vault-go 0.27.0 → 0.29.0

package/README.md

@@ -148,6 +148,10 @@ Projects and sessions: `vault_go_projects`, `vault_go_project_create`, `vault_go
 
 Capture and recall: `vault_go_event`, `vault_go_remember`, `vault_go_forget`, `vault_go_search`, `vault_go_search_index`, `vault_go_retrieve`, `vault_go_observations`, `vault_go_timeline`, `vault_go_context`, `vault_go_file_context`, `vault_go_feed`, `vault_go_memory`, `vault_go_tool_uses`, `vault_go_stats`.
 
+Projects are matched by path first and then by repository: vault-go reads the checkout's `origin` remote, normalizes it to `host/owner/repo` and records it as the project's `repoKey`. A clone on another machine or user joins the oldest project with the same `repoKey` instead of creating a new one, and projects created before this are backfilled the first time a capture matches them by path.
+
+Read tools (`vault_go_search`, `vault_go_search_index`, `vault_go_feed`, `vault_go_retrieve` and query-anchored `vault_go_timeline`) are scoped to the project of the MCP server's working directory when no `projectId` is given; a git worktree maps to its main checkout. Pass `scope: "account"` to search every project of the account. Outside a known project they fall back to the account, and no project is created. Memories marked private stay out of search and feed results unless `includePrivate: true` is set.
+
 `vault_go_retrieve` lets the central memory engine choose a bounded retrieval path while every explicit retrieval tool remains available. `vault_go_decision_status` reports sanitized rollout/circuit state. Jev and its credential remain in the engine; a healthy deployment does not by itself prove provider availability or decision quality. `vault_go_decide` sends a caller-authored state plus up to 8 typed questions (`noul`, `choice`, `score`) to the central Jev and returns probabilities; it runs only in `full` rollout, one call at a time, refuses secrets, e-mails, identifiers, URLs and absolute local paths before anything leaves Vault, and persists nothing. The caller still owns the decision.
 
 Knowledge bases: `vault_go_knowledge_bases`, `vault_go_knowledge_base`, `vault_go_knowledge_build`, `vault_go_knowledge_rebuild`, `vault_go_knowledge_query`, `vault_go_knowledge_delete`, `vault_go_prime_corpus`, `vault_go_query_corpus`, `vault_go_reprime_corpus`.

package/dist/cloud.d.ts

@@ -18,6 +18,7 @@ export interface VaultMemoryApi {
     health(): Promise<unknown>;
     projects(): Promise<unknown>;
     createProject(input: Record<string, unknown>): Promise<unknown>;
+    updateProject?(id: string, input: Record<string, unknown>): Promise<unknown>;
     startSession(input: Record<string, unknown>): Promise<unknown>;
     endSession(id: string): Promise<unknown>;
     event(input: Record<string, unknown>): Promise<unknown>;
@@ -65,6 +66,7 @@ export declare class VaultCloudClient implements VaultMemoryApi {
     rotateDevice(id: string): Promise<unknown>;
     deviceAction(id: string, token: string, action: 'heartbeat' | 'disconnect', body?: Record<string, unknown>): Promise<unknown>;
     projects(): Promise<unknown>;
+    updateProject(id: string, input: Record<string, unknown>): Promise<unknown>;
     createProject(input: Record<string, unknown>): Promise<unknown>;
     startSession(input: Record<string, unknown>): Promise<unknown>;
     endSession(id: string): Promise<unknown>;

package/dist/cloud.js

@@ -80,6 +80,9 @@ export class VaultCloudClient {
     async projects() {
         return this.request('/memory/projects');
     }
+    async updateProject(id, input) {
+        return this.request(`/memory/projects/${encodeURIComponent(id)}`, { method: 'PATCH', body: input });
+    }
     async createProject(input) {
         return this.request('/memory/projects', { method: 'POST', body: input });
     }

package/dist/hooks.d.ts

@@ -3,6 +3,8 @@ import { type VaultMemoryApi } from "./cloud.js";
 export declare const HOOK_EVENTS: readonly ["context", "session-init", "observation", "file-context", "summarize"];
 export type HookEvent = (typeof HOOK_EVENTS)[number];
 type RecordValue = Record<string, unknown>;
+/** The existing project for a working directory (worktrees map to their main checkout); never creates one. */
+export declare function findWorkspaceProject(cloud: Pick<VaultMemoryApi, "projects">, cwd: string): Promise<RecordValue | undefined>;
 export declare function normalizeHookInput(adapter: string, value: unknown): RecordValue;
 export declare function hookOutput(event: HookEvent, context?: string, adapter?: string): RecordValue;
 export declare function executeHook(adapter: string, event: HookEvent, value: unknown, cloud?: VaultMemoryApi, home?: string, options?: {

