skills-viewer 0.7.0 → 0.8.1

package/README.md

@@ -1,6 +1,6 @@
 # skills-viewer
 
-Browse, search and manage your [Claude Code](https://code.claude.com) skills, commands, agents and hooks in the browser.
+Browse, search and manage your [Claude Code](https://code.claude.com) skills, commands, agents, hooks and auto memory in the browser.
 
 Scans every project registered in `~/.claude.json` (plus user scope, plugins and built-ins), and serves a local web UI to explore them — with usage stats, AI-generated summaries, full SKILL.md rendering, same-name diffs, and copy/delete management.
 
@@ -19,11 +19,12 @@ npx skills-viewer
 - **All scopes in one view** — user (`~/.claude/skills`), every project's `.claude/skills` / `.claude/commands`, installed plugins, and Claude Code built-ins, grouped by source
 - **Purpose grouping (AI)** — one haiku call classifies everything installed by _when you use it_ into 4–8 groups generated for your environment (planning / building / review / release / … as a role-agnostic guide — a designer's or PM's skills get their own groups). Switch the list between by-source, by-purpose and flat views; a frontmatter `category:` pins an item to a manual group that takes precedence
 - **Search / sort** — incremental search over name + description + usage; sort by name, usage count, last used, updated date, or token cost
-- **Diagnostics** — an _unused_ badge (no recorded use within the transcript retention window) with an all / used / unused filter, plus static description lint: missing / too-short / too-long descriptions, missing trigger conditions ("use when …") that make auto-invocation unlikely, and name-echo descriptions
+- **Diagnostics** — a _no recent use_ badge (no recorded use within the transcript retention window) with an all / recent use / no recent use filter, plus static description lint: missing / too-short / too-long descriptions, missing trigger conditions ("use when …") that make auto-invocation unlikely, and name-echo descriptions
 - **Token cost** — since every name + description is injected into each session, the estimated token overhead is shown per item, per scope, and as a per-session total for the current project
 - **AI trigger diagnosis** — one click asks the model whether the description is likely to trigger auto-invocation, lists concrete issues, and proposes an improved description you can apply with one click (cached by content hash)
 - **AI flow diagram** — extract the processing flow of orchestration-style skills (steps, branches, delegations, human gates) from the definition body and render it as a step diagram; delegated skills are clickable
 - **AI model choice** — pick the model behind all AI features (haiku default / sonnet / opus) in settings; aliases are resolved by your claude CLI
+- **Memory triage** — a _Memory_ view lists Claude Code's auto memory (`~/.claude/projects/<project>/memory/`, or the directory set by `autoMemoryDirectory`) per project with its context cost split into the always-on part (the `MEMORY.md` index line injected into every session) and the pay-per-use part (the body, read on demand), plus Read / Write counts from transcripts, `[[link]]` resolution and backlinks. **AI triage** reads every memory of a project with the claude CLI (one call, split into a few for very large projects) and proposes a destination per memory — keep / shrink / move to CLAUDE.md / move to your user CLAUDE.md / move to docs / move to a skill / delete / wrong project — with the reasoning and a paste-ready instruction for Claude Code (it is asked to always cover removing the `MEMORY.md` index line and re-pointing `[[link]]`s). Each memory is first judged for freshness (current / outdated / historical / obsolete) from mechanical signals — dates in the body, missing paths, merged or deleted branches, references to another project — and a _rewrite the body_ verdict covers memories whose gist still holds; the triage also flags when the `MEMORY.md` index line disagrees with the body. For feedback memories the instruction is built from a fixed template, so it reads the same on every model. The viewer never writes to memory: you paste the instruction into Claude Code, which inspects, asks when unsure, and executes after your approval
 - **Edit in the browser** — inline editor for SKILL.md / commands / agents (project & user scopes) with mtime conflict detection and a one-generation backup in `~/.cache/skills-viewer/backups/`
 - **What's changed** — a banner shows items added / updated / removed since your last launch (baseline advances only when you dismiss it); the CLI prints a one-line summary at startup too
 - **Usage sparkline** — the detail pane charts the last 30 days of per-day usage
@@ -35,7 +36,7 @@ npx skills-viewer
 - **Same-name diff** — when the same skill name exists in multiple scopes, the detail page lists the other definitions and shows a line diff between them
 - **Open in editor** — via URL scheme (VS Code / Cursor / Zed / Windsurf / custom, configurable in the ⚙ settings modal), or the OS default opener
 - **English / 日本語** — UI language auto-detected from the browser and switchable in settings; AI summaries are generated in the selected language (CLI messages follow `LANG`)
-- **URL routing** — `/skills/:id?tab=md`, search/sort/grouping in query params; links are shareable across reloads
+- **URL routing** — `/skills/:id?tab=md`, `/memory/:id`, `/memory/triage/:project`, search/sort/grouping in query params; links are shareable across reloads
 
