sandstream-kit 1.0.1 → 1.2.0

package/dist/memory/scan.js

@@ -0,0 +1,94 @@
+/**
+ * kit memory — secret scan over the store.
+ *
+ * The memory DB is secret-dense (it indexes raw transcripts). gitleaks and most
+ * scanners only see text files, not SQLite cell contents — so this scans the text
+ * columns directly, reusing kit's SECRET_PATTERNS via findSecrets (DRY). Findings
+ * are MASKED (label + short preview), never the raw secret.
+ *
+ * Findings are DEDUPED by (label, preview) with an occurrence count, split by
+ * CONFIDENCE so the genuinely dangerous keys (sk_live, AIzaSy, AKIA, ghp_, …) are
+ * not buried under the over-eager `KEY=value` heuristic, and ATTRIBUTED to the
+ * project(s) they leaked in (via each row's cwd) so you know which provider account
+ * to rotate. Only high-confidence findings make `kit memory scan` exit non-zero.
+ */
+import { basename } from "node:path";
+import { findSecrets } from "../utils/redactSecrets.js";
+const TARGETS = [
+    {
+        table: "messages",
+        idCol: "id",
+        columns: ["content"],
+        select: "SELECT id, content, cwd AS __project FROM messages",
+    },
+    {
+        table: "tool_uses",
+        idCol: "id",
+        columns: ["tool_input"],
+        select: "SELECT tool_uses.id AS id, tool_uses.tool_input AS tool_input, m.cwd AS __project " +
+            "FROM tool_uses LEFT JOIN messages m ON m.uuid = tool_uses.message_uuid",
+    },
+    {
+        table: "pending_actions",
+        idCol: "id",
+        columns: ["title", "detail", "verify_cmd"],
+        select: "SELECT id, title, detail, verify_cmd, scope AS __project FROM pending_actions",
+    },
+    {
+        table: "saved_threads",
+        idCol: "name",
+        columns: ["summary"],
+        select: "SELECT name, summary, project_path AS __project FROM saved_threads",
+    },
+];
+// Heuristic labels are pattern-based guesses (KEY=value, tfstate blobs) that
+// frequently match benign env vars / file paths. Everything else is a structured,
+// high-confidence credential pattern.
+const HEURISTIC_LABELS = new Set(["kv-secret", "tfstate-value"]);
+function projectName(raw) {
+    if (typeof raw !== "string" || !raw)
+        return null;
+    return raw.includes("/") ? basename(raw) : raw;
+}
+/** Scan every text cell for stored secrets. Deduped, confidence-tiered, project-attributed. */
+export function scanDbForSecrets(db) {
+    const byKey = new Map();
+    for (const target of TARGETS) {
+        const rows = db.prepare(target.select).all();
+        for (const row of rows) {
+            const proj = projectName(row.__project);
+            for (const col of target.columns) {
+                const val = row[col];
+                if (typeof val !== "string" || !val)
+                    continue;
+                for (const f of findSecrets(val)) {
+                    const key = `${f.label} ${f.preview}`;
+                    let entry = byKey.get(key);
+                    if (!entry) {
+                        entry = {
+                            label: f.label,
+                            preview: f.preview,
+                            confidence: HEURISTIC_LABELS.has(f.label) ? "heuristic" : "high",
+                            count: 0,
+                            sample: `${target.table}#${row[target.idCol]}.${col}`,
+                            projects: [],
+                            _projects: new Set(),
+                        };
+                        byKey.set(key, entry);
+                    }
+                    entry.count++;
+                    if (proj)
+                        entry._projects.add(proj);
+                }
+            }
+        }
+    }
+    return [...byKey.values()]
+        .map(({ _projects, ...f }) => ({ ...f, projects: [..._projects].sort() }))
+        .sort((a, b) => {
+        if (a.confidence !== b.confidence)
+            return a.confidence === "high" ? -1 : 1;
+        return b.count - a.count;
+    });
+}
+//# sourceMappingURL=scan.js.map

