sandstream-kit 1.0.1 → 1.2.0

package/README.md

@@ -252,6 +252,24 @@ Production credentials are gated behind explicit env-switching and short-lived e
 - Supply-chain findings auto-append to `.kit-audit.jsonl` (one JSON line per finding) for SIEM ingest
 - Releases ship with SLSA provenance (`npm publish --provenance`), CycloneDX + SPDX SBOMs on every GitHub release, cosign-signed Docker images, and weekly OpenSSF Scorecard
 
+## Memory
+
+`kit memory` gives an agent a local-first, deterministic second brain — it stores
+your raw conversation history and searches it *before answering*, so it pulls
+receipts instead of guessing. SQLite + FTS5, two hooks, no vectors, no model calls.
+A private personal tier (encrypted backup so a stolen laptop doesn't lose your
+context) plus a curated, area-organized **shared** tier that travels with the repo
+and is reviewed like code.
+
+```bash
+kit memory install && kit memory index
+kit memory search "what did we decide about X"   # project-scoped recall
+kit memory area stripe                            # shared: how we built it, status, security
+```
+
+Full reference: [`docs/MEMORY.md`](docs/MEMORY.md). Schema + two-hook design
+credited to [cloudctx](https://github.com/chadptk1238/cloudctx) (MIT).
+
 ## Lock Files
 
 kit uses lock files in `.kit/` to track exact versions of skills and tools:

package/dist/check-web-search.js

@@ -113,12 +113,43 @@ export async function checkWebSearch(config) {
                 };
             }
         case "google":
-            return {
-                provider,
-                configured: true,
-                healthy: true,
-                error: "Google Search not yet implemented in kit",
-            };
+            if (!config.apiKey || !config.cx) {
+                return {
+                    provider,
+                    configured: false,
+                    healthy: false,
+                    error: "Google Custom Search needs web.search.apiKey + web.search.cx (Programmable Search engine id)",
+                };
+            }
+            try {
+                // Custom Search JSON API — key + cx are query params by design.
+                const response = await fetchWithTimeout(`https://www.googleapis.com/customsearch/v1?key=${encodeURIComponent(config.apiKey)}&cx=${encodeURIComponent(config.cx)}&q=test&num=1`);
+                if (response.ok) {
+                    return { provider, configured: true, healthy: true };
+                }
+                if (response.status === 400 || response.status === 401 || response.status === 403) {
+                    return {
+                        provider,
+                        configured: true,
+                        healthy: false,
+                        error: "Invalid Google API key or cx (request rejected)",
+                    };
+                }
+                return {
+                    provider,
+                    configured: true,
+                    healthy: false,
+                    error: `API returned status ${response.status}`,
+                };
+            }
+            catch (err) {
+                return {
+                    provider,
+                    configured: true,
+                    healthy: false,
+                    error: err instanceof Error ? err.message : "API check failed",
+                };
+            }
         case "custom":
             if (!url) {
                 return {

package/dist/check-web-search.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-web-search.js","sourceRoot":"","sources":["../src/check-web-search.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAyC;IAEzC,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAUD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAwB;IAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mCAAmC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAEvB,uCAAuC;IACvC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sDAAsD;iBAC9D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;wBACb,GAAG;qBACJ,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE;iBACnD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;iBACjE,CAAC;YACJ,CAAC;QAEH,KAAK,OAAO;YACV,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kEAAkE;iBAC1E,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,wBAAwB;gBACxB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