shieldcortex 3.0.4 → 3.2.0

package/dist/api/routes/memories.js

@@ -1,3 +1,6 @@
+import { homedir } from 'os';
+import { join } from 'path';
+import { existsSync, readdirSync, readFileSync } from 'fs';
 import { getDatabase } from '../../database/init.js';
 import { searchMemories, getRecentMemories, getHighPriorityMemories, getMemoryStats, getMemoryById, addMemory, deleteMemory, accessMemory, updateMemory, promoteMemory, createMemoryLink, rowToMemory, enrichMemory, } from '../../memory/store.js';
 import { calculateDecayedScore } from '../../memory/decay.js';
@@ -6,6 +9,185 @@ import { getActivationStats, getActiveMemories } from '../../memory/activation.j
 import { detectContradictions, getContradictionsFor } from '../../memory/contradiction.js';
 import { emitConsolidation } from '../events.js';
 export function registerMemoryRoutes(app, requireNotLocked) {
+    app.get('/api/capture/openclaw/sessions', requireNotLocked, (req, res) => {
+        try {
+            const limit = Math.min(parseInt(req.query.limit, 10) || 20, 100);
+            const auditDir = join(homedir(), '.shieldcortex', 'audit');
+            const db = getDatabase();
+            const rows = db.prepare(`
+        SELECT * FROM memories
+        WHERE source_kind IN ('hook', 'plugin') OR source LIKE 'hook:openclaw%' OR source LIKE 'agent:openclaw-plugin%'
+        ORDER BY updated_at DESC
+        LIMIT 500
+      `).all();
+            const openClawMemories = rows.map(rowToMemory);
+            const sessionMap = new Map();
+            const getSession = (sessionId) => {
+                let session = sessionMap.get(sessionId);
+                if (!session) {
+                    session = {
+                        sessionId,
+                        firstSeenAt: new Date().toISOString(),
+                        lastSeenAt: new Date(0).toISOString(),
+                        storedMemoryCount: 0,
+                        loggedSaved: 0,
+                        skipped: 0,
+                        threats: 0,
+                        blocked: 0,
+                        quarantined: 0,
+                        autoExtracted: 0,
+                        keywordTriggered: 0,
+                        pinned: 0,
+                        suppressed: 0,
+                        hooks: new Set(),
+                        models: new Set(),
+                        agentIds: new Set(),
+                        memoryIds: new Set(),
+                        previews: [],
+                        events: [],
+                    };
+                    sessionMap.set(sessionId, session);
+                }
+                return session;
+            };
+            for (const memory of openClawMemories) {
+                const sessionId = typeof memory.metadata?.sessionId === 'string'
+                    ? memory.metadata.sessionId
+                    : memory.source?.startsWith('agent:openclaw-plugin:')
+                        ? memory.source.slice('agent:openclaw-plugin:'.length)
+                        : null;
+                if (!sessionId)
+                    continue;
+                const session = getSession(sessionId);
+                const createdAt = memory.createdAt.toISOString();
+                if (createdAt < session.firstSeenAt)
+                    session.firstSeenAt = createdAt;
+                if (createdAt > session.lastSeenAt)
+                    session.lastSeenAt = createdAt;
+                session.storedMemoryCount += 1;
+                session.memoryIds.add(memory.id);
+                if (typeof memory.metadata?.agentId === 'string')
+                    session.agentIds.add(memory.metadata.agentId);
+                if (memory.captureMethod === 'auto' || memory.captureMethod === 'plugin' || memory.captureMethod === 'hook') {
+                    session.autoExtracted += 1;
+                }
+                if (typeof memory.metadata?.trigger === 'string' || memory.tags.includes('keyword_trigger')) {
+                    session.keywordTriggered += 1;
+                }
+                if (memory.pinned)
+                    session.pinned += 1;
+                if (memory.status === 'suppressed')
+                    session.suppressed += 1;
+            }
+            if (existsSync(auditDir)) {
+                const files = readdirSync(auditDir)
+                    .filter((file) => /^realtime-\d{4}-\d{2}-\d{2}\.jsonl$/.test(file))
+                    .sort()
+                    .slice(-14);
+                for (const file of files) {
+                    const raw = readFileSync(join(auditDir, file), 'utf-8');
+                    for (const line of raw.split('\n')) {
+                        if (!line.trim())