 ## Usage
 
@@ -52,6 +53,7 @@ Run it from a project directory to have that project marked as “current” and
 - Binds to `127.0.0.1` only
 - Mutating APIs require a per-run token that other origins cannot read (same-origin policy), and requests with a non-localhost `Origin` are rejected
 - Copy/delete are restricted to `.claude/skills/` / `.claude/commands/` / `.claude/agents/` paths; plugin directories are never written to; deletions go to the OS trash
+- Reads stay inside `~/.claude`, the per-project `.claude` directories and the `autoMemoryDirectory` you configured — a setting that resolves to a filesystem root, your home directory or an ancestor of it is ignored
 
 ## Development
 
@@ -77,11 +79,13 @@ dist/             # prebuilt UI shipped in the npm package (generated by prepack
 
 ## Notes
 
-- Usage stats only cover the transcript retention window of Claude Code (`cleanupPeriodDays`, default 30 days) — the _unused_ badge has the same limitation
+- Usage stats only cover the transcript retention window of Claude Code (`cleanupPeriodDays`, default 30 days) — the _no recent use_ badge and memory Read counts have the same limitation (projects without transcripts show no usage columns at all)
 - Token costs are heuristic estimates (≈4 chars/token for ASCII, ≈1.5 for CJK), not exact tokenizer counts
 - Usage is attributed per calling project (worktrees roll up to their parent project by encoded-path prefix). When scopes share a name, the resolution order project > user > plugin > built-in is assumed
 - The built-in skill list is hardcoded in `server/scan.js` (they live inside the Claude Code binary); check `/skills` inside Claude Code for the authoritative list
 - AI summaries require a logged-in `claude` CLI
+- Memory triage sends each memory's body to the claude CLI, together with the project's `MEMORY.md` index, the **headings** of `CLAUDE.md` / `.claude/CLAUDE.md` / `~/.claude/CLAUDE.md` and the names + descriptions of the skills available to that project (never their bodies) so it can spot duplicates and promotion targets. Branch status for the freshness signals comes from local `git` (no network). Results are cached per memory by content hash (plus the index line); memory files themselves are never modified
+- The Memory view resolves `autoMemoryDirectory` from your user settings and the current project only — project-scope settings of other projects are not read
 
 ## License
 

package/build/server/cache.js

@@ -0,0 +1,53 @@
+"use strict";
+/*
+ * AI 機能のキャッシュ(~/.cache/skills-viewer/*.json)の共通処理。
+ * どのキャッシュも「実パス → エントリ」の形なので、掃除の規則を 1 箇所に置く。
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneMissing = pruneMissing;
+const fs = __importStar(require("node:fs"));
+/*
+ * 消えたファイル(削除・リネーム・別プロジェクトの撤去)のエントリを落とす。
+ * 呼ぶのは保存時だけにする — GET(読み取り API)で書き込みを発生させないため。
+ */
+function pruneMissing(store) {
+    const out = {};
+    for (const [key, value] of Object.entries(store)) {
+        if (fs.existsSync(key))
+            out[key] = value;
+    }
+    return out;
+}