package/dist/memory/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/memory/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAwBxD,MAAM,OAAO,GAAa;IACxB;QACE,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,oDAAoD;KAC7D;IACD;QACE,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,YAAY,CAAC;QACvB,MAAM,EACJ,oFAAoF;YACpF,wEAAwE;KAC3E;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC;QAC1C,MAAM,EAAE,+EAA+E;KACxF;IACD;QACE,KAAK,EAAE,eAAe;QACtB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,oEAAoE;KAC7E;CACF,CAAC;AAEF,6EAA6E;AAC7E,kFAAkF;AAClF,sCAAsC;AACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;AAEjE,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAA+B,CAAC;QAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAC9C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACtC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,KAAK,GAAG;4BACN,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;4BAChE,KAAK,EAAE,CAAC;4BACR,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE;4BACrD,QAAQ,EAAE,EAAE;4BACZ,SAAS,EAAE,IAAI,GAAG,EAAU;yBAC7B,CAAC;wBACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxB,CAAC;oBACD,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,IAAI,IAAI;wBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;SACvB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/memory/scan.test 2.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/memory/scan.test 2.js

@@ -0,0 +1,55 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { openMemoryDb, upsertSession, insertMessage } from "./db.js";
+import { scanDbForSecrets } from "./scan.js";
+describe("memory secret-scan", () => {
+    it("flags a stored secret (masked, high-confidence) and locates it", () => {
+        const db = openMemoryDb(":memory:");
+        upsertSession(db, { sessionId: "s1", harness: "claude-code" });
+        const fake = "sk_live_" + "A".repeat(24); // synthetic, non-real
+        insertMessage(db, { uuid: "u1", sessionId: "s1", type: "user", content: `the key is ${fake}` });
+        insertMessage(db, { uuid: "u2", sessionId: "s1", type: "user", content: "totally clean message" });
+        const findings = scanDbForSecrets(db);
+        assert.equal(findings.length, 1);
+        assert.equal(findings[0]?.label, "stripe-key");
+        assert.equal(findings[0]?.confidence, "high");
+        assert.equal(findings[0]?.count, 1);
+        assert.match(findings[0]?.sample ?? "", /^messages#\d+\.content$/);
+        assert.ok(!findings[0]?.preview.includes("A".repeat(24)), "preview is masked, not the raw secret");
+        db.close();
+    });
+    it("dedupes the same secret across rows with an occurrence count", () => {
+        const db = openMemoryDb(":memory:");
+        upsertSession(db, { sessionId: "s1", harness: "claude-code" });
+        const fake = "sk_live_" + "B".repeat(24);
+        insertMessage(db, { uuid: "u1", sessionId: "s1", type: "user", content: `key ${fake}` });
+        insertMessage(db, { uuid: "u2", sessionId: "s1", type: "user", content: `again ${fake}` });
+        const findings = scanDbForSecrets(db);
+        assert.equal(findings.length, 1, "one unique finding, not two");
+        assert.equal(findings[0]?.count, 2);
+        db.close();
+    });
+    it("attributes a finding to the project it leaked in (via cwd)", () => {
+        const db = openMemoryDb(":memory:");
+        upsertSession(db, { sessionId: "s1", harness: "claude-code" });
+        const fake = "sk_live_" + "C".repeat(24);
+        insertMessage(db, {
+            uuid: "u1",
+            sessionId: "s1",
+            type: "user",
+            content: `key ${fake}`,
+            cwd: "/Users/me/dev/app-a",
+        });
+        const findings = scanDbForSecrets(db);
+        assert.deepEqual(findings[0]?.projects, ["app-a"]);
+        db.close();
+    });
+    it("returns nothing for a clean db", () => {
+        const db = openMemoryDb(":memory:");
+        upsertSession(db, { sessionId: "s1", harness: "claude-code" });
+        insertMessage(db, { uuid: "u1", sessionId: "s1", type: "user", content: "no secrets here" });
+        assert.deepEqual(scanDbForSecrets(db), []);
+        db.close();
+    });
+});
+//# sourceMappingURL=scan.test%202.js.map

package/dist/memory/scan.test 2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.test 2.js","sourceRoot":"","sources":["../../src/memory/scan.test 2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;QAChE,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;QACnG,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACzF,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,aAAa,CAAC,EAAE,EAAE;YAChB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,GAAG,EAAE,qBAAqB;SAC3B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC/D,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/memory/shared 2.d.ts