+                            continue;
+                        try {
+                            const entry = JSON.parse(line);
+                            const sessionId = typeof entry.sessionId === 'string' ? entry.sessionId : null;
+                            if (!sessionId)
+                                continue;
+                            const session = getSession(sessionId);
+                            const ts = typeof entry.ts === 'string' ? entry.ts : new Date().toISOString();
+                            if (ts < session.firstSeenAt)
+                                session.firstSeenAt = ts;
+                            if (ts > session.lastSeenAt)
+                                session.lastSeenAt = ts;
+                            if (typeof entry.hook === 'string')
+                                session.hooks.add(entry.hook);
+                            if (typeof entry.model === 'string')
+                                session.models.add(entry.model);
+                            if (entry.type === 'memory') {
+                                const count = Number(entry.count ?? 0);
+                                const skipped = Number(entry.skipped ?? 0);
+                                session.loggedSaved += count;
+                                session.skipped += skipped;
+                                session.events.push({
+                                    ts,
+                                    type: 'memory',
+                                    hook: typeof entry.hook === 'string' ? entry.hook : undefined,
+                                    model: typeof entry.model === 'string' ? entry.model : undefined,
+                                    preview: typeof entry.preview === 'string' ? entry.preview : undefined,
+                                    count,
+                                    skipped,
+                                });
+                                if (typeof entry.preview === 'string' && session.previews.length < 6) {
+                                    session.previews.push(entry.preview);
+                                }
+                            }
+                            if (entry.type === 'threat') {
+                                session.threats += 1;
+                                const preview = typeof entry.preview === 'string' ? entry.preview : undefined;
+                                const lower = preview?.toLowerCase() ?? '';
+                                if (lower.includes('quarantine'))
+                                    session.quarantined += 1;
+                                if (lower.includes('block'))
+                                    session.blocked += 1;
+                                session.events.push({
+                                    ts,
+                                    type: lower.includes('quarantine') ? 'quarantine' : lower.includes('block') ? 'blocked' : 'threat',
+                                    hook: typeof entry.hook === 'string' ? entry.hook : undefined,
+                                    model: typeof entry.model === 'string' ? entry.model : undefined,
+                                    preview,
+                                });
+                                if (preview && session.previews.length < 6) {
+                                    session.previews.push(preview);
+                                }
+                            }
+                        }
+                        catch {
+                            // ignore malformed lines
+                        }
+                    }
+                }
+            }
+            const sessions = Array.from(sessionMap.values())
+                .map((session) => ({
+                sessionId: session.sessionId,
+                firstSeenAt: session.firstSeenAt,
+                lastSeenAt: session.lastSeenAt,
+                saved: Math.max(session.storedMemoryCount, session.loggedSaved),
+                skipped: session.skipped,
+                threats: session.threats,
+                blocked: session.blocked,
+                quarantined: session.quarantined,
+                autoExtracted: session.autoExtracted,
+                keywordTriggered: session.keywordTriggered,
+                pinned: session.pinned,
+                suppressed: session.suppressed,
+                hooks: Array.from(session.hooks),
+                models: Array.from(session.models),
+                agentIds: Array.from(session.agentIds),
+                previews: session.previews,
+                events: session.events
+                    .sort((a, b) => new Date(b.ts).getTime() - new Date(a.ts).getTime())
+                    .slice(0, 24),
