superlocalmemory 4.0.6 → 4.0.7

package/CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.7] — Reachable
+
+Everything here was already built. None of it could be used.
+
+### Added
+- **`slm summary` — the readable layer over your memories.** Requested in #113
+  and shipped without a way to call it in 4.0.6.
+  - `slm summary day` — what you recorded today (also `yesterday`, or a date)
+  - `slm summary project` — what was worked on, for a directory
+  - `slm summary session <id>` — what one session covered
+
+  Every summary says how much of the underlying data it could actually see, and
+  `--json` lists the exact memories it was built from. Session data is sparse —
+  roughly 4% of facts carry a session id — so a session summary reports that
+  rather than presenting a fraction as the whole. No language model needed, so
+  these work in the fully offline mode.
+- **Memories now link to the code they mention.** A memory that names a
+  function, method or file is connected to it in the code graph, with a short
+  description of what it points at and a marker when the code has since changed.
+  Expanding a memory in the dashboard shows this; nothing appears if you have no
+  code graph. Runs during background maintenance, never when a memory is saved,
+  and requires no language model.
+- **`scripts/bump_version.py`** sets the release version in all fifteen places
+  that declare one, with `--check` for CI.
+
+### Fixed
+- **The code↔memory bridge never ran.** Four things were missing at once: setup
+  wrote a `bridge_enabled` flag no code read, the code-graph build discarded it,
+  the code-graph settings had no loader at all, and the method the bridge was
+  written against was an unimplemented placeholder. Enabling the code graph
+  during setup left the flag on disk and the feature inert, with nothing to
+  indicate it.
+- **Version numbers disagreed across the project.** 4.0.6 shipped with the pip
+  requirements pins, the npm lockfile, the editor plugin manifest, the citation
+  metadata and the lockfile all still reading 4.0.5, and the agent rule footers
+  reading 4.0.4. Installing from `requirements.txt` fetched the wrong release.
+- **Stale-memory checks reported "nothing is stale" when the feature was off.**
+  They answer entirely from code links, so with linking disabled they returned an
+  empty list — the most reassuring possible answer, from something that never
+  ran. They now say the feature is off, and the remediation message names a
+  setting that exists (it previously named one that did not).
+- **`slm help` did not mention `gdpr`**, which shipped in 4.0.6. The drift guard
+  that should have caught it only read one file, so a command registered
+  elsewhere was exempt from the check.
+- **Consolidation could create a database file named after a bad argument.**
+  Given something that was neither a database handle nor a path, it stringified
+  the object and let SQLite create that filename. It now refuses the argument.
+
 ## [4.0.6] — The Connected Brain
 
 ### Added
@@ -14,10 +62,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   a starting value as a measured result. Source quality no longer lists internal
   identifiers; when nothing has been measured yet it says so and explains what
   would change that.
-- **Session, daily and project summaries.** A readable layer over your memories:
-  what a session covered, what a day's main topics were, and what was worked on
-  per project. Each one links back to the memories it came from, and each states
-  how much of the underlying data it could actually cover. Requested in #113.
+- **Session, daily and project summaries — generators only, not yet reachable.**
+  A readable layer over your memories: what a session covered, what a day's main
+  topics were, and what was worked on per project. Each links back to the
+  memories it came from and states how much of the underlying data it could
+  actually cover. Corrected after release: 4.0.6 ships the generators but no
+  command, tool or endpoint that calls them, so there is no way to use this yet.
+  The surface lands in 4.0.7. Requested in #113.
 - **Entity-level memory consolidation now runs.** Repeated facts about the same
   entity are merged during maintenance, and the originals are archived rather
   than deleted.

package/README.md

@@ -5,7 +5,7 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V4.0.6</h1>
+<h1 align="center">SuperLocalMemory V4.0.7</h1>
 
