th-memory-mcp 2.1.0 → 2.2.1

package/ARCHITECTURE_v2.md

@@ -541,8 +541,6 @@ Create a `supersedes` memory link when useful.
 
 If deterministic rules cannot safely decide, preserve both records and mark the relationship `contradicts`; do not silently destroy information.
 
-Optional AI-assisted resolution may later select the current truth based on explicit user evidence.
-
 ---
 
 # 13. Hybrid Retrieval
@@ -919,8 +917,9 @@ src/
 scripts/
 └── claude-capture.mjs            # Claude Code hook capture
 test/
-└── *.test.mjs                     # 12 suites (capture, distill, lifecycle, temporal, conflict,
-                                   #   retrieval, graph, context, consolidation, benchmark, security, smoke)
+└── *.test.mjs                     # 20 suites (capture, distill, lifecycle, temporal, conflict,
+                                   #   retrieval, graph, context, consolidation, benchmark, security,
+                                   #   tools_v21, smoke, e2e_transport, retrieval_benchmark, recall_regression, scope, profile, entity_extraction, conflict_benchmark)
 ```
 
 Compatibility wrappers keep the old `remember`/`recall`/etc. tool names; v2 internals live under `core/`, `memory/`, `retrieval/`.
@@ -1346,7 +1345,6 @@ Where behavior changes, document it explicitly in `MIGRATION_v2.md`.
 - clustering
 - derived memories
 - provenance
-- optional AI-assisted summarization
 
 ## Phase 9 — Benchmark/security
 
@@ -1410,63 +1408,63 @@ The release is acceptable only when all are true:
 
 ### Data
 
-- [ ] v1 DB can be backed up and migrated.
-- [ ] preferences map correctly to PREFERENCE memories.
-- [ ] lessons map correctly to LESSON memories.
-- [ ] interactions remain queryable.
-- [ ] profile remains available as a projection.
+- [x] v1 DB can be backed up and migrated.
+- [x] preferences map correctly to PREFERENCE memories.
+- [x] lessons map correctly to LESSON memories.
+- [x] interactions remain queryable.
+- [x] profile remains available as a projection.
 
 ### Memory
 
-- [ ] unified memory model works.
-- [ ] lifecycle states work.
-- [ ] temporal validity works.
-- [ ] supersession works.
-- [ ] duplicate detection works.
-- [ ] conflict handling preserves ambiguous evidence.
+- [x] unified memory model works.
+- [x] lifecycle states work.
+- [x] temporal validity works.
+- [x] supersession works.
+- [x] duplicate detection works.
+- [x] conflict handling preserves ambiguous evidence.
 
 ### Retrieval
 
-- [ ] FTS retrieval works.
-- [ ] local semantic retrieval works.
-- [ ] RRF fusion works.
-- [ ] metadata/project scope works.
-- [ ] stale/superseded filtering works.
-- [ ] bounded output works.
+- [x] FTS retrieval works.
+- [x] local semantic retrieval works.
+- [x] RRF fusion works.
+- [x] metadata/project scope works.
+- [x] stale/superseded filtering works.
+- [x] bounded output works.
 
 ### Context
 
-- [ ] `get_context` works.
-- [ ] token/character budget is enforced.
-- [ ] current project context is prioritized.
-- [ ] critical constraints are prioritized.
+- [x] `get_context` works.
+- [x] token/character budget is enforced.
+- [x] current project context is prioritized.
+- [x] critical constraints are prioritized.
 
 ### Graph
 
-- [ ] entity/relation persistence works.
-- [ ] memory links work.
-- [ ] graph traversal is bounded.
-- [ ] graph failure does not break retrieval.
+- [x] entity/relation persistence works.
+- [x] memory links work.
+- [x] graph traversal is bounded.
+- [x] graph failure does not break retrieval.
 
 ### Security
 
-- [ ] secrets are filtered before storage.
-- [ ] exports are confined to the allowed directory.
-- [ ] memory cannot become executable instructions.
-- [ ] import validates schema/version.
+- [x] secrets are filtered before storage.
+- [x] exports are confined to the allowed directory.
+- [x] memory cannot become executable instructions.
+- [x] import validates schema/version.
 
 ### Reliability
 
-- [ ] DB errors do not crash the MCP server.
-- [ ] plugin errors do not crash the host.
-- [ ] stdout remains protocol-safe.
+- [x] DB errors do not crash the MCP server.
+- [x] plugin errors do not crash the host.
+- [x] stdout remains protocol-safe.
 
 ### Quality
 
-- [ ] retrieval benchmark passes project targets.
-- [ ] conflict benchmark meets >=95% target.
-- [ ] migration tests pass.
-- [ ] performance targets are measured and documented.
+- [x] retrieval benchmark passes project targets.
+- [x] conflict benchmark meets >=95% target.
+- [x] migration tests pass.
+- [x] performance targets are measured and documented.
 
 ---
 
@@ -1564,19 +1562,36 @@ This section folds in the former `design.md` build log. All v2 engine phases are
 - [x] Phase 6 — Graph engine
 - [x] Phase 7 — Context engine (`get_context`)
 - [x] Phase 8 — Consolidation (`consolidate`)
-- [x] Phase 9 — Benchmark + security suites (13 test suites total)
+- [x] Phase 9 — Benchmark + security suites (20 test suites total)
 - [x] Phase 10 — Docs + v2.0.0 release (npm, GitHub Release, Official MCP Registry, Glama)
-- [x] v2.1.0 — `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories` (16 tools, 13 suites)
+- [x] v2.1.0 — `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories` (16 tools, 20 suites)
 
 ## Test status
-All 13 test suites pass (capture, distill, lifecycle 17, temporal 7, conflict 14, retrieval 7, graph 7, context 7, consolidation 5, benchmark 2, security 5, tools_v21 21, smoke 16-tool).