+                memories: openClawMemories
+                    .filter((memory) => session.memoryIds.has(memory.id))
+                    .sort((a, b) => new Date(b.updatedAt ?? b.createdAt).getTime() - new Date(a.updatedAt ?? a.createdAt).getTime())
+                    .slice(0, 12),
+            }))
+                .sort((a, b) => new Date(b.lastSeenAt).getTime() - new Date(a.lastSeenAt).getTime())
+                .slice(0, limit);
+            const summary = {
+                sessions: sessions.length,
+                saved: sessions.reduce((sum, session) => sum + session.saved, 0),
+                skipped: sessions.reduce((sum, session) => sum + session.skipped, 0),
+                threats: sessions.reduce((sum, session) => sum + session.threats, 0),
+            };
+            res.json({ summary, sessions });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     app.get('/api/memories', requireNotLocked, async (req, res) => {
         try {
             const project = typeof req.query.project === 'string' ? req.query.project : undefined;
@@ -110,11 +292,127 @@ export function registerMemoryRoutes(app, requireNotLocked) {
         JOIN memories m2 ON m1.title = m2.title AND m1.id < m2.id
         ${project ? 'WHERE m1.project = ?' : ''}
         LIMIT 50
+      `).all(...params);
+            const lowTrust = db.prepare(`
+        SELECT id, title, category, project, trust_score, source_kind, capture_method
+        FROM memories WHERE trust_score < 0.7 ${projectFilter}
+        ORDER BY trust_score ASC, updated_at DESC LIMIT 50
+      `).all(...params);
+            const noisyAutoExtracted = db.prepare(`
+        SELECT id, title, category, project, source_kind, capture_method, tags, trust_score
+        FROM memories
+        WHERE (capture_method = 'auto' OR tags LIKE '%auto-extracted%') ${projectFilter}
+        ORDER BY updated_at DESC LIMIT 50
+      `).all(...params);
+            const projectless = db.prepare(`
+        SELECT id, title, category, scope, source_kind, capture_method
+        FROM memories
+        WHERE (project IS NULL OR project = '') AND scope != 'global'
+        ORDER BY updated_at DESC LIMIT 50
+      `).all();
+            const statusCounts = db.prepare(`
+        SELECT status, COUNT(*) as count
+        FROM memories
+        ${project ? 'WHERE project = ?' : ''}
+        GROUP BY status
       `).all(...params);
             res.json({
                 neverAccessed: { count: neverAccessed.length, items: neverAccessed },
                 stale: { count: stale.length, items: stale },
                 duplicates: { count: duplicates.length, items: duplicates },
+                lowTrust: { count: lowTrust.length, items: lowTrust },
+                noisyAutoExtracted: { count: noisyAutoExtracted.length, items: noisyAutoExtracted },
+                projectless: { count: projectless.length, items: projectless },
+                status: statusCounts.reduce((acc, row) => {
+                    acc[row.status] = row.count;
+                    return acc;
+                }, {}),
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.get('/api/review/queue', requireNotLocked, (req, res) => {
+        try {
+            const project = typeof req.query.project === 'string' ? req.query.project : undefined;
+            const limit = Math.min(parseInt(req.query.limit, 10) || 20, 100);
+            const db = getDatabase();
+            const projectFilter = project ? 'AND project = ?' : '';
+            const params = project ? [project] : [];
+            const stale = db.prepare(`
+        SELECT * FROM memories
+        WHERE decayed_score < 0.3 ${projectFilter}
+        AND last_accessed < datetime('now', '-30 days')
+        ORDER BY decayed_score ASC LIMIT ?
+      `).all(...params, limit);
+            const neverUsed = db.prepare(`
+        SELECT * FROM memories
+        WHERE access_count = 0 ${projectFilter}
+        AND created_at < datetime('now', '-1 day')
+        ORDER BY created_at DESC LIMIT ?
+      `).all(...params, limit);
+            const lowTrust = db.prepare(`
+        SELECT * FROM memories
+        WHERE trust_score < 0.7 ${projectFilter}
+        ORDER BY trust_score ASC, updated_at DESC LIMIT ?
+      `).all(...params, limit);
+            const noisyAutoExtracted = db.prepare(`
+        SELECT * FROM memories
+        WHERE (capture_method = 'auto' OR tags LIKE '%auto-extracted%') ${projectFilter}
+        ORDER BY updated_at DESC LIMIT ?
+      `).all(...params, limit);
+            const projectless = db.prepare(`
+        SELECT * FROM memories
+        WHERE (project IS NULL OR project = '') AND scope != 'global'
+        ORDER BY updated_at DESC LIMIT ?