 <h2 align="center">Rent the LLM. Own the memory.</h2>
 
@@ -27,12 +27,12 @@ guarantee here is stated as a falsifiable invariant, tested under an adversarial
 negative control, and shipped with the harness that regenerates the evidence:
 <code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
 does <em>not</em> exercise is stated too.</p>
-<p align="center"><code>v4.0.6</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v4.0.7</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>Four public arXiv preprints</strong> · V4: <a href="https://arxiv.org/abs/2608.08253">arXiv:2608.08253</a> · companion archive: <a href="https://zenodo.org/records/21853302">Zenodo 21853302</a> (<a href="https://doi.org/10.5281/zenodo.21853302">DOI 10.5281/zenodo.21853302</a>) · prior preprints: <a href="https://arxiv.org/abs/2603.02240">2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">2604.04514</a>.</p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.6-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.6 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.7-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.7 — Current Release"/></a>
   <a href="https://arxiv.org/abs/2608.08253"><img src="https://img.shields.io/badge/arXiv-2608.08253-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="SuperLocalMemory 4.0 paper on arXiv:2608.08253"/></a>
   <a href="https://zenodo.org/records/21853302"><img src="https://img.shields.io/badge/Zenodo-10.5281%2Fzenodo.21853302-1682D4?style=for-the-badge&logo=zenodo&logoColor=white" alt="V4 paper on Zenodo: 10.5281/zenodo.21853302"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
@@ -62,16 +62,11 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 
 **Memory with a sense of time.** SLM does not only store *what* an agent learned — it records *when*. Every fact carries ingestion timing and provenance; recall runs a dedicated temporal candidate channel alongside semantic, lexical, and associative retrieval; scenes and entity timelines reconstruct sequence; and the lifecycle lets neglected memory decay and self-archive instead of growing without bound. Time is a first-class ranking and lifecycle signal rather than a timestamp column an agent never reads — which is what lets a long-lived agent reason about how its context changed, not only what it currently holds.
 
-**What V4.0.6 ships.** The Living Brain is written for the person who owns the memory, not for the person who built the ranker. It leads with how many questions your memory has actually answered instead of a raw event count, names its ranking phase in words, and refuses to present an untrained starting value as a measured result — where nothing has been measured yet, it says so and says what would change that. Alongside it, a readable consolidation layer: session, daily, and project summaries, each linked back to the memories it was derived from and each explicit about how much of the underlying data it could cover. Entity-level consolidation now actually runs during maintenance, merging repeated facts about the same entity and archiving the originals rather than deleting them. Codex and Bounded Loops are detected and shown among connected clients, labelled by the evidence that supports them — configuration proves setup, not traffic, and the dashboard says which one it has. Presence now distinguishes "no agents are active" from "presence has stopped being recorded", because those looked identical before and only one of them is fine. See [reviewed corrections](docs/reviewed-corrections.md) for the correction lifecycle and [MCP tools](docs/mcp-tools.md) for host-facing commands.
+**What V4.0.7 ships.** Three things that existed but could not be used. `slm summary` gives you a readable layer over your own memories — `day` for what you recorded today, `project` for a directory, `session` for one session — each stating how much of the underlying data it could actually see, with `--json` listing the exact memories it came from. Memories that mention a function, method or file are now linked to that code, with a short description of what they point at and a marker once the code has changed; expanding a memory in the dashboard shows it. Both need no language model, so they work in the fully local mode. The code↔memory bridge behind the second one had never run at all: the setup flag was written and never read, the build discarded it, its settings had no loader, and the method it was written against was an unimplemented placeholder. Linking runs during background maintenance, never when a memory is saved. See [reviewed corrections](docs/reviewed-corrections.md) for the correction lifecycle and [MCP tools](docs/mcp-tools.md) for host-facing commands.
 