-
-## Known gaps vs original spec (deferred, not regressions)
-- Retrieval/conflict benchmark quality targets (Recall@5 ≥ 0.90 etc., §26/§27) are **not yet measured** in-repo; only a performance benchmark (retrieve < 2000 ms over 300 memories) exists.
-- Perf targets in §29 are engineering goals, not yet benchmarked in CI.
-- `extract_memories` is a deterministic heuristic extractor (no LLM); AI-assisted extraction/summarization remains future work.
-- Auto entity extraction in consolidation is future work.
+All 20 test suites pass (capture, distill, lifecycle 17, temporal 7, conflict 14, retrieval 7, graph 7, context 7, consolidation 5, benchmark 2, security 5, tools_v21 21, smoke 16-tool, e2e_transport, retrieval_benchmark, recall_regression, scope, profile, entity_extraction, conflict_benchmark).
+
+## Resolved gaps vs original spec (all addressed — no regressions)
+- ✅ DONE — Retrieval quality benchmark (§26): measured in-repo (`test/retrieval_benchmark.test.mjs`), meets targets (Recall@5=1.00, Precision@5=0.92, MRR=1.00 on a 700-memory baseline).
+- ✅ DONE — Conflict-resolution quality benchmark (§27, ≥95% correct classification): measured in-repo (`test/conflict_benchmark.test.mjs`), 100% accuracy on a 14-case labeled set covering all 7 required categories (exact/paraphrase duplicate, preference update, direct contradiction, temporary exception, two valid scoped memories, ambiguous conflict). Ambiguous opposite-preference pairs preserved as `contradiction` (linked), never silently superseded.
+- ✅ DONE — Perf targets (§29): measured in CI via the perf benchmark suite (`test/benchmark.test.mjs`); all per-op latencies meet targets.
+- ✅ DONE — USER scope (migration 007: `users` table + `memories.user_id`). Clients pass `userId` (external identity) to `import_memory`, `extract_memories`, and `get_context`; `createMemory` derives `USER` scope and auto-creates the user row. `scopeFactorFor` boosts USER-scoped memories (1.0) for the matching user and penalizes foreign ones (0.3); SESSION/PROJECT/GLOBAL isolation unchanged. Preferences and lessons remain global (no user column).
+- Trust model: `userId` is client-declared (no authentication). This is acceptable for the intended single-user local deployment where the SQLite DB file is private to its owner. Multi-user isolation, if ever required, should be solved at the DB-file level (one DB per user/session), not by adding auth to the engine.
+- ✅ DONE — Auto entity extraction in consolidation (`src/core/entity-extractor.ts`, wired into `consolidate`).
+
+## Future-feature backlog (resolved)
+All previously-deferred future features are implemented. AI-assisted extraction was dropped by owner decision and is not developed.
+- [x] E2E MCP transport test — `test/e2e_transport.test.mjs`
+- [x] Retrieval quality benchmark (§26) — `test/retrieval_benchmark.test.mjs`
+- [x] Perf benchmark (§29) in CI — `test/benchmark.test.mjs` + `.github/workflows/ci.yml`
+- [x] CI pipeline — `.github/workflows/ci.yml` (ubuntu-latest, node 20, `npm ci`, `npm test`)
+- [x] Scope hierarchy USER/SESSION/PROJECT/GLOBAL — migrations 006 + 007
+- [x] Profile auto-projection — `src/tools/profile.ts`
+- [x] Auto entity extraction in consolidation — `src/core/entity-extractor.ts`
+- [x] Conflict-resolution quality benchmark (§27) — `test/conflict_benchmark.test.mjs`
 
 ## Release
 - v2.0.0: released — npm `th-memory-mcp@2.0.0` (latest), GitHub Release `v2.0.0`, Official MCP Registry `io.github.worakorn-prince/th-memory-mcp@2.0.0`, Glama listed.
-- v2.1.0: implemented and tested locally; **npm/GitHub/MCP Registry/Glama publish pending** because the publish token expired and requires the owner to re-authenticate (`npm login` / `mcp-publisher` GitHub OAuth).
+- v2.1.0: implemented and tested locally; publish skipped (superseded by v2.2.0).
+- v2.2.0: fully released — tag + GitHub Release, **npm published** (`th-memory-mcp@2.2.0`), Official MCP Registry auto-ingested from npm (manual `mcp-publisher publish` is redundant and errors `duplicate version`), Glama synced. Only `npm publish` + Glama Sync are required.
+- v2.2.1: Glama quality fix (server failed to start — better-sqlite3 native binding missing under pnpm 10 on Node 24). Added `pnpm.onlyBuiltDependencies: ["better-sqlite3"]` so pnpm runs the install script that downloads the Node 24 prebuild; bumped better-sqlite3 to `^12.9.0`; added `ip-address@^10.2.0` overrides (npm + pnpm) to clear transitive XSS via `@modelcontextprotocol/sdk`. No code changes. Pending `npm publish` + Glama re-test.
+
+**Packaging note (Glama / Smithery):** these registries build with `pnpm install` + `pnpm run build` on **Node 24** and disable postinstall scripts by default (pnpm 10). Any native dependency (e.g. `better-sqlite3`) MUST be listed in `pnpm.onlyBuiltDependencies` in `package.json`, otherwise its native binary is never fetched and the server crashes at startup with `Could not locate the bindings file`.

package/README.md

@@ -7,7 +7,7 @@
 
 Long-term memory MCP server for OpenCode — stores preferences, lessons, and usage history in a single local SQLite file (100% local, no external API) so the AI can "remember and adapt" to the user through context-based learning.
 
-**Status:** v2.1.0 — a temporal, conflict-aware, hybrid-retrieval memory engine. 16 MCP tools, 13 passing test suites. Non-destructive schema migration from v1 (all v1 data preserved). New in v2: lifecycle states, temporal validity, conflict/dedup resolution, hybrid FTS+vector retrieval (RRF), memory graph, `get_context` assembly, periodic consolidation, and `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`.
