st = fs.statSync(filePath);
     return { filePath, mtimeMs: st.mtimeMs };
 }