+      `).all(limit);
+            const openClawSummary = db.prepare(`
+        SELECT
+          COUNT(*) as total,
+          SUM(CASE WHEN capture_method = 'auto' THEN 1 ELSE 0 END) as auto_count,
+          SUM(CASE WHEN tags LIKE '%keyword-trigger%' THEN 1 ELSE 0 END) as keyword_count,
+          SUM(CASE WHEN status = 'suppressed' THEN 1 ELSE 0 END) as suppressed_count,
+          SUM(CASE WHEN pinned = 1 THEN 1 ELSE 0 END) as pinned_count
+        FROM memories
+        WHERE (source_kind IN ('hook', 'plugin') OR tags LIKE '%openclaw%')
+        ${project ? 'AND project = ?' : ''}
+      `).get(...params);
+            const contradictions = detectContradictions({
+                project,
+                minScore: 0.4,
+                limit,
+            });
+            res.json({
+                summary: {
+                    stale: stale.length,
+                    neverUsed: neverUsed.length,
+                    lowTrust: lowTrust.length,
+                    noisyAutoExtracted: noisyAutoExtracted.length,
+                    projectless: projectless.length,
+                    contradictions: contradictions.length,
+                },
+                openClaw: {
+                    total: openClawSummary.total ?? 0,
+                    autoExtracted: openClawSummary.auto_count ?? 0,
+                    keywordTriggered: openClawSummary.keyword_count ?? 0,
+                    suppressed: openClawSummary.suppressed_count ?? 0,
+                    pinned: openClawSummary.pinned_count ?? 0,
+                },
+                sections: {
+                    stale: stale.map(rowToMemory),
+                    neverUsed: neverUsed.map(rowToMemory),
+                    lowTrust: lowTrust.map(rowToMemory),
+                    noisyAutoExtracted: noisyAutoExtracted.map(rowToMemory),
+                    projectless: projectless.map(rowToMemory),
+                    contradictions: contradictions.map((item) => ({
+                        memoryA: item.memoryA,
+                        memoryB: item.memoryB,
+                        score: item.score,
+                        reason: item.reason,
+                        sharedTopics: item.sharedTopics,
+                    })),
+                },
             });
         }
         catch (error) {
@@ -585,7 +883,7 @@ export function registerMemoryRoutes(app, requireNotLocked) {
     app.patch('/api/memories/:id', requireNotLocked, (req, res) => {
         try {
             const id = parseInt(req.params.id, 10);
-            const { title, content, category, tags, importance } = req.body;
+            const { title, content, category, tags, importance, status, pinned, reviewedBy, cloudExcluded, scope, project } = req.body;
             if (title !== undefined && (typeof title !== 'string' || title.trim().length === 0)) {
                 return res.status(400).json({ error: 'Title must be a non-empty string' });
             }
@@ -602,6 +900,24 @@ export function registerMemoryRoutes(app, requireNotLocked) {
             if (importance !== undefined && (typeof importance !== 'number' || importance < 0 || importance > 1)) {
                 return res.status(400).json({ error: 'Importance must be a number between 0 and 1' });
             }
+            if (status !== undefined && !['active', 'archived', 'suppressed', 'canonical'].includes(status)) {
+                return res.status(400).json({ error: 'Invalid review status' });
+            }
+            if (pinned !== undefined && typeof pinned !== 'boolean') {
+                return res.status(400).json({ error: 'Pinned must be boolean' });
+            }
+            if (cloudExcluded !== undefined && typeof cloudExcluded !== 'boolean') {
+                return res.status(400).json({ error: 'cloudExcluded must be boolean' });
+            }
+            if (reviewedBy !== undefined && reviewedBy !== null && typeof reviewedBy !== 'string') {
+                return res.status(400).json({ error: 'reviewedBy must be string or null' });
+            }
+            if (scope !== undefined && !['project', 'global'].includes(scope)) {
+                return res.status(400).json({ error: 'scope must be project or global' });
+            }
+            if (project !== undefined && project !== null && typeof project !== 'string') {