,uDAAuD,EACvD;oBACE,OAAO,EAAE;wBACP,QAAQ,EAAE,kBAAkB;wBAC5B,sBAAsB,EAAE,MAAM,CAAC,MAAM;qBACtC;iBACa,CACjB,CAAC;gBAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvD,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,sDAAsD;qBAC9D,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB,QAAQ,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBAC/D,CAAC;YACJ,CAAC;QAEH,KAAK,QAAQ;YACX,OAAO;gBACL,QAAQ;gBACR,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,0CAA0C;aAClD,CAAC;QAEJ,KAAK,QAAQ;YACX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,4DAA4D;iBACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3C,kEAAkE;oBAClE,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;wBACb,GAAG;qBACJ,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,uBAAuB,QAAQ,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBAC/D,CAAC;YACJ,CAAC;QAEH;YACE,OAAO;gBACL,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB,QAAQ,EAAE;aACvC,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"check-web-search.js","sourceRoot":"","sources":["../src/check-web-search.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,IAAyC;IAEzC,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAUD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAwB;IAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,mCAAmC;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAEvB,uCAAuC;IACvC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sDAAsD;iBAC9D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,6DAA6D;gBAC7D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;wBACb,GAAG;qBACJ,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE;iBACnD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;iBACjE,CAAC;YACJ,CAAC;QAEH,KAAK,OAAO;YACV,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,kEAAkE;iBAC1E,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,wBAAwB;gBACxB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,uDAAuD,EACvD;oBACE,OAAO,EAAE;wBACP,QAAQ,EAAE,kBAAkB;wBAC5B,sBAAsB,EAAE,MAAM,CAAC,MAAM;qBACtC;iBACa,CACjB,CAAC;gBAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;qBACd,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvD,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,sDAAsD;qBAC9D,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB,QAAQ,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBAC/D,CAAC;YACJ,CAAC;QAEH,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjC,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8FAA8F;iBACtG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,kDAAkD,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CACvI,CAAC;gBACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvD,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAClF,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,iDAAiD;qBACzD,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB,QAAQ,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBAC/D,CAAC;YACJ,CAAC;QAEH,KAAK,QAAQ;YACX,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,KAAK;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,4DAA4D;iBACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3C,kEAAkE;oBAClE,OAAO;wBACL,QAAQ;wBACR,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,IAAI;wBACb,GAAG;qBACJ,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,uBAAuB,QAAQ,CAAC,MAAM,EAAE;iBAChD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,QAAQ;oBACR,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,KAAK;oBACd,GAAG;oBACH,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;iBAC/D,CAAC;YACJ,CAAC;QAEH;YACE,OAAO;gBACL,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB,QAAQ,EAAE;aACvC,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { writeFile, access, mkdir } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import { resolve, dirname, join } from "node:path";
+import { resolve, dirname, join, basename } from "node:path";
 import { loadConfig, resolveActiveEnvironment } from "./config.js";
 import { checkTools } from "./check-tools.js";
 import { checkServices } from "./check-services.js";
@@ -56,6 +56,7 @@ import { cmdFix } from "./fix.js";
 import { promptConfirm } from "./utils/prompt.js";
 import { startMcpServer } from "./mcp-server.js";
 import { c } from "./utils/colors.js";
+import { gatherStatus } from "./status.js";
 import { runDoctor } from "./doctor.js";
 import { inspectEnv } from "./env-inspect.js";