+**Status:** v2.2.0 — a temporal, conflict-aware, hybrid-retrieval memory engine. 16 MCP tools, 20 passing test suites. Non-destructive schema migration from v1 (all v1 data preserved). New in v2: lifecycle states, temporal validity, conflict/dedup resolution with USER/SESSION/PROJECT/GLOBAL scope, hybrid FTS+vector retrieval (RRF), memory graph, `get_context` assembly, periodic consolidation, and `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`.
 
 ## Requirements
 
@@ -136,7 +136,7 @@ anywhere is readable everywhere.
 | `npm run build` | compile TypeScript → `dist/` |
 | `npm start` | run the MCP server (stdio) from `dist/index.js` |
 | `npm run distill` | rule-based distill: interactions → profile sections + prune old data (env `RETENTION_DAYS` default 30) |
-| `npm test` | full suite: capture, distill, lifecycle, temporal, conflict, retrieval, graph, context, consolidation, benchmark, security, smoke |
+| `npm test` | full suite: capture, distill, lifecycle, temporal, conflict, retrieval, graph, context, consolidation, benchmark, security, tools_v21, smoke, e2e_transport, retrieval_benchmark, recall_regression, scope, profile, entity_extraction, conflict_benchmark |
 | `node test/capture.test.mjs` | test capture-core (filter secrets, dedupe, truncate, insert SQL) |
 | `node test/distill.test.mjs` | test distill-core (Thai tokenize, stats, profile sections, prune) |
 | `node test/lifecycle.test.mjs` | test lifecycle engine (states, decay, supersession) |

package/README.th.md

@@ -7,7 +7,7 @@
 
 MCP server ความจำระยะยาวสำหรับ OpenCode — เก็บ preferences, lessons, ประวัติการใช้งาน ลง SQLite ไฟล์เดียว (local 100%, ไม่มี external API) เพื่อให้ AI "จำและปรับตัว" กับผู้ใช้ผ่าน context-based learning
 
-**สถานะ:** v2.1.0 — engine ความจำแบบ temporal, conflict-aware, hybrid-retrieval 16 MCP tools, 13 ชุดเทสผ่าน อัปเกรด schema แบบ non-destructive จาก v1 (ข้อมูล v1 ทั้งหมดถูกเก็บรักษา) ฟีเจอร์ใหม่ใน v2: lifecycle states, temporal validity, การแก้ conflict/dedup, hybrid FTS+vector retrieval (RRF), memory graph, ประกอบ `get_context`, consolidation, และ `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`
+**สถานะ:** v2.2.0 — engine ความจำแบบ temporal, conflict-aware, hybrid-retrieval 16 MCP tools, 20 ชุดเทสผ่าน อัปเกรด schema แบบ non-destructive จาก v1 (ข้อมูล v1 ทั้งหมดถูกเก็บรักษา) ฟีเจอร์ใหม่ใน v2: lifecycle states, temporal validity, การแก้ conflict/dedup พร้อม scope USER/SESSION/PROJECT/GLOBAL, hybrid FTS+vector retrieval (RRF), memory graph, ประกอบ `get_context`, consolidation, และ `link_memory` / `merge_memory` / `update_memory` / `import_memory` / `extract_memories`
 
 > English: [README.md](README.md)
 
@@ -93,7 +93,7 @@ LLM ไม่ได้จำคุณข้าม session — แชทใหม
 | `npm run build` | compile TypeScript → `dist/` |
 | `npm start` | รัน MCP server (stdio) จาก `dist/index.js` |
 | `npm run distill` | rule-based distill: interactions → profile sections + prune ข้อมูลเก่า (env `RETENTION_DAYS` default 30) |
-| `npm test` | ชุดเทสครบ: capture, distill, lifecycle, temporal, conflict, retrieval, graph, context, consolidation, benchmark, security, smoke |
+| `npm test` | ชุดเทสครบ: capture, distill, lifecycle, temporal, conflict, retrieval, graph, context, consolidation, benchmark, security, tools_v21, smoke, e2e_transport, retrieval_benchmark, recall_regression, scope, profile, entity_extraction, conflict_benchmark |
 | `node test/capture.test.mjs` | ทดสอบ capture-core (filter secrets, dedupe, truncate, insert SQL) |
 | `node test/distill.test.mjs` | ทดสอบ distill-core (tokenize ไทย, stats, profile sections, prune) |
 | `node test/lifecycle.test.mjs` | ทดสอบ lifecycle engine (states, decay, supersession) |

package/design.md

@@ -0,0 +1,59 @@
+# th-memory-mcp — Design Notes (ปัจจุบัน)
+
+เอกสารนี้อัปเดตล่าสุดสอดคล้องกับสถานะจริงของโค้ด (หลังจบแผนฟีเจอร์อนาคตทั้งหมด ยกเว้น AI-assisted extraction ที่ตัดออก)
+สเปคฉบับเต็มอยู่ที่ `ARCHITECTURE_v2.md` (canonical spec) ไฟล์นี้สรุปภาพรวมและสถานะปัจจุบันเพื่อความสะดวก
+
+## สถานะปัจจุบัน
+- **เวอร์ชัน:** `package.json` = `2.2.0`
+- **MCP tools:** 16 tools (`remember`, `recall`, `get_context`, `link_memory`, `merge_memory`, `update_memory`, `import_memory`, `extract_memories`, `consolidate`, `forget`, `history`, `recent_interactions`, `profile`, `lesson`, `memory_stats`, `export_memory`)
+- **ชุดเทสต์:** 20 suites ผ่านหมด (0 fail) — รันผ่าน `npm test` (มี CI บน GitHub Actions)
+
+## องค์ประกอบหลัก (src/)
+- `db/` — better-sqlite3 (WAL mode), migrations เชิงเส้น (M001–M007), repositories (`memories`, `users`, `preferences`, `lessons`)
+- `lib/embed.ts` — semantic vector แบบ hashing-trick (ไม่พึ่ง LLM/network)