+                return res.status(400).json({ error: 'project must be string or null' });
+            }
             const updates = {};
             if (title !== undefined)
                 updates.title = title.trim();
@@ -613,6 +929,55 @@ export function registerMemoryRoutes(app, requireNotLocked) {
                 updates.tags = tags;
             if (importance !== undefined)
                 updates.salience = importance;
+            if (status !== undefined)
+                updates.status = status;
+            if (pinned !== undefined)
+                updates.pinned = pinned;
+            if (reviewedBy !== undefined)
+                updates.reviewedBy = reviewedBy;
+            if (cloudExcluded !== undefined)
+                updates.cloudExcluded = cloudExcluded;
+            if (scope !== undefined)
+                updates.scope = scope;
+            if (project !== undefined)
+                updates.project = project;
+            const updated = updateMemory(id, updates);
+            if (!updated) {
+                return res.status(404).json({ error: 'Memory not found' });
+            }
+            res.json(updated);
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
+    app.patch('/api/memories/:id/review', requireNotLocked, (req, res) => {
+        try {
+            const id = parseInt(req.params.id, 10);
+            const { action, reviewedBy, project, scope } = req.body;
+            if (Number.isNaN(id)) {
+                return res.status(400).json({ error: 'Invalid memory ID' });
+            }
+            const reviewActor = typeof reviewedBy === 'string' && reviewedBy.trim() ? reviewedBy.trim() : 'dashboard';
+            const actionMap = {
+                archive: { status: 'archived', reviewedBy: reviewActor },
+                suppress: { status: 'suppressed', reviewedBy: reviewActor },
+                restore: { status: 'active', reviewedBy: reviewActor },
+                pin: { pinned: true, reviewedBy: reviewActor },
+                unpin: { pinned: false, reviewedBy: reviewActor },
+                canonicalize: { status: 'canonical', pinned: true, reviewedBy: reviewActor },
+                excludeCloud: { cloudExcluded: true, reviewedBy: reviewActor },
+                includeCloud: { cloudExcluded: false, reviewedBy: reviewActor },
+                rescopeProject: { scope: 'project', project: project ?? null, reviewedBy: reviewActor },
+                rescopeGlobal: { scope: 'global', project: null, reviewedBy: reviewActor },
+            };
+            if (!action || !actionMap[action]) {
+                return res.status(400).json({ error: 'Unsupported review action' });
+            }
+            const updates = {
+                ...actionMap[action],
+                ...(scope ? { scope } : {}),
+            };
             const updated = updateMemory(id, updates);
             if (!updated) {
                 return res.status(404).json({ error: 'Memory not found' });

package/dist/api/routes/recall.js

@@ -1,4 +1,5 @@
 import { searchMemoriesExplained } from '../../memory/store.js';
+import { getMemoryById, getRecentMemories } from '../../memory/store.js';
 export function registerRecallRoutes(app, requireNotLocked) {
     app.get('/api/recall/explain', requireNotLocked, async (req, res) => {
         try {
@@ -12,6 +13,9 @@ export function registerRecallRoutes(app, requireNotLocked) {
             const limit = Math.min(parseInt(req.query.limit, 10) || 10, 50);
             const includeDecayed = req.query.includeDecayed === 'true';
             const includeGlobal = req.query.includeGlobal !== 'false';
+            const includeArchived = req.query.includeArchived === 'true';
+            const includeSuppressed = req.query.includeSuppressed === 'true';
+            const expectedId = typeof req.query.expectedId === 'string' ? parseInt(req.query.expectedId, 10) : null;
             const results = await searchMemoriesExplained({
                 query,
                 project,
@@ -20,13 +24,62 @@ export function registerRecallRoutes(app, requireNotLocked) {
                 limit,
                 includeDecayed,
                 includeGlobal,
+                includeArchived,
+                includeSuppressed,
             });