 import { detectStack } from "./stack-detector.js";
@@ -68,6 +69,17 @@ import { listServices, openService } from "./open.js";
 import { gatherProjectContext } from "./context.js";
 import { runTriage, listTriageTools } from "./triage.js";
 import { parsePkgSpec, installPkg } from "./pkg.js";
+import { openMemoryDb, getStats, getMemoryDbPath, searchMessages } from "./memory/db.js";
+import { indexAllHarnesses } from "./memory/parser.js";
+import { mergeDb } from "./memory/merge.js";
+import { getCurrentProjectRoot } from "./memory/project.js";
+import { scanDbForSecrets } from "./memory/scan.js";
+import { backupEncrypted, restoreEncrypted } from "./memory/backup.js";
+import { shareEntry, listAreas, queryArea, getSharedPath, } from "./memory/shared.js";
+import { userPromptSubmitReminder, runSessionEndIndex, sessionStartRecovery } from "./memory/hook.js";
+import { installMemoryHooks, uninstallMemoryHooks, getClaudeSettingsPath, } from "./memory/install.js";
+import { palAdd, palList, palDone, palSnooze, palAutoVerify, importLegacyLedger, } from "./memory/pal.js";
+import { saveThread, listThreads, removeThread, latestSessionId, resolveThread, } from "./memory/threads.js";
 const KIT_FILE = ".kit.toml";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const KIT_VERSION = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-8")).version;
@@ -3319,6 +3331,21 @@ async function cmdContext() {
         return false;
     }
 }
+async function cmdStatus() {
+    const items = await gatherStatus();
+    if (hasFlag(process.argv, "--json")) {
+        console.log(JSON.stringify(items, null, 2));
+        return true;
+    }
+    const done = items.filter((i) => i.ok).length;
+    console.log(`${c.bold}kit status${c.reset}  ${c.dim}${done}/${items.length} set up${c.reset}`);
+    for (const item of items) {
+        const mark = item.ok ? `${c.green}✓${c.reset}` : `${c.yellow}○${c.reset}`;
+        const hint = !item.ok && item.hint ? `  ${c.dim}→ ${item.hint}${c.reset}` : "";
+        console.log(`  ${mark} ${item.label}  ${c.dim}${item.detail}${c.reset}${hint}`);
+    }
+    return true;
+}
 async function cmdWhoami() {
     const jsonMode = hasFlag(process.argv, "--json");
     let config = {};
@@ -3390,7 +3417,24 @@ function cmdVersion() {
     return true;
 }
 const COMMAND_HELP = {
+    status: "Adoption checklist — what's set up across kit + the next step for each gap",
     check: "Check status of all tools, services, secrets, and lock files",
+    memory: "Local conversation memory — index transcripts + show stats",
+    "memory index": "Index ~/.claude transcripts into the SQLite memory store",
+    "memory search": "Full-text search memory (current project; --global for all)",
+    "memory stats": "Show what the local memory store contains",
+    "memory merge": "Merge another machine's memory.db into this one (dedup by uuid)",
+    "memory install": "Wire UserPromptSubmit + SessionEnd + SessionStart (recovery) hooks into ~/.claude/settings.json",
+    "memory scan": "Scan the memory store for stored secrets (exit 1 if any found)",
+    "memory backup": "Encrypted backup of the memory store (AES-256-GCM; KIT_MEMORY_PASSPHRASE)",
+    "memory restore": "Restore an encrypted memory backup (e.g. on a new machine)",
+    "memory share": "Promote a curated, secret-scanned entry to the shared (team) memory",
+    "memory areas": "List shared responsibility areas (stripe, whatsapp, …)",
+    "memory area": "Show shared entries for one area (decisions, how-built, status, security)",
+    "memory pal": "Pending action ledger — list/add/done/snooze/verify/import 'blocked-on-you' items",
+    "memory save": "Bookmark the current session as a named copilot",
+    "memory threads": "List saved copilots (current project; --global for all)",
+    "memory resume": "Print the resume command for a saved copilot (by name or number)",
     init: "Detect stack, generate .kit.toml, and run full setup",
     upgrade: "Update lock files from .kit.toml",
     install: "Install missing tools via mise",
@@ -3858,6 +3902,474 @@ async function showSkippedCommitBanner() {
         /* banner is best-effort — never break the CLI */
     }
 }
+/**
+ * `kit memory` — local conversation memory (SQLite + FTS5). Deterministic and
+ * zero-LLM: it stores raw transcripts and searches them; it never calls a model.