-**Fixed in V4.0.6.** The knowledge graph no longer opens blank. It framed itself against a canvas that had no size yet, spent its whole frame budget drawing off-screen, and stopped — so the graph appeared only after you moved the node slider. Returning to the pane cleared the canvas without redrawing it, which failed the same way for a different reason. Both are fixed, the default node count is 50, and on narrower screens the details and chat panel is reachable instead of stranded a screen-height below the fold. Recall no longer raises when the reranker reports success but returns no scores; it falls back to its existing ranking. Corrections attempted without the daemon now refuse with the reason and the remedy, rather than reporting a transient error that could never clear.
+**Fixed in V4.0.7.** Version numbers disagreed across the project — the pip requirement pins, npm lockfile, editor plugin manifest, citation metadata and lockfile all still named the previous release, so installing from `requirements.txt` fetched the wrong version; one script now sets all fifteen. Stale-memory checks reported "nothing is stale" when code linking was simply switched off, and pointed at a setting that did not exist. `slm gdpr` was missing from `slm help`. Consolidation, handed something that was neither a database handle nor a path, created a file named after the object instead of refusing it.
 
-**Carried forward from V4.0.5.** A correction is a review-gated lifecycle, not an in-place edit: SLM creates an immutable successor, keeps it out of current recall until an authenticated reviewer applies it, and preserves the predecessor for time-aware history. Every candidate path, including cached context, pins, bridge expansion, and scene expansion, uses hard current-truth admission and abstains if that truth cannot be read. `slm brain`, MCP, HTTP, and the Living Brain share one observation-only BrainTruth snapshot; feedback, external Bounded Loops evidence, and receipt claims are shown honestly but do not silently alter recall, ranking, or model routing. The optional Bounded Loops bridge remains capability-negotiated and independent.
-
-**Adaptive-ranking migration.** V4.0.6 leaves the optional adaptive ranker off
-unless an operator sets `SLM_RANKING` (`v1`, `v2`, or `v2-ensemble`). This does
-not disable the normal retrieval channels; it prevents feedback and
-observation data from changing ranking without an explicit operator decision.
+**Carried forward from V4.0.5 and V4.0.6.** A correction is a review-gated lifecycle, not an in-place edit: SLM creates an immutable successor, keeps it out of current recall until an authenticated reviewer applies it, and preserves the predecessor for time-aware history. Every candidate path — cached context, pins, bridge and scene expansion — uses hard current-truth admission and abstains if that truth cannot be read. `slm brain`, MCP, HTTP and the Living Brain share one observation-only BrainTruth snapshot; feedback, external Bounded Loops evidence and receipt claims are shown honestly but never silently alter recall, ranking or model routing. The Living Brain leads with how many questions your memory has answered rather than a raw event count, and says so plainly where nothing has been measured yet. The knowledge graph opens reliably, with a default of 50 nodes and its details panel reachable on narrow screens. The optional adaptive ranker stays off unless an operator sets `SLM_RANKING` (`v1`, `v2`, or `v2-ensemble`) — that gate prevents feedback and observation data from changing ranking without an explicit decision, and does not disable the normal retrieval channels.
 
 - **[SLM-Mesh](#slm-mesh-cross-session--cross-machine-coordination)** — authenticated cross-session and cross-machine peer coordination (messages, locks, shared state, inbox/outbox, optional discovery). Coordination only — not automatic replicated memory.
 - **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "4.0.6",
+  "version": "4.0.7",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "4.0.5"
+  "version": "4.0.7"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v4.0.5 -->
+<!-- BEGIN SuperLocalMemory v4.0.7 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v4.0.5 -->
+<!-- END SuperLocalMemory v4.0.7 -->
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==4.0.5
+superlocalmemory==4.0.7

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -312,4 +312,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -146,4 +146,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.0.5 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -129,4 +129,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v4.0.4 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.7 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "4.0.6"
+version = "4.0.7"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "4.0.6"
+__version__ = "4.0.7"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/commands.py

@@ -282,6 +282,12 @@ def _cmd_gdpr_dispatch(args: Namespace) -> None:
     cmd_gdpr(args)
 