package/build/server/diagnose.js

@@ -45,6 +45,7 @@ exports.attachDiagnoses = attachDiagnoses;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+const cache_1 = require("./cache");
 const summary_1 = require("./summary");
 const DIAG_FILE = path.join(os.homedir(), '.cache', 'skills-viewer', 'diagnoses.json');
 function loadDiagnoses() {
@@ -57,7 +58,8 @@ function loadDiagnoses() {
 }
 function saveDiagnoses(store) {
     fs.mkdirSync(path.dirname(DIAG_FILE), { recursive: true });
-    fs.writeFileSync(DIAG_FILE, JSON.stringify(store, null, 1));
+    // 保存のついでに死にエントリを掃除する(GET では書き込まないので掃除もしない)
+    fs.writeFileSync(DIAG_FILE, JSON.stringify((0, cache_1.pruneMissing)(store), null, 1));
 }
 function buildPrompt(name, content, lang) {
     if (lang === 'ja') {

package/build/server/flow.js

@@ -45,6 +45,7 @@ exports.attachFlows = attachFlows;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+const cache_1 = require("./cache");
 const summary_1 = require("./summary");
 const FLOW_FILE = path.join(os.homedir(), '.cache', 'skills-viewer', 'flows.json');
 /*
@@ -63,7 +64,8 @@ function loadFlows() {
 }
 function saveFlows(store) {
     fs.mkdirSync(path.dirname(FLOW_FILE), { recursive: true });
-    fs.writeFileSync(FLOW_FILE, JSON.stringify(store, null, 1));
+    // 保存のついでに死にエントリを掃除する(GET では書き込まないので掃除もしない)
+    fs.writeFileSync(FLOW_FILE, JSON.stringify((0, cache_1.pruneMissing)(store), null, 1));
 }
 function buildPrompt(name, content, lang) {
     if (lang === 'ja') {