+ */
+async function cmdMemory() {
+    const subcommand = process.argv[3];
+    const jsonMode = hasFlag(process.argv, "--json");
+    if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+        console.log("kit memory — local conversation memory (SQLite + FTS5)");
+        console.log("\nUsage:");
+        console.log("  kit memory index            Index ~/.claude transcripts into the memory store");
+        console.log("  kit memory search <query>   Search memory (current project; --global for all)");
+        console.log("  kit memory stats            Show what the memory store contains");
+        console.log("  kit memory merge <file>     Merge another machine's memory.db into this one");
+        console.log("  kit memory install          Wire the 2 hooks into ~/.claude/settings.json");
+        console.log("  kit memory uninstall        Remove the hooks");
+        console.log("  kit memory pal [list|add|done|snooze|verify|import]   Pending action ledger");
+        console.log("  kit memory save <name>      Bookmark the current session as a named copilot");
+        console.log("  kit memory threads          List saved copilots (--global for all)");
+        console.log("  kit memory resume <name|n>  Print the resume command for a saved copilot");
+        console.log("  kit memory forget <name>    Remove a saved copilot");
+        console.log("  kit memory scan             Scan the store for stored secrets");
+        console.log("  kit memory backup <file>    Encrypted backup (set KIT_MEMORY_PASSPHRASE)");
+        console.log("  kit memory restore <file>   Restore an encrypted backup (new machine)");
+        console.log("  kit memory share …          Promote a curated entry to shared (team) memory");
+        console.log("  kit memory areas            List shared responsibility areas");
+        console.log("  kit memory area <name>      Show shared entries for one area");
+        return true;
+    }
+    if (subcommand === "index") {
+        const db = openMemoryDb();
+        const t0 = Date.now();
+        const byHarness = indexAllHarnesses(db);
+        const ms = Date.now() - t0;
+        db.close();
+        if (jsonMode) {
+            console.log(JSON.stringify({ byHarness, ms }));
+            return true;
+        }
+        let messages = 0;
+        let toolUses = 0;
+        let files = 0;
+        let skipped = 0;
+        for (const r of Object.values(byHarness)) {
+            messages += r.messages;
+            toolUses += r.toolUses;
+            files += r.files;
+            skipped += r.filesSkipped;
+        }
+        console.log(`${c.green}✓${c.reset} indexed ${c.bold}${messages}${c.reset} messages + ${toolUses} tool-uses from ${files} sessions${skipped ? `, ${skipped} unchanged` : ""} ${c.dim}(${ms}ms)${c.reset}`);
+        for (const [harness, r] of Object.entries(byHarness)) {
+            if (r.files || r.messages) {
+                console.log(`  ${c.dim}${harness}: ${r.messages} msg · ${r.files} sessions${r.filesSkipped ? ` · ${r.filesSkipped} unchanged` : ""}${c.reset}`);
+            }
+        }
+        return true;
+    }
+    if (subcommand === "merge") {
+        const sourcePath = process.argv[4];
+        if (!sourcePath) {
+            console.error(`${c.red}usage: kit memory merge <other-machine-memory.db>${c.reset}`);
+            return false;
+        }
+        const db = openMemoryDb();
+        try {
+            const r = mergeDb(db, sourcePath);
+            console.log(`${c.green}✓${c.reset} merged ${c.bold}${r.messages}${c.reset} messages + ${r.toolUses} tool-uses · ${r.sessions} sessions · ${r.pending} pending · ${r.threads} copilots ${c.dim}from ${sourcePath}${c.reset}`);
+        }
+        catch (err) {
+            db.close();
+            console.error(`${c.red}${err.message}${c.reset}`);
+            return false;
+        }
+        db.close();
+        return true;
+    }
+    if (subcommand === "stats") {
+        const db = openMemoryDb();
+        const s = getStats(db);
+        db.close();
+        if (jsonMode) {
+            console.log(JSON.stringify(s));
+            return true;
+        }
+        console.log(`${c.bold}kit memory${c.reset}  ${c.dim}${s.dbPath}${c.reset}`);
+        console.log(`  sessions   ${s.sessions}`);
+        console.log(`  messages   ${s.messages}`);
+        console.log(`  tool-uses  ${s.toolUses}`);
+        console.log(`  pending    ${s.pendingOpen} ${c.dim}(open action items)${c.reset}`);
+        console.log(`  size       ${Math.round(s.sizeBytes / 1024)} KB`);
+        return true;
+    }
+    if (subcommand === "search") {
+        const terms = process.argv.slice(4).filter((a) => !a.startsWith("--"));
+        const query = terms.join(" ").trim();
+        if (!query) {
+            console.error(`${c.red}usage: kit memory search <query> [--global] [--project=<path>] [--limit=N]${c.reset}`);
+            return false;
+        }
+        const limit = Number(flagValue(process.argv, "--limit") ?? "20") || 20;
+        const projectPath = hasFlag(process.argv, "--global")
+            ? undefined
+            : (flagValue(process.argv, "--project") ?? getCurrentProjectRoot());
+        const db = openMemoryDb();
+        const hits = searchMessages(db, query, { limit, projectPath });
+        db.close();
+        if (jsonMode) {
+            console.log(JSON.stringify(hits));
+            return true;
+        }
+        const scope = projectPath ? `${c.dim}in ${projectPath}${c.reset}` : `${c.dim}(global)${c.reset}`;
+        if (!hits.length) {
+            console.log(`${c.dim}no matches for "${query}" ${projectPath ?? "(global)"}${c.reset}`);
+            return true;
+        }
+        console.log(`${c.bold}${hits.length}${c.reset} match(es) ${scope}`);
+        for (const h of hits) {
+            const snippet = (h.content ?? "").replace(/\s+/g, " ").slice(0, 120);
+            console.log(`  ${c.dim}${h.timestamp ?? "?"}${c.reset} ${c.bold}${h.role ?? h.uuid ?? ""}${c.reset}  ${snippet}`);
+        }
+        return true;
+    }
+    if (subcommand === "hook") {
+        // Internal: invoked by Claude Code hooks. Fail-open — never block.