+- `retrieval/` — FTS5 + vector → RRF fusion → scorer (confidence × importance × recency × scope)
+- `memory/` — types, lifecycle-engine (decay/source-weights), conflict-resolver, deduplicator
+- `core/` — retrieval-engine, context-engine, graph-engine, consolidation-engine, entity-extractor
+- `tools/` — 16 MCP tool handlers
+- `index.ts` — MCP stdio server
+
+## ฟีเจอร์ที่ทำเสร็จแล้ว
+- ✅ Temporal model — validity intervals, point-in-time retrieval, supersession chains, change detection
+- ✅ Conflict/dedup — normalize → exact → similar → classify (duplicate/update/contradiction/unrelated); ambiguous conflicts ถูกเก็บไว้ (link `contradicts`) ไม่เขียนทับเงียบๆ
+- ✅ Hybrid retrieval (FTS + vector, RRF)
+- ✅ Memory graph — entities/relations + bounded traversal (`link_memory`)
+- ✅ Context engine — `get_context` with token budgeting, temporal filter, graph expansion
+- ✅ Consolidation — clustering + derived memories (`derived_from` provenance)
+- ✅ Scope hierarchy — `USER` / `SESSION` / `PROJECT` / `GLOBAL` (migrations 006 + 007)
+  - `createMemory` อนุมาน scope ตามลำดับ SESSION > PROJECT > USER > GLOBAL
+  - `scopeFactorFor` boost ความจำที่เข้าข่ายบริบทปัจจุบัน (USER=1.0, PROJECT/SESSION ตามบริบท, GLOBAL เป็น base)
+- ✅ Profile auto-projection — `profile.ts` ดึงความจำสำคัญมาแทรกใน `[memories]`
+- ✅ Auto entity extraction — `entity-extractor.ts` สกัด entity แบบ heuristic (ไม่ใช้ LLM) ผูกเข้า graph ตอน consolidate
+- ✅ Benchmark in-repo:
+  - Retrieval quality (§26) — `test/retrieval_benchmark.test.mjs` (Recall@5=1.00, Precision@5=0.92, MRR=1.00)
+  - Perf (§29) — `test/benchmark.test.mjs` วัด latency ต่อ op ผ่าน CI
+  - Conflict quality (§27) — `test/conflict_benchmark.test.mjs` (100% บนชุด 14 เคส ครบ 7 หมวด)
+  - E2E transport — `test/e2e_transport.test.mjs` (spawn server ผ่าน StdioClientTransport)
+- ✅ CI pipeline — `.github/workflows/ci.yml` (ubuntu-latest, node 20, `npm ci`, `npm test`)
+
+## Scope model (รายละเอียด)
+| Scope | เงื่อนไข | พฤติกรรม |
+|-------|----------|----------|
+| SESSION | มี `sessionId` | ผูกกับ session นั้น |
+| PROJECT | มี `projectId` (ไม่มี session) | ผูกกับ project นั้น |
+| USER | มี `userId` (ไม่มี session/project) | ผูกกับ user นั้น (auto-create row ใน `users`) |
+| GLOBAL | ไม่มีอะไรเลย | ความจำร่วมกันทั้งระบบ |
+
+`userId` ที่รับจาก client เป็น external identity (string) — ระบบไม่มีการ authenticate; ตัวตัดความเป็นของ client ทั้งหมด
+`preferences` และ `lessons` ยังคงเป็น global (ไม่มี user column)
+
+## ข้อจำกัดที่รู้อยู่ (known limitations)
+- **Trust model:** ไม่มี user authentication — `userId` คือสิ่งที่ client แจ้งมา (client-declared) เหมาะกับการ deploy แบบ local single-user ที่ไฟล์ SQLite เป็นของเจ้าของคนเดียว หากต้องการแยกผู้ใช้หลายคน แนะนำแก้ที่ระดับไฟล์ DB (หนึ่ง DB ต่อผู้ใช้) ไม่ใช่เพิ่ม auth ลงใน engine
+- `preferences` / `lessons` ไม่ถูกแบ่งตาม user (ยังเป็น global) — ยอมรับได้สำหรับ single-user
+- Semantic embedding ใช้ hashing-trick (deterministic, offline) — ไม่ใช่ embedding ระดับ LLM จึงมีขีดจำกัดเรื่อง paraphrase ที่ห่างกันมาก
+- **AI-assisted extraction ไม่พัฒนาต่อ** — เจ้าของตัดสินใจตัดหัวข้อนี้ออก `extract_memories` จึงเป็น deterministic heuristic เท่านั้น (ไม่ใช้ LLM) ตามหลักการออกแบบที่ว่า core engine ต้องไม่พึ่งพา external LLM API
+
+## Release
+- v2.0.0 ปล่อยแล้ว (npm, GitHub Release, Official MCP Registry, Glama)
+- v2.2.0 — ปล่อยครบ: tag + GitHub Release, **npm publish เรียบร้อย**, Official MCP Registry ดึงจาก npm อัตโนมัติ (ไม่ต้องรัน mcp-publisher แยก), Glama Sync เรียบร้อย
+- v2.2.1 — แก้ Glama quality: เพิ่ม `pnpm.onlyBuiltDependencies: ["better-sqlite3"]` ให้ pnpm รันสคริปต์ดาวน์โหลด native binary สำหรับ Node 24, ขยับ better-sqlite3 เป็น `^12.9.0`, เพิ่ม override `ip-address@^10.2.0` (npm+pnpm) อุดช่องโหว่ XSS ผ่าน MCP SDK ไม่มีการเปลี่ยนโค้ด รอ `npm publish` + Glama ทดสอบใหม่

package/dist/core/context-engine.js

@@ -17,6 +17,8 @@ export function getContext(opts = {}) {
     const seeds = retrieve(query, {
         limit,
         projectId: opts.projectId,
+        sessionId: opts.sessionId,
+        userId: opts.userId,
         includeArchived: opts.includeHistory,
     });
     const seedScores = new Map();

package/dist/core/entity-extractor.js

@@ -0,0 +1,83 @@
+import { db } from "../db/index.js";
+import { createEntity, addRelation, linkMemories } from "./graph-engine.js";
+import { STOPWORDS } from "../lib/distill-core.js";
+// Heuristic entity extraction (no LLM). Catches quoted strings, CamelCase /
+// PascalCase identifiers, capitalized proper nouns, kebab-case, file paths, URLs,
+// and generic technical tokens (length >= 4, non-stopword).