package/build/server/index.js

@@ -46,12 +46,14 @@ const crypto = __importStar(require("node:crypto"));
 const node_child_process_1 = require("node:child_process");
 const scan_1 = require("./scan");
 const usage_1 = require("./usage");
+const memory_1 = require("./memory");
 const summary_1 = require("./summary");
 const manage_1 = require("./manage");
 const edit_1 = require("./edit");
 const diagnose_1 = require("./diagnose");
 const flow_1 = require("./flow");
 const groups_1 = require("./groups");
+const memory_triage_1 = require("./memory-triage");
 const snapshot_1 = require("./snapshot");
 const errors_1 = require("./errors");
 const locale_1 = require("./locale");
@@ -134,7 +136,66 @@ function attributeUsage(sections) {
     }
     return Object.keys(byDir).length > 0;
 }
+/*
+ * memory の Read(参照)/ Write・Edit(作成・更新)実績を付与する。
+ * skill と違って帰属先の解決は不要で、Read の file_path がそのまま実ファイルを指す。
+ * usageAvailable は「そのプロジェクトのトランスクリプトがあるか」= エンコード名で始まる
+ * ディレクトリ(worktree 分を含む)に jsonl が 1 件以上あるか。false なら Read 列は出さない。
+ * 判定そのもの(共有ストアの扱いを含む)は usageAvailableFor に集約している。
+ */
+function attributeMemoryUsage(memory) {
+    if (!memory.length)
+        return;
+    const { byPath, dirsWithTranscripts } = (0, usage_1.scanMemoryUsage)();
+    for (const sec of memory) {
+        // autoMemoryDirectory の置き場は id が置き場のパス由来なので、transcript の
+        // ディレクトリ名(現在のプロジェクトの slug)を別に持っている
+        sec.usageAvailable = (0, memory_1.usageAvailableFor)(sec, dirsWithTranscripts);
+        for (const it of sec.items) {
+            const u = byPath[it.path];
+            if (!u)
+                continue;
+            if (u.reads > 0) {
+                it.useCount = u.reads;
+                it.lastUsed = u.lastRead;
+                it.dailyUse = u.daily;
+            }
+            if (u.writes > 0)
+                it.writeCount = u.writes;
+        }
+    }
+}
+/*
+ * 実績付きの memory セクション一覧。/api/skills だけでなく /api/memory-triage からも
+ * 同じ事実(Read / W-E / usageAvailable)をプロンプトに載せる必要があるので共通化する。
+ */
+function memorySections(cwd) {
+    primeMemoryRoots(cwd);
+    const memory = (0, memory_1.scanMemory)(cwd);
+    attributeMemoryUsage(memory);
+    return memory;
+}
+/*
+ * この環境の自動メモリ置き場(autoMemoryDirectory)を usage 集計の許可ルートに設定する。
+ * skill 集計と memory 集計は同じ transcript キャッシュを共有するので、走査を始める前に
+ * 揃えておかないと同じファイルを二度読みすることになる(解決自体は memo 済みで安い)。
+ */
+function primeMemoryRoots(cwd) {
+    const auto = (0, memory_1.resolveAutoMemoryDir)(cwd);
+    if (!auto) {
+        (0, usage_1.setMemoryRoots)([]);
+        return;
+    }
+    /*
+     * 設定値そのものと、その実パス(異なるときだけ)の両方を許可ルートにする。
+     * transcript の file_path が symlink 解決済みで記録される環境があり、設定値だけを
+     * 前方一致に使うと、その置き場の Read / Write を丸ごと取り逃すため。
+     */
+    const real = (0, memory_1.realDir)(auto.dir);
+    (0, usage_1.setMemoryRoots)(real !== auto.dir ? [auto.dir, real] : [auto.dir]);
+}
 function collect(cwd, lang) {
+    primeMemoryRoots(cwd);
     const sections = (0, scan_1.scanSections)(cwd, lang);
     const usageAvailable = attributeUsage(sections);
     const summaries = (0, summary_1.loadSummaries)();
@@ -162,6 +223,12 @@ function collect(cwd, lang) {
     (0, flow_1.attachFlows)(sections, lang);
     const grp = (0, groups_1.attachGroups)(sections, lang);
     const aiStale = (0, summary_1.staleItems)(sections, lang).length;
+    // memory は「呼び出す」ものではないので sections には混ぜず、別配列で同乗させる
+    const memory = memorySections(cwd);
+    // 共有ストア環境かどうかは cwd から解決した値で判定する(棚卸し側と同じ事実を見る)
+    (0, memory_triage_1.attachMemoryTriage)(memory, lang, undefined, {
+        sharedEnv: (0, memory_1.resolveAutoMemoryDir)(cwd)?.scope === 'user',
+    });
     const targets = [
         { label: 'user skills', sub: '~/.claude/skills/', path: scan_1.HOME },
         ...(0, scan_1.listProjects)(cwd)
@@ -178,6 +245,7 @@ function collect(cwd, lang) {
         changes: (0, snapshot_1.computeChanges)(sections),
         ...(grp.groups ? { groups: grp.groups } : {}),
         ...(grp.stale ? { groupsStale: true } : {}),
+        ...(memory.length ? { memory: (0, memory_1.publicMemory)(memory) } : {}),
     };
 }
 /* DNS rebinding 対策: same-origin GET には Origin が付かないため Host 側も検証する */
@@ -219,7 +287,7 @@ function handleApi(req, res, cwd) {
             if (url.pathname === '/api/summary-status')
                 return send(200, (0, summary_1.summaryStatus)());
             if (url.pathname === '/api/file') {
-                const real = (0, manage_1.assertReadableMd)(url.searchParams.get('src') || '');
+                const real = (0, manage_1.assertReadableMd)(url.searchParams.get('src') || '', cwd);
                 // mtime は編集画面の競合検出(/api/save の baseMtime)に使う