+            let expectedMemory = null;
+            if (expectedId && Number.isFinite(expectedId)) {
+                const memory = getMemoryById(expectedId);
+                if (memory) {
+                    const foundIndex = results.findIndex((result) => result.memory.id === expectedId);
+                    expectedMemory = {
+                        id: memory.id,
+                        title: memory.title,
+                        status: memory.status,
+                        pinned: memory.pinned,
+                        cloudExcluded: memory.cloudExcluded,
+                        trustScore: memory.trustScore,
+                        captureMethod: memory.captureMethod,
+                        sourceKind: memory.sourceKind,
+                        rank: foundIndex >= 0 ? foundIndex + 1 : null,
+                        eligible: memory.status !== 'archived' && memory.status !== 'suppressed',
+                        reasons: [
+                            ...(memory.status === 'archived' ? ['Archived memories are excluded from normal recall'] : []),
+                            ...(memory.status === 'suppressed' ? ['Suppressed memories are excluded from normal recall'] : []),
+                            ...(memory.trustScore < 0.7 ? [`Low trust source (${memory.trustScore.toFixed(2)})`] : []),
+                            ...(memory.cloudExcluded ? ['Excluded from cloud sync'] : []),
+                            ...(foundIndex === -1 ? ['Did not rank in the current result window'] : []),
+                        ],
+                    };
+                }
+            }
+            const misses = getRecentMemories(200, project).filter((memory) => {
+                if (results.some((result) => result.memory.id === memory.id))
+                    return false;
+                if (memory.status === 'archived' || memory.status === 'suppressed')
+                    return false;
+                return memory.salience >= 0.65 || memory.pinned;
+            }).slice(0, 5).map((memory) => ({
+                id: memory.id,
+                title: memory.title,
+                status: memory.status,
+                salience: memory.salience,
+                captureMethod: memory.captureMethod,
+                sourceKind: memory.sourceKind,
+                whyNotRecalled: [
+                    'Lower relevance for this query than the returned set',
+                    ...(memory.pinned ? ['Pinned memories are still query-sensitive, not guaranteed results'] : []),
+                    ...(memory.trustScore < 0.7 ? [`Low trust source (${memory.trustScore.toFixed(2)})`] : []),
+                ],
+            }));
             res.json({
                 query,
                 project: project ?? null,
                 total: results.length,
                 sideEffects: 'disabled',
                 results,
+                expectedMemory,
+                misses,
             });
         }
         catch (error) {

package/dist/api/routes/system.js

@@ -1,6 +1,8 @@
 import { WebSocket } from 'ws';
-import { getCloudConfig, getDefenceMode, getOpenClawMemoryConfig, isConfigTampered, readRawConfig, setCloudConfig, setDefenceMode, setOpenClawMemoryConfig, } from '../../cloud/config.js';
+import { getCloudConfig, getCloudSyncControls, getDeviceId, getDeviceName, getDefenceMode, getOpenClawMemoryConfig, isConfigTampered, readRawConfig, setCloudConfig, setCloudSyncControls, setDefenceMode, setOpenClawMemoryConfig, } from '../../cloud/config.js';
 import { getQueueStats } from '../../cloud/sync-queue.js';
+import { getDatabase } from '../../database/init.js';
+import { getRequiredTier, isFeatureEnabled } from '../../license/gate.js';
 import { getControlStatus, isKillSwitchActive, pause, resume } from '../control.js';
 import { checkForUpdates, getCurrentVersion, getRunningVersion, performUpdate, scheduleRestart, } from '../version.js';
 export function registerSystemRoutes(app, deps) {
@@ -44,6 +46,7 @@ export function registerSystemRoutes(app, deps) {
                 enabled: config.cloudEnabled,
                 apiKeySet: !!config.cloudApiKey,
                 baseUrl: config.cloudBaseUrl,
+                syncControls: getCloudSyncControls(),
                 openclawMemory: getOpenClawMemoryConfig(),