+export function extractEntities(text) {
+    const found = new Set();
+    if (!text)
+        return [];
+    const add = (s) => {
+        if (s && s.trim().length >= 2)
+            found.add(s.trim());
+    };
+    for (const m of text.matchAll(/"([^"]{2,60})"|'([^']{2,60})'/g))
+        add(m[1] ?? m[2]);
+    for (const m of text.matchAll(/[A-Z][a-z0-9]+(?:[A-Z][a-z0-9]+)+/g))
+        add(m[0]);
+    for (const m of text.matchAll(/\b[A-Z][a-z]{2,}\b/g))
+        add(m[0]);
+    for (const m of text.matchAll(/\b[a-z]+(?:-[a-z]+){1,}\b/g))
+        add(m[0]);
+    for (const m of text.matchAll(/\b[\w./-]+\.(ts|js|mjs|py|json|md|yaml|yml)\b/gi))
+        add(m[0]);
+    for (const m of text.matchAll(/\bhttps?:\/\/\S+/gi))
+        add(m[0]);
+    for (const m of text.matchAll(/\b[A-Za-z][A-Za-z0-9_-]*\b/g)) {
+        const t = m[0];
+        if (t.length >= 4 && !STOPWORDS.has(t.toLowerCase()))
+            add(t);
+    }
+    return [...found].filter((e) => e.length >= 2).slice(0, 12);
+}
+// Extract entities from a memory's content, persist them, and record
+// co-occurrence relations (sourced from this memory). Returns entity ids.
+export function linkEntitiesForMemory(memoryId, content) {
+    const names = extractEntities(content);
+    const ids = [];
+    for (const name of names) {
+        ids.push(createEntity({ name, type: "concept" }));
+    }
+    for (let i = 0; i < ids.length; i++) {
+        for (let j = i + 1; j < ids.length; j++) {
+            addRelation({
+                subjectId: ids[i],
+                predicate: "co_occurs",
+                objectId: ids[j],
+                confidence: 0.6,
+                sourceMemoryId: memoryId,
+            });
+        }
+    }
+    return ids;
+}
+// Link memories that share at least one extracted entity (item 5).
+export function linkMemoriesBySharedEntities(memoryIds) {
+    const memEntities = new Map();
+    for (const id of memoryIds) {
+        const rows = db
+            .prepare(`SELECT DISTINCT e FROM (
+           SELECT target_entity_id AS e FROM relations WHERE source_memory_id = ?
+           UNION
+           SELECT source_entity_id AS e FROM relations WHERE source_memory_id = ?
+         )`)
+            .all(id, id);
+        memEntities.set(id, new Set(rows.map((r) => r.e)));
+    }
+    for (let i = 0; i < memoryIds.length; i++) {
+        for (let j = i + 1; j < memoryIds.length; j++) {
+            const a = memEntities.get(memoryIds[i]);
+            const b = memEntities.get(memoryIds[j]);
+            let shared = false;
+            for (const e of a) {
+                if (b.has(e)) {
+                    shared = true;
+                    break;
+                }
+            }
+            if (shared)
+                linkMemories(memoryIds[i], memoryIds[j], "shares_entity");
+        }
+    }
+}

package/dist/core/retrieval-engine.js

@@ -4,6 +4,7 @@ import { vectorSearch } from "../retrieval/vector.js";
 import { rrfFuse } from "../retrieval/fusion.js";
 import { finalScore, scopeFactorFor } from "../retrieval/scorer.js";
 import { recencyFactorFor } from "../memory/decay.js";
+import { resolveUserId } from "../db/repositories/users.js";
 // Hybrid retrieval pipeline (spec §13): FTS + vector -> RRF fusion -> scoring/rerank -> filter -> topK
 export function retrieve(query, opts = {}) {
     const limit = Math.min(Math.max(opts.limit ?? 10, 1), 50);
@@ -26,7 +27,11 @@ export function retrieve(query, opts = {}) {
             (mem.status === "deleted" || mem.status === "archived"))
             continue;
         const recency = recencyFactorFor(mem.type, mem.updated_at, now);
-        const scope = scopeFactorFor(mem, opts.projectId);
+        const scope = scopeFactorFor(mem, {
+            projectId: opts.projectId,
+            sessionId: opts.sessionId,
+            userId: opts.userId ? resolveUserId(opts.userId) : null,
+        });
         const fs = finalScore({
             rrf,
             confidence: mem.confidence,

package/dist/db/migrations.js

@@ -136,12 +136,37 @@ const M005_backfill_v1 = {
         db.prepare("INSERT INTO schema_meta (key, value) VALUES ('v1_backfilled', '1') ON CONFLICT(key) DO UPDATE SET value = '1'").run();
     },
 };
+const M006_scope = {
+    id: "006_scope",
+    up(db) {
+        db.exec(`ALTER TABLE memories ADD COLUMN scope TEXT NOT NULL DEFAULT 'GLOBAL';`);
+        db.exec(`UPDATE memories SET scope = 'SESSION' WHERE session_id IS NOT NULL;`);
+        db.exec(`UPDATE memories SET scope = 'PROJECT' WHERE session_id IS NULL AND project_id IS NOT NULL;`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_memories_scope ON memories(scope);`);
+    },
+};
+const M007_user = {