@@ -0,0 +1,33 @@
+export type SharedKind = "decision" | "convention" | "how-built" | "status" | "security" | "note";
+export interface SharedEntry {
+    id: string;
+    area: string;
+    kind: SharedKind;
+    title: string;
+    body: string;
+    refs: string[];
+    author: string;
+    ts: string;
+    source_ref?: string;
+}
+export interface ShareInput {
+    area: string;
+    kind: SharedKind;
+    title: string;
+    body: string;
+    refs?: string[];
+}
+export declare function getSharedPath(root: string): string;
+export declare function readShared(root: string): SharedEntry[];
+/**
+ * Promote one entry into the shared store. Fail-closed: refuses (throws) if any
+ * text field contains a secret. Only allow-listed fields are persisted — no raw
+ * tool output / env dumps can sneak in. Author + source_ref give provenance.
+ */
+export declare function shareEntry(root: string, input: ShareInput, now: string): SharedEntry;
+export declare function listAreas(root: string): {
+    area: string;
+    count: number;
+}[];
+export declare function queryArea(root: string, area: string): SharedEntry[];
+export declare function searchShared(root: string, query: string): SharedEntry[];

package/dist/memory/shared 2.js

@@ -0,0 +1,120 @@
+/**
+ * kit memory — shared project / responsibility-area memory (the curated tier).
+ *
+ * This is CONTEXT, not raw memory: durable, curated, intentional knowledge that
+ * is safe to share with the team and travels with the repo. Treated LIKE CODE:
+ *  - committed TEXT (.kit/shared/memory.jsonl) → diffable, PR-reviewable, gitleaks-scannable;
+ *  - deny-by-default — nothing is auto-shared, you promote entries explicitly;
+ *  - allow-listed schema — only safe fields (no raw dumps);
+ *  - fail-closed secret-scan on write (reuses kit's SECRET_PATTERNS);
+ *  - provenance + receipts (author + source_ref) so colleagues can trust it.
+ *
+ * Organized by `area` (e.g. "stripe", "whatsapp", "plugins") so a growing system
+ * stays navigable: "how did we build X, what's next, is it secure?" = that area's
+ * entries (with receipts). Entries are few (curated) → plain JSONL + JS query; no
+ * second database. Querying never calls a model.
+ */
+import { randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { findSecrets } from "../utils/redactSecrets.js";
+export function getSharedPath(root) {
+    return join(root, ".kit", "shared", "memory.jsonl");
+}
+function gitAuthor(root) {
+    const read = (key) => {
+        try {
+            return execFileSync("git", ["config", key], {
+                cwd: root,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim();
+        }
+        catch {
+            return "";
+        }
+    };
+    const name = read("user.name");
+    const email = read("user.email");
+    if (name && email)
+        return `${name} <${email}>`;
+    return name || email || "unknown";
+}
+function gitHead(root) {
+    try {
+        const sha = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+            cwd: root,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return sha || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readShared(root) {
+    const path = getSharedPath(root);
+    if (!existsSync(path))
+        return [];
+    const out = [];
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        try {
+            out.push(JSON.parse(t));
+        }
+        catch {
+            // skip malformed lines, keep the rest readable
+        }
+    }
+    return out;
+}
+/**
+ * Promote one entry into the shared store. Fail-closed: refuses (throws) if any
+ * text field contains a secret. Only allow-listed fields are persisted — no raw
+ * tool output / env dumps can sneak in. Author + source_ref give provenance.
+ */
+export function shareEntry(root, input, now) {
+    const refs = input.refs ?? [];
+    const scanned = [input.title, input.body, ...refs].join("\n");
+    const found = findSecrets(scanned);
+    if (found.length) {
+        throw new Error(`refused: entry contains ${found.length} secret(s) (${found
+            .map((f) => f.label)
+            .join(", ")}) — shared memory must be secret-clean`);
+    }
+    const entry = {
+        id: randomBytes(3).toString("hex"),
+        area: input.area,
+        kind: input.kind,
+        title: input.title,
+        body: input.body,
+        refs,
+        author: gitAuthor(root),
+        ts: now,
+        source_ref: gitHead(root),
+    };
+    const path = getSharedPath(root);
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, JSON.stringify(entry) + "\n");
+    return entry;
+}
+export function listAreas(root) {
+    const counts = new Map();
+    for (const e of readShared(root))
+        counts.set(e.area, (counts.get(e.area) ?? 0) + 1);
+    return [...counts.entries()]
+        .map(([area, count]) => ({ area, count }))
+        .sort((a, b) => a.area.localeCompare(b.area));
+}
+export function queryArea(root, area) {
+    return readShared(root).filter((e) => e.area === area);
+}
+export function searchShared(root, query) {
+    const q = query.toLowerCase();
+    return readShared(root).filter((e) => e.title.toLowerCase().includes(q) || e.body.toLowerCase().includes(q));
+}
+//# sourceMappingURL=shared%202.js.map