+        const event = process.argv[4];
+        if (event === "user-prompt-submit") {
+            const text = userPromptSubmitReminder();
+            if (text)
+                console.log(text);
+            return true;
+        }
+        if (event === "session-end") {
+            runSessionEndIndex();
+            return true;
+        }
+        if (event === "session-start") {
+            const text = sessionStartRecovery();
+            if (text)
+                console.log(text);
+            return true;
+        }
+        console.error(`${c.red}Unknown hook event: ${event ?? "(none)"}${c.reset}`);
+        return false;
+    }
+    if (subcommand === "install") {
+        const { added, alreadyPresent } = installMemoryHooks();
+        for (const e of added)
+            console.log(`${c.green}✓${c.reset} installed ${e} hook`);
+        for (const e of alreadyPresent)
+            console.log(`${c.dim}• ${e} hook already present${c.reset}`);
+        console.log(`${c.dim}settings: ${getClaudeSettingsPath()}${c.reset}`);
+        return true;
+    }
+    if (subcommand === "uninstall") {
+        const { removed } = uninstallMemoryHooks();
+        if (removed.length) {
+            for (const e of removed)
+                console.log(`${c.green}✓${c.reset} removed ${e} hook`);
+        }
+        else {
+            console.log(`${c.dim}no kit memory hooks were installed${c.reset}`);
+        }
+        return true;
+    }
+    if (subcommand === "share") {
+        const area = flagValue(process.argv, "--area");
+        const title = flagValue(process.argv, "--title");
+        const kind = (flagValue(process.argv, "--kind") ?? "note");
+        const body = flagValue(process.argv, "--body") ?? "";
+        const ref = flagValue(process.argv, "--ref");
+        if (!area || !title) {
+            console.error(`${c.red}usage: kit memory share --area <a> --title <t> [--kind decision|convention|how-built|status|security|note] [--body <b>] [--ref <r>]${c.reset}`);
+            return false;
+        }
+        const root = getCurrentProjectRoot();
+        try {
+            const e = shareEntry(root, { area, kind, title, body, refs: ref ? [ref] : [] }, new Date().toISOString());
+            console.log(`${c.green}✓${c.reset} shared ${c.bold}${e.id}${c.reset} to area ${c.bold}${area}${c.reset} ${c.dim}(${getSharedPath(root)})${c.reset}`);
+            console.log(`${c.dim}commit .kit/shared/memory.jsonl + open a PR — shared memory is reviewed like code${c.reset}`);
+        }
+        catch (err) {
+            console.error(`${c.red}${err.message}${c.reset}`);
+            return false;
+        }
+        return true;
+    }
+    if (subcommand === "areas") {
+        const areas = listAreas(getCurrentProjectRoot());
+        if (jsonMode) {
+            console.log(JSON.stringify(areas));
+            return true;
+        }
+        if (!areas.length) {
+            console.log(`${c.dim}no shared areas yet — add one with kit memory share${c.reset}`);
+            return true;
+        }
+        console.log(`${c.bold}${areas.length}${c.reset} responsibility area(s):`);
+        for (const a of areas) {
+            console.log(`  ${c.bold}${a.area}${c.reset} ${c.dim}· ${a.count} entr${a.count === 1 ? "y" : "ies"}${c.reset}`);
+        }
+        return true;
+    }
+    if (subcommand === "area") {
+        const name = process.argv[4];
+        if (!name) {
+            console.error(`${c.red}usage: kit memory area <name>${c.reset}`);
+            return false;
+        }
+        const entries = queryArea(getCurrentProjectRoot(), name);
+        if (jsonMode) {
+            console.log(JSON.stringify(entries));
+            return true;
+        }
+        if (!entries.length) {
+            console.log(`${c.dim}no shared memory for area '${name}'${c.reset}`);
+            return true;
+        }
+        console.log(`${c.bold}${name}${c.reset} ${c.dim}· ${entries.length} entr${entries.length === 1 ? "y" : "ies"}${c.reset}`);
+        for (const e of entries) {