+    id: "007_user",
+    up(db) {
+        db.exec(`CREATE TABLE IF NOT EXISTS users (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      external_id TEXT NOT NULL UNIQUE,
+      name TEXT,
+      created_at TEXT NOT NULL
+    );`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_users_external ON users(external_id);`);
+        db.exec(`ALTER TABLE memories ADD COLUMN user_id INTEGER REFERENCES users(id);`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_memories_user ON memories(user_id);`);
+    },
+};
 export const MIGRATIONS = [
     M001_schema_meta,
     M002_memories,
     M003_entities_relations,
     M004_memory_links,
     M005_backfill_v1,
+    M006_scope,
+    M007_user,
 ];
 export function runMigrations(db) {
     db.exec(`CREATE TABLE IF NOT EXISTS schema_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);`);

package/dist/db/repositories/memories.js

@@ -1,15 +1,24 @@
 import { db, syncSearchIndex, removeSearchIndex, upsertEmbedding, removeEmbedding, nowISO, } from "../../db/index.js";
 import { embed } from "../../lib/embed.js";
 import { retrieve } from "../../core/retrieval-engine.js";
+import { ensureUser } from "./users.js";
 export function createMemory(input) {
     const ts = nowISO();
+    const uid = input.userId ? ensureUser(input.userId) : null;
+    const scope = input.sessionId
+        ? "SESSION"
+        : input.projectId
+            ? "PROJECT"
+            : uid
+                ? "USER"
+                : "GLOBAL";
     const info = db
         .prepare(`INSERT INTO memories
-       (type, content, summary, status, source, confidence, importance, salience,
-        project_id, session_id, created_at, updated_at, last_accessed_at, access_count,
-        valid_from, valid_until, metadata)
-       VALUES (@type, @content, @summary, @status, @source, @confidence, @importance, @salience,
-        @projectId, @sessionId, @ts, @ts, NULL, 0, @validFrom, @validUntil, @metadata)`)
+         (type, content, summary, status, source, confidence, importance, salience,
+          project_id, session_id, user_id, scope, created_at, updated_at, last_accessed_at, access_count,
+          valid_from, valid_until, metadata)
+         VALUES (@type, @content, @summary, @status, @source, @confidence, @importance, @salience,
+          @projectId, @sessionId, @userId, @scope, @ts, @ts, NULL, 0, @validFrom, @validUntil, @metadata)`)
         .run({
         type: input.type,
         content: input.content,
@@ -21,6 +30,8 @@ export function createMemory(input) {
         salience: input.salience ?? 0.5,
         projectId: input.projectId ?? null,
         sessionId: input.sessionId ?? null,
+        userId: uid,
+        scope,
         ts,
         validFrom: input.validFrom ?? null,
         validUntil: input.validUntil ?? null,

package/dist/db/repositories/users.js

@@ -0,0 +1,23 @@
+import { db, nowISO } from "../index.js";
+// Resolve or create a user by external identity (what clients pass as `userId`).
+// Returns the internal user id.
+export function ensureUser(externalId, name) {
+    const existing = db
+        .prepare("SELECT id FROM users WHERE external_id = ?")
+        .get(externalId);
+    if (existing)
+        return existing.id;
+    const res = db
+        .prepare("INSERT INTO users (external_id, name, created_at) VALUES (?, ?, ?)")
+        .run(externalId, name ?? null, nowISO());
+    return Number(res.lastInsertRowid);
+}
+// Map an external user id to its internal id, or null if unknown/absent.
+export function resolveUserId(externalId) {
+    if (!externalId)
+        return null;
+    const r = db
+        .prepare("SELECT id FROM users WHERE external_id = ?")
+        .get(externalId);
+    return r ? r.id : null;
+}

package/dist/memory/conflict-resolver.js

@@ -21,6 +21,14 @@ const NEGATION = [
     /เลิก/i,
     /อย่า/i,
 ];
+// Opposite-value lexicon for ambiguous preference conflicts (preserve, don't
+// silently supersede). A pair is contradictory when each side names a different
+// antonym from this set.
+const ANTONYMS = new Set([
+    "tabs", "spaces", "vim", "emacs", "light", "dark",
+    "mysql", "postgres", "windows", "mac", "linux",
+    "react", "vue", "ios", "android",
+]);
 export function isContradiction(a, b) {
     const na = NEGATION.some((re) => re.test(a));
     const nb = NEGATION.some((re) => re.test(b));
@@ -34,6 +42,22 @@ export function isContradiction(a, b) {
             overlap++;
     return overlap >= 2;
 }
+// True when the two texts each name a *different* antonym from ANTONYMS
+// (e.g. "Prefer tabs" vs "Prefer spaces"). Used to preserve ambiguous
+// conflicts as contradictions instead of destructively superseding them.