package/dist/memory/shared 2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared 2.js","sourceRoot":"","sources":["../../src/memory/shared 2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA8BxD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAC1C,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,IAAI,KAAK;QAAE,OAAO,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;IAC/C,OAAO,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;YAChE,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAgB,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB,EAAE,GAAW;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,MAAM,eAAe,KAAK;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aACnB,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,GAAG;QACP,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC;KAC1B,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC"}

package/dist/memory/shared.d.ts

@@ -0,0 +1,33 @@
+export type SharedKind = "decision" | "convention" | "how-built" | "status" | "security" | "note";
+export interface SharedEntry {
+    id: string;
+    area: string;
+    kind: SharedKind;
+    title: string;
+    body: string;
+    refs: string[];
+    author: string;
+    ts: string;
+    source_ref?: string;
+}
+export interface ShareInput {
+    area: string;
+    kind: SharedKind;
+    title: string;
+    body: string;
+    refs?: string[];
+}
+export declare function getSharedPath(root: string): string;
+export declare function readShared(root: string): SharedEntry[];
+/**
+ * Promote one entry into the shared store. Fail-closed: refuses (throws) if any
+ * text field contains a secret. Only allow-listed fields are persisted — no raw
+ * tool output / env dumps can sneak in. Author + source_ref give provenance.
+ */
+export declare function shareEntry(root: string, input: ShareInput, now: string): SharedEntry;
+export declare function listAreas(root: string): {
+    area: string;
+    count: number;
+}[];
+export declare function queryArea(root: string, area: string): SharedEntry[];
+export declare function searchShared(root: string, query: string): SharedEntry[];

package/dist/memory/shared.js

@@ -0,0 +1,120 @@
+/**
+ * kit memory — shared project / responsibility-area memory (the curated tier).
+ *
+ * This is CONTEXT, not raw memory: durable, curated, intentional knowledge that
+ * is safe to share with the team and travels with the repo. Treated LIKE CODE:
+ *  - committed TEXT (.kit/shared/memory.jsonl) → diffable, PR-reviewable, gitleaks-scannable;
+ *  - deny-by-default — nothing is auto-shared, you promote entries explicitly;
+ *  - allow-listed schema — only safe fields (no raw dumps);
+ *  - fail-closed secret-scan on write (reuses kit's SECRET_PATTERNS);
+ *  - provenance + receipts (author + source_ref) so colleagues can trust it.
+ *
+ * Organized by `area` (e.g. "stripe", "whatsapp", "plugins") so a growing system
+ * stays navigable: "how did we build X, what's next, is it secure?" = that area's
+ * entries (with receipts). Entries are few (curated) → plain JSONL + JS query; no
+ * second database. Querying never calls a model.
+ */
+import { randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { findSecrets } from "../utils/redactSecrets.js";
+export function getSharedPath(root) {
+    return join(root, ".kit", "shared", "memory.jsonl");
+}
+function gitAuthor(root) {
+    const read = (key) => {
+        try {
+            return execFileSync("git", ["config", key], {
+                cwd: root,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim();
+        }
+        catch {
+            return "";
+        }
+    };
+    const name = read("user.name");
+    const email = read("user.email");
+    if (name && email)
+        return `${name} <${email}>`;
+    return name || email || "unknown";
+}
+function gitHead(root) {
+    try {
+        const sha = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+            cwd: root,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return sha || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readShared(root) {
+    const path = getSharedPath(root);
+    if (!existsSync(path))
+        return [];
+    const out = [];
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        try {
+            out.push(JSON.parse(t));
+        }
+        catch {
+            // skip malformed lines, keep the rest readable
+        }
+    }
+    return out;
+}
+/**
+ * Promote one entry into the shared store. Fail-closed: refuses (throws) if any
+ * text field contains a secret. Only allow-listed fields are persisted — no raw
+ * tool output / env dumps can sneak in. Author + source_ref give provenance.
+ */
+export function shareEntry(root, input, now) {
+    const refs = input.refs ?? [];
+    const scanned = [input.title, input.body, ...refs].join("\n");
+    const found = findSecrets(scanned);
+    if (found.length) {
+        throw new Error(`refused: entry contains ${found.length} secret(s) (${found
+            .map((f) => f.label)
+            .join(", ")}) — shared memory must be secret-clean`);
+    }
+    const entry = {
+        id: randomBytes(3).toString("hex"),
+        area: input.area,
+        kind: input.kind,
+        title: input.title,
+        body: input.body,
+        refs,
+        author: gitAuthor(root),
+        ts: now,
+        source_ref: gitHead(root),
+    };
+    const path = getSharedPath(root);
+    mkdirSync(dirname(path), { recursive: true });
+    appendFileSync(path, JSON.stringify(entry) + "\n");
+    return entry;
+}
+export function listAreas(root) {
+    const counts = new Map();
+    for (const e of readShared(root))
+        counts.set(e.area, (counts.get(e.area) ?? 0) + 1);
+    return [...counts.entries()]
+        .map(([area, count]) => ({ area, count }))
+        .sort((a, b) => a.area.localeCompare(b.area));
+}
+export function queryArea(root, area) {
+    return readShared(root).filter((e) => e.area === area);
+}
+export function searchShared(root, query) {
+    const q = query.toLowerCase();
+    return readShared(root).filter((e) => e.title.toLowerCase().includes(q) || e.body.toLowerCase().includes(q));
+}
+//# sourceMappingURL=shared.js.map