+            const prov = `${e.author}${e.source_ref ? ` @${e.source_ref}` : ""}`;
+            console.log(`  ${c.bold}[${e.kind}]${c.reset} ${e.title} ${c.dim}— ${prov}${c.reset}`);
+            if (e.body)
+                console.log(`    ${e.body}`);
+            if (e.refs.length)
+                console.log(`    ${c.dim}refs: ${e.refs.join(", ")}${c.reset}`);
+        }
+        return true;
+    }
+    if (subcommand === "scan") {
+        const db = openMemoryDb();
+        const findings = scanDbForSecrets(db);
+        db.close();
+        if (jsonMode) {
+            console.log(JSON.stringify(findings));
+            return !findings.some((f) => f.confidence === "high");
+        }
+        if (!findings.length) {
+            console.log(`${c.green}✓${c.reset} no stored secrets found in the memory store`);
+            return true;
+        }
+        const high = findings.filter((f) => f.confidence === "high");
+        const heuristic = findings.filter((f) => f.confidence === "heuristic");
+        const times = (n) => (n > 1 ? ` ×${n}` : "");
+        if (high.length) {
+            console.log(`${c.red}⚠ ${high.length} high-confidence secret(s):${c.reset}`);
+            for (const f of high) {
+                const proj = f.projects.length ? `${c.bold}[${f.projects.join(", ")}]${c.reset}${c.dim} · ` : "";
+                console.log(`  ${c.bold}${f.label}${c.reset} ${c.dim}${f.preview}${times(f.count)} · ${proj}${f.sample}${c.reset}`);
+            }
+        }
+        else {
+            console.log(`${c.green}✓${c.reset} no high-confidence secrets`);
+        }
+        if (heuristic.length) {
+            const showAll = hasFlag(process.argv, "--all");
+            if (showAll) {
+                console.log(`${c.dim}${heuristic.length} heuristic match(es) (KEY=value patterns — usually env vars / paths):${c.reset}`);
+                for (const f of heuristic) {
+                    console.log(`  ${c.dim}${f.label} ${f.preview}${times(f.count)} · ${f.sample}${c.reset}`);
+                }
+            }
+            else {
+                console.log(`${c.dim}+ ${heuristic.length} heuristic match(es) (likely env vars / paths) — run with --all to see${c.reset}`);
+            }
+        }
+        return high.length === 0; // exit non-zero only on high-confidence findings
+    }
+    if (subcommand === "backup") {
+        const out = process.argv[4];
+        const pass = process.env.KIT_MEMORY_PASSPHRASE ?? flagValue(process.argv, "--passphrase");
+        if (!out) {
+            console.error(`${c.red}usage: kit memory backup <file>  (set KIT_MEMORY_PASSPHRASE)${c.reset}`);
+            return false;
+        }
+        if (!pass) {
+            console.error(`${c.red}set KIT_MEMORY_PASSPHRASE (or --passphrase) — the key is never stored${c.reset}`);
+            return false;
+        }
+        try {
+            backupEncrypted(pass, getMemoryDbPath(), out);
+        }
+        catch (err) {
+            console.error(`${c.red}${err.message}${c.reset}`);
+            return false;
+        }
+        console.log(`${c.green}✓${c.reset} encrypted backup → ${out} ${c.dim}(AES-256-GCM · scrypt)${c.reset}`);
+        return true;
+    }
+    if (subcommand === "restore") {
+        const inFile = process.argv[4];
+        const pass = process.env.KIT_MEMORY_PASSPHRASE ?? flagValue(process.argv, "--passphrase");
+        if (!inFile) {
+            console.error(`${c.red}usage: kit memory restore <file> [--to <path>] [--force]${c.reset}`);
+            return false;
+        }
+        if (!pass) {
+            console.error(`${c.red}set KIT_MEMORY_PASSPHRASE (or --passphrase)${c.reset}`);
+            return false;
+        }
+        const dest = flagValue(process.argv, "--to") ?? getMemoryDbPath();
+        if (existsSync(dest) && !hasFlag(process.argv, "--force")) {
+            console.error(`${c.red}${dest} exists — pass --force to overwrite${c.reset}`);
+            return false;
+        }
+        try {
+            restoreEncrypted(pass, inFile, dest);
+        }
+        catch {