 
+def _cmd_summary_dispatch(args: Namespace) -> None:
+    """V4.0.7: readable session/day/project summaries (issue #113)."""
+    from superlocalmemory.cli.summary_cmd import cmd_summary
+    cmd_summary(args)
+
+
 # ---- end SLM v3.6 Optimize dispatch functions ----
 
 
@@ -414,6 +420,7 @@ def dispatch(args: Namespace) -> None:
         "ops": _cmd_ops,
         # V4.0.6: GDPR subject-rights CLI (Art.15/17/20)
         "gdpr": _cmd_gdpr_dispatch,
+        "summary": _cmd_summary_dispatch,
     }
     handler = handlers.get(args.command)
     if handler:
@@ -2215,6 +2222,13 @@ _COMMAND_GROUPS: list[tuple[str, list[tuple[str, str]]]] = [
         ("forget", "Run the decay cycle (preview first)"),
         ("trace", "Recall with a per-channel score breakdown"),
         ("ingest", "Ingest external observations / documents"),
+        ("summary", "Readable summaries: session, day, or project"),
+    ]),
+    ("Privacy & compliance", [
+        # gdpr shipped in 4.0.6 but was never listed here, so `slm help` did not
+        # mention it at all. The drift test caught it; the omission is the thing
+        # that test exists to prevent.
+        ("gdpr", "Subject rights: status, export, erase, verify"),
     ]),
     ("Run SLM (daemon & dashboard)", [
         ("serve", "Start/stop the background daemon"),

package/src/superlocalmemory/cli/main.py

@@ -90,6 +90,9 @@ _NO_DAEMON_COMMANDS = {
     "serve", "restart",
     # V4.0.6: GDPR CLI accesses the DB directly; no daemon required.
     "gdpr",
+    # V4.0.7: summaries read memory.db directly and are extractive by default,
+    # so they need neither the daemon nor a language model.
+    "summary",
 }
 
 
@@ -968,6 +971,12 @@ def main() -> None:
         _sp.add_argument("--json", action="store_true",
                          help="Output structured JSON (agent-native)")
 
+    # V4.0.7: the readable summary layer from issue #113. The generators shipped
+    # in 4.0.6 with no caller; this is the surface that makes them reachable.
+    from superlocalmemory.cli.summary_cmd import register_summary_parser
+
+    register_summary_parser(sub)
+
     # Wave-3 / V4.0.6: GDPR subject-rights CLI (Art.15/17/20)
     gdpr_p = sub.add_parser(
         "gdpr",