                 return send(200, {
                     content: fs.readFileSync(real, 'utf8'),
@@ -257,7 +325,7 @@ function handleApi(req, res, cwd) {
             if (url.pathname === '/api/apply-description')
                 return send(200, (0, edit_1.doApplyDescription)(data));
             if (url.pathname === '/api/diagnose') {
-                const real = (0, manage_1.assertReadableMd)(data.src);
+                const real = (0, manage_1.assertReadableMd)(data.src, cwd);
                 const name = data.name || path.basename(path.dirname(real));
                 (0, diagnose_1.diagnoseOne)(real, name, lang, model)
                     .then((d) => send(200, { ok: true, ...d }))
@@ -265,7 +333,7 @@ function handleApi(req, res, cwd) {
                 return;
             }
             if (url.pathname === '/api/flow') {
-                const real = (0, manage_1.assertReadableMd)(data.src);
+                const real = (0, manage_1.assertReadableMd)(data.src, cwd);
                 const name = data.name || path.basename(path.dirname(real));
                 (0, flow_1.flowOne)(real, name, lang, model)
                     .then((f) => send(200, { ok: true, ...f }))
@@ -281,7 +349,7 @@ function handleApi(req, res, cwd) {
             if (url.pathname === '/api/delete')
                 return send(200, (0, manage_1.doDelete)(data));
             if (url.pathname === '/api/open')
-                return send(200, (0, manage_1.openInEditor)(data));
+                return send(200, (0, manage_1.openInEditor)(data, cwd));
             if (url.pathname === '/api/summarize-all')
                 return send(200, (0, summary_1.startSummarizeAll)((0, scan_1.scanSections)(cwd, lang), !!data.force, lang, model));
             if (url.pathname === '/api/group-generate') {
@@ -291,8 +359,31 @@ function handleApi(req, res, cwd) {
                     .catch((e) => send(400, (0, errors_1.toErrorBody)(e)));
                 return;
             }
+            if (url.pathname === '/api/memory-triage') {
+                // 1 プロジェクト分をまとめて 1 回の claude 呼び出しで棚卸しする(結果は再取得で反映)
+                const project = String(data.project || '');
+                const sec = memorySections(cwd).find((s) => s.id === project);
+                if (!sec)
+                    throw new errors_1.ApiError('not-found', project);
+                const files = Array.isArray(data.files)
+                    ? data.files.filter((f) => typeof f === 'string')
+                    : undefined;
+                // sections は「CLAUDE.md / skill に既に書いてある」「skill へ昇格」を判定させる文脈。
+                // AI を呼ぶときだけ要るので、フルスキャンは関数で渡して遅延させる
+                (0, memory_triage_1.triageProject)(sec, lang, model, {
+                    force: !!data.force,
+                    files,
+                    sections: () => (0, scan_1.scanSections)(cwd, lang),
+                    // 置き場の解決は起動ディレクトリ基準。process.cwd() 任せにせず、この
+                    // リクエストと同じ cwd で解決した値を渡す(スキャン・読み取り許可と同じ事実を見る)
+                    autoMemory: (0, memory_1.resolveAutoMemoryDir)(cwd),
+                })
+                    .then((results) => send(200, { ok: true, results }))
+                    .catch((e) => send(400, (0, errors_1.toErrorBody)(e)));
+                return;
+            }
             if (url.pathname === '/api/summarize') {
-                const real = (0, manage_1.assertReadableMd)(data.src);
+                const real = (0, manage_1.assertReadableMd)(data.src, cwd);
                 // refs(関係候補)はスキャン結果から復元する
                 const sections = (0, scan_1.scanSections)(cwd, lang);
                 const item = sections.flatMap((s) => s.items).find((x) => x.path === real);
@@ -332,7 +423,7 @@ function serveStatic(req, res) {
 }
 /*
  * 起動時の1〜2行サマリー(--no-open 運用でも価値が出るように)。
- * 前回からの差分 + セッション注入トークン概算 + 未使用件数。失敗しても起動は止めない。
+ * 前回からの差分 + セッション注入トークン概算 + 直近未使用の件数。失敗しても起動は止めない。
  */
 function printStartupSummary(cwd) {
     try {
@@ -350,8 +441,8 @@ function printStartupSummary(cwd) {
                 .length
             : null;
         console.log((0, locale_1.srvMsg)(`スキル定義のセッション注入 ≈${sessionTokens.toLocaleString()}tok` +
-            (unused !== null ? ` / 未使用 ${unused} 件` : ''), `Skill definitions inject ≈${sessionTokens.toLocaleString()} tok/session` +
-            (unused !== null ? ` / ${unused} unused` : '')));
+            (unused !== null ? ` / 直近未使用 ${unused} 件` : ''), `Skill definitions inject ≈${sessionTokens.toLocaleString()} tok/session` +
+            (unused !== null ? ` / ${unused} with no recent use` : '')));
     }
     catch {
         /* サマリーは補助情報。失敗しても起動を妨げない */