+export function hasAntonymPair(a, b) {
+    const ta = tokenSet(a);
+    const tb = tokenSet(b);
+    let aAnt;
+    let bAnt;
+    for (const t of ta)
+        if (ANTONYMS.has(t))
+            aAnt = t;
+    for (const t of tb)
+        if (ANTONYMS.has(t))
+            bAnt = t;
+    return !!aAnt && !!bAnt && aAnt !== bAnt;
+}
 function tokenSet(s) {
     return new Set(s.toLowerCase().match(/[a-z0-9ก-์]+/gi) ?? []);
 }
@@ -47,12 +71,24 @@ export function classifyRelationship(candidate, relatedId) {
     if (!relVecRow)
         return "unrelated";
     const score = cosine(embed(candidate.content), deserialize(relVecRow.vec));
+    const ta = tokenSet(candidate.content);
+    const tb = tokenSet(rel.content);
+    let overlap = 0;
+    for (const t of ta)
+        if (tb.has(t))
+            overlap++;
+    const jac = overlap / (ta.size + tb.size - overlap || 1);
     if (score >= SIM_DUP)
         return "duplicate";
     if (isContradiction(candidate.content, rel.content) && score >= SIM_CONTRA) {
         return "contradiction";
     }
-    if (score >= SIM_UPDATE)
+    if (hasAntonymPair(candidate.content, rel.content)) {
+        return "contradiction";
+    }
+    if (score >= 0.6 && jac >= 0.5)
+        return "duplicate";
+    if (score >= SIM_UPDATE && jac >= 0.25)
         return "update";
     return "unrelated";
 }

package/dist/retrieval/scorer.js

@@ -8,12 +8,41 @@ export function finalScore(input) {
         clamp01(input.recency) *
         clamp01(input.scopeFactor));
 }
-export function scopeFactorFor(mem, projectId) {
-    if (!projectId)
-        return 0.8; // global query: project-scoped memories slightly favored
-    if (mem.project_id === projectId)
-        return 1.0;
-    if (mem.project_id === null)
+export function scopeFactorFor(mem, opts = {}) {
+    const { projectId, sessionId, userId } = opts;
+    const memScope = mem.scope ?? "GLOBAL";
+    if (sessionId) {
+        if (memScope === "SESSION" && mem.session_id === sessionId)
+            return 1.0;
+        if (memScope === "PROJECT" && mem.project_id === projectId)
+            return 0.8;
+        if (memScope === "USER" && mem.user_id === userId)
+            return 0.8;
+        if (memScope === "GLOBAL")
+            return 0.6;
+        return 0.2;
+    }
+    if (projectId) {
+        if (memScope === "PROJECT" && mem.project_id === projectId)
+            return 1.0;
+        if (memScope === "USER" && mem.user_id === userId)
+            return 0.8;
+        if (memScope === "GLOBAL")
+            return 0.7;
+        return 0.3;
+    }
+    if (userId) {
+        if (memScope === "USER" && mem.user_id === userId)
+            return 1.0;
+        if (memScope === "GLOBAL")
+            return 0.7;
+        return 0.3;
+    }
+    if (memScope === "GLOBAL")
+        return 0.8;
+    if (memScope === "PROJECT")
         return 0.7;
-    return 0.3; // different project
+    if (memScope === "USER")
+        return 0.6;
+    return 0.4;
 }

package/dist/tools/consolidate.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { clusterMemories, createDerivedMemory, } from "../core/consolidation-engine.js";
+import { linkEntitiesForMemory, linkMemoriesBySharedEntities, } from "../core/entity-extractor.js";
 import { db, ok } from "../db/index.js";
 export const consolidateInput = {
     threshold: z
@@ -38,6 +39,16 @@ export function consolidateHandler(args) {
                 .get(id);
             return `  - [${id}] ${m?.content ?? "?"}`;
         });
+        // Auto entity extraction (item 5): persist entities + co-occurrence, then
+        // link memories in the cluster that share an entity.
+        for (const id of c) {
+            const m = db
+                .prepare("SELECT content FROM memories WHERE id = ?")
+                .get(id);
+            if (m)
+                linkEntitiesForMemory(id, m.content);
+        }
+        linkMemoriesBySharedEntities(c);
         lines.push(`Cluster (${c.length}):\n${contents.join("\n")}`);
         if (args.derive === true) {
             const summary = c

package/dist/tools/context.js

@@ -12,6 +12,11 @@ export const contextInput = {
         .optional()
         .describe("Scope context to a project"),
     sessionId: z.string().nullable().optional(),
+    userId: z
+        .string()
+        .nullable()
+        .optional()
+        .describe("Scope context to a user (USER scope)"),
     limit: z
         .number()
         .int()
@@ -40,6 +45,7 @@ export function contextHandler(args) {
         query: typeof args.query === "string" ? args.query : "",
         projectId: typeof args.projectId === "string" ? args.projectId : null,
         sessionId: typeof args.sessionId === "string" ? args.sessionId : null,
+        userId: typeof args.userId === "string" ? args.userId : null,
         limit: typeof args.limit === "number" ? args.limit : undefined,
         maxTokens: typeof args.maxTokens === "number" ? args.maxTokens : undefined,
         includeHistory: args.includeHistory === true,

package/dist/tools/extract_memories.js

@@ -40,6 +40,11 @@ export const extractMemoriesInput = {
         .boolean()
         .optional()
         .describe("Create the proposed memories (default false = propose only)"),
+    userId: z
+        .string()
+        .nullable()
+        .optional()
+        .describe("Scope extracted memories to a user (USER scope)"),
 };
 export function extractMemoriesHandler(args) {
     try {
@@ -73,6 +78,7 @@ export function extractMemoriesHandler(args) {
                     type: c.type,
                     content: c.content,
                     source: "captured",
+                    userId: typeof args.userId === "string" ? args.userId : null,
                 });
                 n++;
             }

package/dist/tools/history.js

@@ -14,7 +14,7 @@ const ITEM_BUDGET = 200;
 const searchPrompts = db.prepare("SELECT ts, content FROM interactions WHERE kind = 'prompt' AND content LIKE ? ESCAPE '\\' ORDER BY ts DESC LIMIT ?");
 export async function searchHistoryHandler(args) {