package/src/superlocalmemory/cli/summary_cmd.py

@@ -0,0 +1,195 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory | https://qualixar.com
+
+"""``slm summary`` — the readable layer over your memories (issue #113).
+
+WHY THIS FILE EXISTS
+--------------------
+4.0.6 shipped the three generators in ``superlocalmemory/summaries/`` with no way
+to call them: no command, no MCP tool, no route. The changelog listed the feature
+as added, the issue reply said it had landed, and a user could do nothing with it.
+This is that missing surface.
+
+Three summaries, each bounded and traceable:
+
+  ``slm summary session <id>``   what one session covered
+  ``slm summary day [DATE]``     what a day's main topics were
+  ``slm summary project <path>`` what was worked on in a project
+
+Every result states its coverage. Session data in particular is sparse — roughly
+4% of facts carry a session id on a real store — so a session summary reports what
+fraction it could actually see rather than presenting a slice as the whole.
+
+No language model is required: the generators are extractive by default, so this
+works in Local Guardian mode with nothing installed.
+"""
+
+from __future__ import annotations
+
+import json
+from argparse import Namespace
+from datetime import date, timedelta
+from pathlib import Path
+from typing import Any
+
+from superlocalmemory.infra.data_root import state_path
+
+def _coverage_is_complete(coverage: str) -> bool:
+    """Whether *coverage* means "this really is the whole picture".
+
+    Deliberately inverted. My first version listed the values that needed a
+    caveat — ``("partial", "sparse", "none", "empty")`` — and three of those four
+    are not values this system emits. The real vocabulary is COVERAGE_FULL /
+    PARTIAL / INSUFFICIENT / NO_SESSION / UNAVAILABLE, so a session summary
+    reporting "no_session" printed no caveat at all: the one honesty feature
+    issue #113 asked for, silently inactive.
+
+    Testing for completeness instead means any value that is not FULL — including
+    one added later — gets the caveat. The failure mode becomes an unnecessary
+    warning rather than a missing one.
+    """
+    try:
+        from superlocalmemory.summaries.base import COVERAGE_FULL
+
+        return coverage == COVERAGE_FULL
+    except Exception:
+        return coverage == "full"
+
+
+def _db_path() -> Path:
+    return state_path("memory.db")
+
+
+def _active_profile() -> str:
+    """Resolve the active profile without a daemon and without side effects.
+
+    Reads the ``active`` pointer out of ``profiles.json`` directly.
+    ``ProfileManager`` would give the same answer, but its constructor calls
+    ``mkdir(parents=True)`` — creating directories is not something a read-only
+    summary command should do. ``core.profiles`` also has no module-level
+    accessor; ``get_active_profile`` there is a method on the manager, and the
+    module-level one lives in ``server/routes/helpers.py``, which the CLI must
+    not import.
+    """
+    try:
+        from superlocalmemory.core.profiles import DEFAULT_PROFILES_FILE
+
+        path = state_path(DEFAULT_PROFILES_FILE)
+        if path.exists():
+            raw = json.loads(path.read_text(encoding="utf-8"))
+            active = raw.get("active")
+            if isinstance(active, str) and active:
+                return active
+    except Exception:
+        pass
+    return "default"
+
+
+def _emit(result: Any, as_json: bool) -> None:
+    """Print a SummaryResult as JSON or as prose."""
+    if as_json:
+        print(json.dumps({
+            "kind": result.kind,
+            "profile_id": result.profile_id,
+            "content": result.content,
+            "source_fact_ids": result.source_fact_ids,
+            "coverage": result.coverage,
+            "generated_by": result.generated_by,
+            "metadata": result.metadata,
+        }, indent=2, default=str))
+        return
+
+    print()
+    print(result.content.rstrip() or "(nothing recorded)")
+    print()
+
+    # Coverage is not decoration. A summary built from a fraction of the data
+    # that presents itself as the whole is the failure mode issue #113 called
+    # out by name, so it is stated on every single result, not only bad ones.
+    n = len(result.source_fact_ids)
+    line = f"Built from {n} memor{'y' if n == 1 else 'ies'} · coverage: {result.coverage}"
+    if not _coverage_is_complete(result.coverage):
+        line += " — treat as a partial view, not a complete record"
+    print(line)
+    if result.generated_by:
+        print(f"Method: {result.generated_by}")
+    print("Use --json to see the exact memories this came from.")
+
+
+def cmd_summary(args: Namespace) -> None:
+    """Dispatch ``slm summary <subcommand>``."""
+    sub = getattr(args, "summary_command", None)
+    as_json = bool(getattr(args, "json", False))
+    profile = getattr(args, "profile", None) or _active_profile()
+    db = _db_path()
+
+    if not db.exists():
+        print(f"No memory database at {db}. Run `slm status` first.")
+        return
+
+    if sub == "session":
+        from superlocalmemory.summaries import generate_session_summary
+
+        _emit(generate_session_summary(db, args.session_id, profile), as_json)
+        return
+
+    if sub == "day":
+        from superlocalmemory.summaries import generate_daily_reflection
+
+        target = getattr(args, "date", None) or date.today().isoformat()
+        if target == "yesterday":
+            target = (date.today() - timedelta(days=1)).isoformat()
+        elif target == "today":
+            target = date.today().isoformat()
+        _emit(generate_daily_reflection(db, target, profile), as_json)
+        return
+
+    if sub == "project":
+        from superlocalmemory.summaries import generate_project_work_log
+
+        path = getattr(args, "path", None) or str(Path.cwd())
+        _emit(generate_project_work_log(db, path, profile), as_json)
+        return
+
+    print("Usage: slm summary {session <id> | day [DATE] | project [PATH]}")
+    print()
+    print("  slm summary day                 what you recorded today")
+    print("  slm summary day yesterday       ...or yesterday")
+    print("  slm summary day 2026-08-17      ...or a specific date")
+    print("  slm summary project             work log for the current directory")
+    print("  slm summary session <id>        what one session covered")
+    print()
+    print("Add --json to include the ids of the memories a summary came from.")
+
+
+def register_summary_parser(sub: Any) -> None:
+    """Attach the ``summary`` parser. Called from cli/main.py."""
+    p = sub.add_parser(
+        "summary",
+        help="Readable summaries of your memories (session, day, project)",
+    )
+    p.add_argument("--json", action="store_true", help="machine-readable output")
+    p.add_argument("--profile", help="profile to summarise (default: active)")
+    ssub = p.add_subparsers(dest="summary_command", title="summary subcommands")
+
+    s = ssub.add_parser("session", help="what one session covered")
+    s.add_argument("session_id", help="session id (see `slm status`)")
+    s.add_argument("--json", action="store_true")
+    s.add_argument("--profile")
+
+    d = ssub.add_parser("day", help="what a day's main topics were")
+    d.add_argument(
+        "date", nargs="?",
+        help="YYYY-MM-DD, 'today' or 'yesterday' (default: today)",
+    )
+    d.add_argument("--json", action="store_true")
+    d.add_argument("--profile")
+
+    pr = ssub.add_parser("project", help="what was worked on in a project")
+    pr.add_argument(
+        "path", nargs="?",
+        help="project directory (default: current directory)",
+    )
+    pr.add_argument("--json", action="store_true")
+    pr.add_argument("--profile")