             });
         }
@@ -53,7 +56,7 @@ export function registerSystemRoutes(app, deps) {
     });
     app.post('/api/cloud/config', (req, res) => {
         try {
-            const { cloudApiKey, cloudEnabled, cloudBaseUrl, openclawAutoMemory, openclawAutoMemoryDedupe, openclawAutoMemoryNoveltyThreshold, openclawAutoMemoryMaxRecent, } = req.body;
+            const { cloudApiKey, cloudEnabled, cloudBaseUrl, cloudSyncProjectMode, cloudSyncProjects, cloudSyncContentMode, cloudSyncExcludeSensitive, openclawAutoMemory, openclawAutoMemoryDedupe, openclawAutoMemoryNoveltyThreshold, openclawAutoMemoryMaxRecent, } = req.body;
             if (openclawAutoMemory !== undefined && typeof openclawAutoMemory !== 'boolean') {
                 return res.status(400).json({ error: 'openclawAutoMemory must be a boolean' });
             }
@@ -68,11 +71,36 @@ export function registerSystemRoutes(app, deps) {
                 (typeof openclawAutoMemoryMaxRecent !== 'number' || Number.isNaN(openclawAutoMemoryMaxRecent))) {
                 return res.status(400).json({ error: 'openclawAutoMemoryMaxRecent must be a number' });
             }
+            if (cloudSyncProjectMode !== undefined &&
+                cloudSyncProjectMode !== 'all' &&
+                cloudSyncProjectMode !== 'include' &&
+                cloudSyncProjectMode !== 'exclude') {
+                return res.status(400).json({ error: 'cloudSyncProjectMode must be all, include, or exclude' });
+            }
+            if (cloudSyncContentMode !== undefined &&
+                cloudSyncContentMode !== 'full' &&
+                cloudSyncContentMode !== 'metadata') {
+                return res.status(400).json({ error: 'cloudSyncContentMode must be full or metadata' });
+            }
+            if (cloudSyncExcludeSensitive !== undefined &&
+                typeof cloudSyncExcludeSensitive !== 'boolean') {
+                return res.status(400).json({ error: 'cloudSyncExcludeSensitive must be a boolean' });
+            }
+            if (cloudSyncProjects !== undefined &&
+                (!Array.isArray(cloudSyncProjects) || cloudSyncProjects.some((value) => typeof value !== 'string'))) {
+                return res.status(400).json({ error: 'cloudSyncProjects must be an array of strings' });
+            }
             setCloudConfig({
                 ...(cloudApiKey !== undefined && { cloudApiKey }),
                 ...(cloudEnabled !== undefined && { cloudEnabled }),
                 ...(cloudBaseUrl !== undefined && { cloudBaseUrl }),
             });
+            setCloudSyncControls({
+                ...(cloudSyncProjectMode !== undefined && { projectMode: cloudSyncProjectMode }),
+                ...(cloudSyncProjects !== undefined && { projects: cloudSyncProjects }),
+                ...(cloudSyncContentMode !== undefined && { contentMode: cloudSyncContentMode }),
+                ...(cloudSyncExcludeSensitive !== undefined && { excludeSensitive: cloudSyncExcludeSensitive }),
+            });
             setOpenClawMemoryConfig({
                 ...(openclawAutoMemory !== undefined && { autoMemory: openclawAutoMemory }),
                 ...(openclawAutoMemoryDedupe !== undefined && { dedupe: openclawAutoMemoryDedupe }),
@@ -85,6 +113,7 @@ export function registerSystemRoutes(app, deps) {
                 enabled: updated.cloudEnabled,
                 apiKeySet: !!updated.cloudApiKey,
                 baseUrl: updated.cloudBaseUrl,
+                syncControls: getCloudSyncControls(),
                 openclawMemory: getOpenClawMemoryConfig(),
             });
         }
@@ -122,10 +151,25 @@ export function registerSystemRoutes(app, deps) {
             res.json({
                 enabled: config.cloudEnabled,
                 apiKeySet: !!config.cloudApiKey,
+                baseUrl: config.cloudBaseUrl,
+                featureEnabled: isFeatureEnabled('cloud_sync'),
+                requiredTier: getRequiredTier('cloud_sync'),
+                controls: getCloudSyncControls(),
                 lastSyncAt: (typeof raw.lastSyncAt === 'string' ? raw.lastSyncAt : null),
+                device: {
+                    id: getDeviceId(),
+                    name: getDeviceName(),
+                    platform: `${process.platform}/${process.arch}`,