+            console.error(`${c.red}restore failed — wrong passphrase or corrupt backup${c.reset}`);
+            return false;
+        }
+        console.log(`${c.green}✓${c.reset} restored → ${dest}`);
+        return true;
+    }
+    if (subcommand === "save") {
+        const name = process.argv.slice(4).filter((a) => !a.startsWith("--")).join(" ").trim();
+        if (!name) {
+            console.error(`${c.red}usage: kit memory save <name> [--session=<id>]${c.reset}`);
+            return false;
+        }
+        const root = getCurrentProjectRoot();
+        const db = openMemoryDb();
+        const sessionId = flagValue(process.argv, "--session") ?? latestSessionId(db, { projectPath: root });
+        if (!sessionId) {
+            db.close();
+            console.error(`${c.red}no session found for ${root} — index first or pass --session=<id>${c.reset}`);
+            return false;
+        }
+        saveThread(db, { name, sessionId, projectPath: root });
+        db.close();
+        console.log(`${c.green}✓${c.reset} saved copilot ${c.bold}${name}${c.reset} ${c.dim}→ ${sessionId}${c.reset}`);
+        return true;
+    }
+    if (subcommand === "threads") {
+        const projectPath = hasFlag(process.argv, "--global") ? undefined : getCurrentProjectRoot();
+        const db = openMemoryDb();
+        const list = listThreads(db, { projectPath });
+        db.close();
+        if (jsonMode) {
+            console.log(JSON.stringify(list));
+            return true;
+        }
+        if (!list.length) {
+            console.log(`${c.dim}no saved copilots${projectPath ? ` in ${projectPath}` : ""}${c.reset}`);
+            return true;
+        }
+        const scope = projectPath ? `${c.dim}in ${projectPath}${c.reset}` : `${c.dim}(global)${c.reset}`;
+        console.log(`${c.bold}${list.length}${c.reset} saved copilot(s) ${scope}:`);
+        list.forEach((t, i) => {
+            console.log(`  ${c.bold}${i + 1}${c.reset}. ${t.name}  ${c.dim}${t.session_id}${c.reset}`);
+        });
+        console.log(`${c.dim}resume with: kit memory resume <name|number>${c.reset}`);
+        return true;
+    }
+    if (subcommand === "resume") {
+        const ref = process.argv[4];
+        if (!ref) {
+            console.error(`${c.red}usage: kit memory resume <name|number>${c.reset}`);
+            return false;
+        }
+        const projectPath = hasFlag(process.argv, "--global") ? undefined : getCurrentProjectRoot();
+        const db = openMemoryDb();
+        const t = resolveThread(db, ref, { projectPath });
+        db.close();
+        if (!t) {
+            console.error(`${c.red}no saved copilot '${ref}'${c.reset}`);
+            return false;
+        }
+        console.log(`${c.bold}${t.name}${c.reset} — run:`);
+        console.log(`  claude --resume ${t.session_id}`);
+        return true;
+    }
+    if (subcommand === "forget") {
+        const name = process.argv.slice(4).filter((a) => !a.startsWith("--")).join(" ").trim();
+        if (!name) {
+            console.error(`${c.red}usage: kit memory forget <name>${c.reset}`);
+            return false;
+        }
+        const db = openMemoryDb();
+        const ok = removeThread(db, name);
+        db.close();
+        console.log(ok ? `${c.green}✓${c.reset} forgot ${name}` : `${c.dim}no copilot '${name}'${c.reset}`);
+        return true;
+    }
+    if (subcommand === "pal") {
+        const action = process.argv[4] && !process.argv[4].startsWith("--") ? process.argv[4] : "list";
+        const db = openMemoryDb();
+        try {
+            if (action === "list") {
+                const scope = hasFlag(process.argv, "--global")
+                    ? undefined
+                    : basename(getCurrentProjectRoot());
+                const items = palList(db, { scope });
+                if (jsonMode) {
+                    console.log(JSON.stringify(items));
+                    return true;
+                }
+                if (!items.length) {
+                    console.log(`${c.dim}no open action items${c.reset}`);