package/src/superlocalmemory/code_graph/bridge/entity_resolver.py

@@ -152,9 +152,25 @@ class EntityResolver:
         self,
         fact_text: str,
         fact_id: str,
+        max_links: int | None = None,
     ) -> list[CodeMemoryLink]:
         """Resolve code entity mentions in fact text and create links.
 
+        Args:
+            fact_text: Text to scan for code mentions.
+            fact_id:   The fact these links belong to.
+            max_links: Keep at most this many links, highest confidence first.
+                ``None`` (the default) is unbounded, preserving the behaviour the
+                manual ``link_memory_to_code`` path relies on.
+
+                A bound matters for automatic resolution. One file-path mention
+                matches EVERY node in that file: the fact "the parser in
+                code_graph/parser.py was dropping edges" produced 17 links at
+                confidence 0.6-0.8, while a backticked function name produces one
+                at 0.95. Unbounded, a fact naming a few files buries its own
+                high-signal links and hands a large node set to HebbianLinker,
+                whose neighbourhood expansion then grows accordingly.
+
         Returns list of CodeMemoryLink objects created.
         """
         if not fact_text or not fact_id:
@@ -177,6 +193,16 @@ class EntityResolver:
         if not matches:
             return []
 
+        selected = list(matches.values())
+        if max_links is not None and len(selected) > max_links:
+            # Confidence ranks the match kinds correctly already — backticked and
+            # call-syntax mentions score 0.95, a bare identifier 0.9, file-path
+            # fan-out 0.6-0.8 — so ordering by it keeps the precise mentions and
+            # drops the broad ones.
+            selected.sort(key=lambda m: m.confidence, reverse=True)
+            selected = selected[:max_links]
+            matches = {m.node_id: m for m in selected}
+
         # Classify link type
         link_type = self._classify_link_type(fact_text)
         now_str = datetime.now(timezone.utc).isoformat()