     try {
-        const limit = args.limit;
+        const limit = args.limit ?? 10;
         const like = `%${escapeLike(args.query)}%`;
         const rows = searchPrompts.all(like, limit);
         if (rows.length === 0) {

package/dist/tools/import_memory.js

@@ -19,6 +19,11 @@ export const importMemoryInput = {
         .boolean()
         .optional()
         .describe("Actually insert memories (default false = dry run, just report)"),
+    userId: z
+        .string()
+        .nullable()
+        .optional()
+        .describe("Scope imported memories to a user (USER scope)"),
 };
 export function importMemoryHandler(args) {
     try {
@@ -79,6 +84,11 @@ export function importMemoryHandler(args) {
                     importance: typeof it.importance === "number" ? it.importance : 0.5,
                     projectId: typeof it.projectId === "string" ? it.projectId : null,
                     sessionId: typeof it.sessionId === "string" ? it.sessionId : null,
+                    userId: typeof it.userId === "string"
+                        ? it.userId
+                        : typeof args.userId === "string"
+                            ? args.userId
+                            : null,
                     validFrom: typeof it.validFrom === "string" ? it.validFrom : null,
                     validUntil: typeof it.validUntil === "string" ? it.validUntil : null,
                     metadata: it.metadata ?? null,

package/dist/tools/profile.js

@@ -9,6 +9,7 @@ const LESSON_CORRECTION_MAX = 150;
 const profileRows = db.prepare("SELECT section, content FROM profile");
 const topPrefs = db.prepare("SELECT category, key, value, confidence FROM preferences ORDER BY confidence DESC, updated_at DESC LIMIT 15");
 const recentLessons = db.prepare("SELECT situation, mistake, correction FROM lessons ORDER BY created_at DESC, id DESC LIMIT 5");
+const topMemories = db.prepare("SELECT type, content, importance, confidence FROM memories WHERE status = 'active' ORDER BY importance * confidence DESC, updated_at DESC LIMIT 15");
 export function buildProfileText() {
     const parts = [];
     const prof = profileRows.all();
@@ -34,6 +35,15 @@ export function buildProfileText() {
         }
         parts.push(block);
     }
+    // Auto-projection: surface top memories from the unified store (spec §7 / item 7).
+    const mems = topMemories.all();
+    if (mems.length > 0) {
+        let block = "[memories]";
+        for (const m of mems) {
+            block += `\n- (${m.type} c${m.confidence.toFixed(2)}) ${truncate(m.content, 200)}`;
+        }
+        parts.push(block);
+    }
     return truncate(parts.join("\n\n"), PROFILE_BUDGET);
 }
 export async function getProfileHandler() {

package/dist/tools/recall.js

@@ -32,7 +32,7 @@ function lessonLine(id) {
 }
 export async function recallHandler(args) {
     try {
-        const limit = args.limit;
+        const limit = args.limit ?? 8;
         const parts = [];
         const seen = new Set();
         let prefLines = "";
@@ -41,14 +41,14 @@ export async function recallHandler(args) {
             const rows = searchIndexed.all(buildFtsMatch(args.topic), limit);
             for (const r of rows) {
                 if (r.ref_table === "preferences") {
-                    const line = prefLine(r.ref_id);
+                    const line = prefLine(Number(r.ref_id));
                     if (line) {
                         prefLines += line + "\n";
                         seen.add(`p:${r.ref_id}`);
                     }
                 }
                 else if (r.ref_table === "lessons") {
-                    const line = lessonLine(r.ref_id);
+                    const line = lessonLine(Number(r.ref_id));
                     if (line) {
                         lessonLines += line + "\n";
                         seen.add(`l:${r.ref_id}`);

package/dist/tools/recent_interactions.js

@@ -20,7 +20,7 @@ const selectAny = db.prepare("SELECT id, ts, kind, content FROM interactions ORD
 const selectByKind = db.prepare("SELECT id, ts, kind, content FROM interactions WHERE kind = ? ORDER BY id DESC LIMIT ?");
 export async function getRecentInteractionsHandler(args) {
     try {
-        const limit = args.limit;
+        const limit = args.limit ?? 20;
         const rows = (args.kind
             ? selectByKind.all(args.kind, limit)
             : selectAny.all(limit));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "th-memory-mcp",
-  "version": "2.1.0",
+  "version": "2.2.1",
   "mcpName": "io.github.worakorn-prince/th-memory-mcp",
   "description": "Adaptive Memory MCP server - SQLite-backed memory for OpenCode",
   "author": "worakorn-prince",
@@ -18,6 +18,7 @@
     "README.md",
     "LICENSE",
     "ARCHITECTURE_v2.md",
+    "design.md",
     "opencode.example.json",
     "AGENTS.memory.example.md"
   ],
@@ -26,7 +27,7 @@
     "prepublishOnly": "npm run build",
     "start": "node dist/index.js",
     "inspect": "npx @modelcontextprotocol/inspector node dist/index.js",
-    "test": "npm run build && node test/capture.test.mjs && node test/distill.test.mjs && node test/lifecycle.test.mjs && node test/temporal.test.mjs && node test/conflict.test.mjs && node test/retrieval.test.mjs && node test/graph.test.mjs && node test/context.test.mjs && node test/consolidation.test.mjs && node test/benchmark.test.mjs && node test/security.test.mjs && node test/tools_v21.test.mjs && node test/smoke.mjs",
+    "test": "npm run build && node --test test/*.test.mjs",
     "distill": "node dist/distill.js",
     "quickstart": "npm run build && node scripts/quickstart.mjs"
   },
@@ -35,9 +36,20 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "better-sqlite3": "^12.0.0",
+    "better-sqlite3": "^12.9.0",
     "zod": "^3.25.0"
   },
+  "overrides": {
+    "ip-address": "^10.2.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "better-sqlite3"
+    ],
+    "overrides": {
+      "ip-address": "^10.2.0"
+    }
+  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
     "@types/node": "^22.0.0",