+                },
                 queue: {
                     pending: queue.pending,
                     failed: queue.failed,
+                    synced: queue.synced,
+                    byKind: queue.byKind,
+                    oldestPendingAt: queue.oldestPendingAt,
+                    nextRetryAt: queue.nextRetryAt,
+                    lastError: queue.lastError,
+                    lastErrorKind: queue.lastErrorKind,
                 },
             });
         }
@@ -133,6 +177,27 @@ export function registerSystemRoutes(app, deps) {
             res.status(500).json({ error: error.message });
         }
     });
+    app.get('/api/cloud/projects', (_req, res) => {
+        try {
+            const db = getDatabase();
+            const rows = db.prepare(`
+        SELECT project, COUNT(*) as count
+        FROM memories
+        WHERE project IS NOT NULL AND TRIM(project) != ''
+        GROUP BY project
+        ORDER BY count DESC, project ASC
+      `).all();
+            res.json({
+                projects: rows.map((row) => ({
+                    project: row.project,
+                    count: Number(row.count ?? 0),
+                })),
+            });
+        }
+        catch (error) {
+            res.status(500).json({ error: error.message });
+        }
+    });
     app.get('/api/version', (_req, res) => {
         try {
             const version = getCurrentVersion();

package/dist/cloud/cli.d.ts

@@ -1 +1,2 @@
 export declare function handleCloudConfig(args: string[]): void;
+export declare function handleCloudCommand(args: string[]): Promise<void>;

package/dist/cloud/cli.js

@@ -1,4 +1,9 @@
 import { getCloudConfig, setCloudConfig, getDefenceMode, setDefenceMode, getVerifyConfig, setVerifyConfig, getOpenClawAutoMemory, setOpenClawAutoMemory, } from './config.js';
+import { syncAllGraphToCloud } from './graph-sync.js';
+import { syncAllMemoriesToCloud } from './memory-sync.js';
+import { isFeatureEnabled } from '../license/gate.js';
+import { initDatabase } from '../database/init.js';
+import { reconcileSyncQueue } from './sync-queue.js';
 const VALID_MODES = ['strict', 'balanced', 'permissive'];
 const VALID_VERIFY_MODES = ['advisory', 'enforce'];
 export function handleCloudConfig(args) {
@@ -128,3 +133,38 @@ export function handleCloudConfig(args) {
         console.log('  --verify-timeout <ms>  Set verify timeout in ms (1000-30000)');
     }
 }
+export async function handleCloudCommand(args) {
+    const action = args[0];
+    if (action === 'sync' && args.includes('--full')) {
+        const config = getCloudConfig();
+        if (!config.cloudEnabled || !config.cloudApiKey) {
+            console.error('Cloud sync is not configured. Set an API key and enable cloud sync first.');
+            process.exit(1);
+        }
+        if (!isFeatureEnabled('cloud_sync')) {
+            console.error('Cloud memory sync requires a Team or higher licence.');
+            process.exit(1);
+        }
+        initDatabase();
+        console.log('Syncing local memories and graph to ShieldCortex Cloud...');
+        const memoryResult = await syncAllMemoriesToCloud();
+        const graphResult = await syncAllGraphToCloud();
+        let reconciled = 0;
+        if (memoryResult.failed === 0 && graphResult.failedBatches === 0) {
+            reconciled = reconcileSyncQueue({
+                kinds: ['memory', 'graph'],
+                statuses: ['pending', 'failed'],
+                maxCreatedAt: new Date().toISOString(),
+            }).removed;
+        }
+        console.log(`Finished. ${memoryResult.synced}/${memoryResult.total} memories synced` +
+            `${memoryResult.failed > 0 ? `, ${memoryResult.failed} queued for retry` : ''}.`);
+        console.log(`Graph replica: ${graphResult.entities} entities, ${graphResult.triples} relationships, ${graphResult.memoryEntities} memory links` +
+            `${graphResult.failedBatches > 0 ? `, ${graphResult.failedBatches} batch${graphResult.failedBatches === 1 ? '' : 'es'} queued for retry` : ''}.`);
+        if (reconciled > 0) {
+            console.log(`Reconciled ${reconciled} stale sync queue entr${reconciled === 1 ? 'y' : 'ies'}.`);
+        }
+        return;
+    }
+    console.log('Usage: shieldcortex cloud sync --full');
+}