package/dist/memory/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/memory/shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AA8BxD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE;QACnC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAC1C,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,IAAI,KAAK;QAAE,OAAO,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;IAC/C,OAAO,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;YAChE,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAgB,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB,EAAE,GAAW;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,MAAM,eAAe,KAAK;aACxD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aACnB,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAgB;QACzB,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,GAAG;QACP,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC;KAC1B,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC"}

package/dist/memory/threads 2.d.ts

@@ -0,0 +1,37 @@
+/**
+ * kit memory — named copilots (saved threads).
+ *
+ * Claude Code's resume list labels sessions by the first message you happened to
+ * type, so the thread you want is unfindable. Here you bookmark the threads worth
+ * keeping under a real name ("a fleet of named copilots"); a small curated list
+ * replaces the scrap heap. Scoped per project by default (the personal store holds
+ * all projects; this just filters). Pure read/write — no model calls.
+ */
+import type { DatabaseSync } from "node:sqlite";
+export interface SavedThread {
+    name: string;
+    session_id: string;
+    summary: string | null;
+    project_path: string | null;
+    saved_at: string | null;
+}
+export interface SaveThreadInput {
+    name: string;
+    sessionId: string;
+    summary?: string;
+    projectPath?: string;
+}
+export declare function saveThread(db: DatabaseSync, input: SaveThreadInput): void;
+export declare function listThreads(db: DatabaseSync, opts?: {
+    projectPath?: string;
+}): SavedThread[];
+export declare function getThread(db: DatabaseSync, name: string): SavedThread | undefined;
+export declare function removeThread(db: DatabaseSync, name: string): boolean;
+/** Most recent session that touched this project (by message timestamp). */
+export declare function latestSessionId(db: DatabaseSync, opts?: {
+    projectPath?: string;
+}): string | undefined;
+/** Resolve a thread by name, or by 1-based index into the (scoped) list. */
+export declare function resolveThread(db: DatabaseSync, ref: string, opts?: {
+    projectPath?: string;
+}): SavedThread | undefined;