+                    return true;
+                }
+                console.log(`${c.bold}${items.length}${c.reset} open action item(s):`);
+                for (const p of items) {
+                    const tag = p.kind === "auto" ? ` ${c.dim}· auto${c.reset}` : "";
+                    const scope = p.scope ? ` ${c.dim}[${p.scope}]${c.reset}` : "";
+                    console.log(`  ${c.bold}${p.id}${c.reset}  ${p.title}${scope}${tag}`);
+                }
+                return true;
+            }
+            if (action === "add") {
+                const title = process.argv.slice(5).filter((a) => !a.startsWith("--")).join(" ").trim();
+                if (!title) {
+                    console.error(`${c.red}usage: kit memory pal add <title> [--verify=<cmd>] [--scope=<s>]${c.reset}`);
+                    return false;
+                }
+                const id = palAdd(db, {
+                    title,
+                    verifyCmd: flagValue(process.argv, "--verify"),
+                    scope: flagValue(process.argv, "--scope") ?? basename(getCurrentProjectRoot()),
+                });
+                console.log(`${c.green}✓${c.reset} added ${c.bold}${id}${c.reset}`);
+                return true;
+            }
+            if (action === "done") {
+                const id = process.argv[5];
+                if (!id) {
+                    console.error(`${c.red}usage: kit memory pal done <id>${c.reset}`);
+                    return false;
+                }
+                console.log(palDone(db, id)
+                    ? `${c.green}✓${c.reset} closed ${id}`
+                    : `${c.dim}${id} not found or already closed${c.reset}`);
+                return true;
+            }
+            if (action === "snooze") {
+                const id = process.argv[5];
+                const days = Number(process.argv[6] ?? "7") || 7;
+                if (!id) {
+                    console.error(`${c.red}usage: kit memory pal snooze <id> [days]${c.reset}`);
+                    return false;
+                }
+                console.log(palSnooze(db, id, days)
+                    ? `${c.green}✓${c.reset} snoozed ${id} for ${days}d`
+                    : `${c.dim}${id} not found${c.reset}`);
+                return true;
+            }
+            if (action === "verify") {
+                const r = palAutoVerify(db);
+                console.log(`${c.dim}checked ${r.checked} · closed ${r.closed.length} · reopened ${r.reopened.length}${c.reset}`);
+                return true;
+            }
+            if (action === "import") {
+                const r = importLegacyLedger(db);
+                console.log(`${c.green}✓${c.reset} imported ${r.imported} item(s) from the legacy ledger`);
+                return true;
+            }
+            console.error(`${c.red}Unknown pal action: ${action}${c.reset}`);
+            console.error("Use: kit memory pal [list|add|done|snooze|verify|import]");
+            return false;
+        }
+        finally {
+            db.close();
+        }
+    }
+    console.error(`${c.red}Unknown memory subcommand: ${subcommand}${c.reset}`);
+    console.error("Use: kit memory index | search <query> | stats | install | uninstall | pal");
+    return false;
+}
 async function main() {
     const args = process.argv.slice(2);
     const command = args[0];
@@ -3926,6 +4438,9 @@ async function main() {
                 ok = true;
                 break;
             }
+            case "status":
+                ok = await cmdStatus();
+                break;
             case "whoami":
                 ok = await cmdWhoami();
                 break;
@@ -4032,6 +4547,9 @@ async function main() {
             case "team":
                 ok = await cmdTeam();
                 break;
+            case "memory":
+                ok = await cmdMemory();
+                break;
             default: {
                 console.error(`Unknown command: ${command}`);
                 const { didYouMean } = await import("./utils/didYouMean.js");