package/build/server/manage.js

@@ -45,6 +45,7 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const scan_1 = require("./scan");
+const memory_1 = require("./memory");
 const errors_1 = require("./errors");
 const HOME = os.homedir();
 /* realpath 解決(存在しないパスは not-found に正規化) */
@@ -77,19 +78,55 @@ function assertManagedPath(p) {
         throw new errors_1.ApiError('not-managed-path', real);
     return { real, kind };
 }
-/* 読み取り専用は plugin 配下も許可(.claude 配下の .md のみ) */
-function assertReadableMd(p) {
+/*
+ * 自動メモリの置き場(settings の autoMemoryDirectory)の realpath。キャッシュは解決値ごとに 1 回。
+ * 設定が有効な環境では memory の実体が .claude の外へ丸ごと移るため、
+ * 一覧に出ている本文が読めない(fetchFile・棚卸しモーダル・エディタで開くが全滅する)。
+ */
+const autoRealMemo = new Map();
+function autoMemoryRoot(cwd) {
+    const info = (0, memory_1.resolveAutoMemoryDir)(cwd);
+    if (!info)
+        return null;
+    const cached = autoRealMemo.get(info.dir);
+    if (cached)
+        return cached;
+    try {
+        const real = fs.realpathSync(info.dir);
+        // 解決できたときだけ覚える(置き場がまだ無い時点の失敗を焼き付けない。
+        // ディレクトリは後から作られ得るので、次のリクエストで解決し直せるようにする)
+        autoRealMemo.set(info.dir, real);
+        return real;
+    }
+    catch {
+        return null;
+    }
+}
+/*
+ * 解決済み autoMemoryDirectory の配下か。realpath 同士を path.sep 区切りで前方一致させる
+ * (symlink 経由のパスで一致が外れないように / `<dir>-other` のような兄弟を巻き込まないように)。
+ * `.claude` のルールは緩めず、この許可を足すだけ。
+ */
+function underAutoMemory(real, cwd) {
+    const root = autoMemoryRoot(cwd);
+    // isUnder はケース非依存 FS で case-fold する(root が `/USERS/…` のとき
+    // 実ファイルの realpath `/Users/…` と取り違えないように)
+    return !!root && real !== root && (0, memory_1.isUnder)(real, root);
+}
+const underDotClaude = (real) => real.includes(path.sep + '.claude' + path.sep);
+/* 読み取り専用は plugin 配下も許可(.claude 配下 + 自動メモリの置き場配下の .md のみ) */
+function assertReadableMd(p, cwd = process.cwd()) {
     const real = realpathOrThrow(p);
     if (!real.endsWith('.md'))
         throw new errors_1.ApiError('not-md', real);
-    if (!real.includes(path.sep + '.claude' + path.sep))
+    if (!underDotClaude(real) && !underAutoMemory(real, cwd))
         throw new errors_1.ApiError('not-readable-path', real);
     return real;
 }
-/* エディタで開くのは .claude 配下ならなんでも良い(settings.json 等も含む) */
-function assertOpenablePath(p) {
+/* エディタで開くのは .claude 配下(settings.json 等も含む)と自動メモリの置き場配下 */
+function assertOpenablePath(p, cwd) {
     const real = realpathOrThrow(p);
-    if (!real.includes(path.sep + '.claude' + path.sep))
+    if (!underDotClaude(real) && !underAutoMemory(real, cwd))
         throw new errors_1.ApiError('not-openable-path', real);
     return real;
 }
@@ -190,8 +227,8 @@ function detectEditor() {
     }
     return (editorCache = { cmd: null });
 }
-function openInEditor({ src }) {
-    const real = assertOpenablePath(src);
+function openInEditor({ src }, cwd = process.cwd()) {
+    const real = assertOpenablePath(src, cwd);
     const { cmd } = detectEditor();
     if (cmd) {
         (0, node_child_process_1.spawn)(cmd, [real], { detached: true, stdio: 'ignore' }).unref();