package/dist/memory/threads 2.js

@@ -0,0 +1,50 @@
+export function saveThread(db, input) {
+    db.prepare(`INSERT INTO saved_threads (name, session_id, summary, project_path, saved_at)
+     VALUES (?, ?, ?, ?, datetime('now'))
+     ON CONFLICT(name) DO UPDATE SET
+       session_id = excluded.session_id,
+       summary = COALESCE(excluded.summary, saved_threads.summary),
+       project_path = COALESCE(excluded.project_path, saved_threads.project_path),
+       saved_at = datetime('now')`).run(input.name, input.sessionId, input.summary ?? null, input.projectPath ?? null);
+}
+export function listThreads(db, opts = {}) {
+    if (opts.projectPath) {
+        return db
+            .prepare("SELECT * FROM saved_threads WHERE project_path = ? ORDER BY saved_at DESC")
+            .all(opts.projectPath);
+    }
+    return db
+        .prepare("SELECT * FROM saved_threads ORDER BY saved_at DESC")
+        .all();
+}
+export function getThread(db, name) {
+    return db.prepare("SELECT * FROM saved_threads WHERE name = ?").get(name);
+}
+export function removeThread(db, name) {
+    return Number(db.prepare("DELETE FROM saved_threads WHERE name = ?").run(name).changes) > 0;
+}
+/** Most recent session that touched this project (by message timestamp). */
+export function latestSessionId(db, opts = {}) {
+    let row;
+    if (opts.projectPath) {
+        row = db
+            .prepare(`SELECT session_id FROM messages
+         WHERE cwd = ? OR cwd LIKE ?
+         ORDER BY timestamp DESC LIMIT 1`)
+            .get(opts.projectPath, `${opts.projectPath}/%`);
+    }
+    else {
+        row = db
+            .prepare("SELECT session_id FROM messages ORDER BY timestamp DESC LIMIT 1")
+            .get();
+    }
+    return row?.session_id;
+}
+/** Resolve a thread by name, or by 1-based index into the (scoped) list. */
+export function resolveThread(db, ref, opts = {}) {
+    if (/^\d+$/.test(ref)) {
+        return listThreads(db, opts)[Number(ref) - 1];
+    }
+    return getThread(db, ref);
+}
+//# sourceMappingURL=threads%202.js.map

package/dist/memory/threads 2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threads 2.js","sourceRoot":"","sources":["../../src/memory/threads 2.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,UAAU,CAAC,EAAgB,EAAE,KAAsB;IACjE,EAAE,CAAC,OAAO,CACR;;;;;;kCAM8B,CAC/B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,EAAgB,EAChB,OAAiC,EAAE;IAEnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,EAAE;aACN,OAAO,CAAC,2EAA2E,CAAC;aACpF,GAAG,CAAC,IAAI,CAAC,WAAW,CAA6B,CAAC;IACvD,CAAC;IACD,OAAO,EAAE;SACN,OAAO,CAAC,oDAAoD,CAAC;SAC7D,GAAG,EAA8B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAgB,EAAE,IAAY;IACtD,OAAO,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,IAAI,CAE3D,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAgB,EAAE,IAAY;IACzD,OAAO,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,EAAgB,EAChB,OAAiC,EAAE;IAEnC,IAAI,GAAuC,CAAC;IAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,GAAG,EAAE;aACL,OAAO,CACN;;yCAEiC,CAClC;aACA,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,CAAuC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,EAAE;aACL,OAAO,CAAC,iEAAiE,CAAC;aAC1E,GAAG,EAAwC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,EAAE,UAAU,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAC3B,EAAgB,EAChB,GAAW,EACX,OAAiC,EAAE;IAEnC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/memory/threads.d.ts

@@ -0,0 +1,37 @@
+/**
+ * kit memory — named copilots (saved threads).
+ *
+ * Claude Code's resume list labels sessions by the first message you happened to
+ * type, so the thread you want is unfindable. Here you bookmark the threads worth
+ * keeping under a real name ("a fleet of named copilots"); a small curated list
+ * replaces the scrap heap. Scoped per project by default (the personal store holds
+ * all projects; this just filters). Pure read/write — no model calls.
+ */
+import type { DatabaseSync } from "node:sqlite";
+export interface SavedThread {
+    name: string;
+    session_id: string;
+    summary: string | null;
+    project_path: string | null;
+    saved_at: string | null;
+}
+export interface SaveThreadInput {
+    name: string;
+    sessionId: string;
+    summary?: string;
+    projectPath?: string;
+}
+export declare function saveThread(db: DatabaseSync, input: SaveThreadInput): void;
+export declare function listThreads(db: DatabaseSync, opts?: {
+    projectPath?: string;
+}): SavedThread[];
+export declare function getThread(db: DatabaseSync, name: string): SavedThread | undefined;
+export declare function removeThread(db: DatabaseSync, name: string): boolean;
+/** Most recent session that touched this project (by message timestamp). */
+export declare function latestSessionId(db: DatabaseSync, opts?: {
+    projectPath?: string;
+}): string | undefined;
+/** Resolve a thread by name, or by 1-based index into the (scoped) list. */
+export declare function resolveThread(db: DatabaseSync, ref: string, opts?: {
+    projectPath?: string;
+}): SavedThread | undefined;