package/dist/hooks.js

@@ -5,6 +5,7 @@ import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { applyCustomModeContext } from './custom-modes.js';
 import { VaultCloudClient } from "./cloud.js";
+import { repoKey } from "./repo-key.js";
 import { vaultHome } from "./config.js";
 import { enqueueGeneration } from "./hook-queue.js";
 import { transcriptCaptureEnabled } from './transcript-config.js';
@@ -66,6 +67,25 @@ function projectRoots(workspace) {
         return fallback;
     }
 }
+function matchWorkspaceProject(projects, roots, key) {
+    if (!Array.isArray(projects))
+        throw new Error("Resposta de projetos inválida");
+    const byPath = roots.map((cwd) => projects.find((item) => item &&
+        typeof item === "object" &&
+        typeof item.rootPath === "string" &&
+        Boolean(String(item.rootPath).trim()) &&
+        resolvedPath(String(item.rootPath)) === cwd)).find(Boolean);
+    if (byPath || !key)
+        return byPath;
+    // Why: a clone on another machine or user shares the repository, not the path.
+    // Projects arrive newest first; the oldest one with this key is the canonical one.
+    return projects.filter((item) => item && typeof item === "object" && item.repoKey === key).at(-1);
+}
+/** The existing project for a working directory (worktrees map to their main checkout); never creates one. */
+export async function findWorkspaceProject(cloud, cwd) {
+    const workspace = root(cwd);
+    return matchWorkspaceProject(await cloud.projects(), projectRoots(workspace), repoKey(workspace));
+}
 function canonicalFile(file, workspace, project) {
     const absolute = resolve(workspace, file);
     for (const directory of [workspace, resolvedPath(workspace)]) {
@@ -173,11 +193,8 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     const projects = await cloud.projects();
     if (!Array.isArray(projects))
         throw new Error("Resposta de projetos inválida");
-    let project = roots.map((cwd) => projects.find((item) => item &&
-        typeof item === "object" &&
-        typeof item.rootPath === "string" &&
-        Boolean(String(item.rootPath).trim()) &&
-        resolvedPath(String(item.rootPath)) === cwd)).find(Boolean);
+    const key = repoKey(workspace);
+    let project = matchWorkspaceProject(projects, roots, key);
     const cwd = project ? resolvedPath(String(project.rootPath)) : roots[0];
     if (!project && reading)
         return hookOutput(event, "", adapter);
@@ -185,8 +202,13 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
         project = record(await cloud.createProject({
             name: (basename(cwd) || "workspace").padEnd(3, "_").slice(0, 80),
             rootPath: cwd,
+            ...(key ? { repoKey: key } : {}),
         }));
     }
+    else if (!reading && key && !project.repoKey && typeof project.id === "string" && cloud.updateProject) {
+        // Backfill projects created before repository keys; never blocks capture.
+        await cloud.updateProject(project.id, { repoKey: key }).catch(() => undefined);
+    }
     if (typeof project.id !== "string")
         throw new Error("Projeto inválido");
     const limits = {

package/dist/knowledge-agent.d.ts

@@ -10,7 +10,7 @@ export declare function primeKnowledgeAgent(home: string, cloud: VaultMemoryApi,
     primed: boolean;
     memoryCount: number;
     conversationReset: boolean;
-    engine: "vault-ai-resume" | "claude-subscription" | "openai-subscription" | "openrouter" | "gemini";
+    engine: "gemini" | "vault-ai-resume" | "claude-subscription" | "openai-subscription" | "openrouter";
     model: string;
 }>;
 export declare function queryKnowledgeAgent(home: string, cloud: VaultMemoryApi, id: string, question: string, dependencies?: Dependencies): Promise<{
@@ -31,7 +31,7 @@ export declare function queryKnowledgeAgent(home: string, cloud: VaultMemoryApi,
         title: string;
     }[];
     generated: boolean;
-    engine: "vault-ai-resume" | "claude-subscription" | "openai-subscription" | "openrouter" | "gemini";
+    engine: "gemini" | "vault-ai-resume" | "claude-subscription" | "openai-subscription" | "openrouter";
     model: string;
     conversationTurns: number;
     contextTruncated: boolean;

package/dist/project-scope.d.ts

@@ -0,0 +1,13 @@
+import type { VaultMemoryApi } from './cloud.js';
+export type ProjectScope = 'project' | 'account';
+type ScopedInput = Record<string, unknown> & {
+    projectId?: string | undefined;
+    scope?: ProjectScope | undefined;
+};
+/**
+ * Why: MCP reads used to span every project of the account, so an agent in one
+ * repository received memories from unrelated clients. Reads now default to the
+ * project of the MCP server's working directory; `scope: "account"` widens them.
+ */
+export declare function createProjectScope(cloud: VaultMemoryApi, cwd?: () => string): (input: ScopedInput) => Promise<Record<string, unknown>>;
+export {};

package/dist/project-scope.js

@@ -0,0 +1,22 @@
+import { findWorkspaceProject } from './hooks.js';
+const CACHE_MS = 60_000;
+/**
+ * Why: MCP reads used to span every project of the account, so an agent in one
+ * repository received memories from unrelated clients. Reads now default to the
+ * project of the MCP server's working directory; `scope: "account"` widens them.
+ */
+export function createProjectScope(cloud, cwd = () => process.cwd()) {
+    let cached;
+    return async (input) => {
+        const { scope = 'project', ...rest } = input;
+        if (rest.projectId || scope === 'account')
+            return rest;
+        const workspace = cwd();
+        if (!cached || cached.cwd !== workspace || Date.now() - cached.at > CACHE_MS) {
+            const project = await findWorkspaceProject(cloud, workspace);
+            cached = { cwd: workspace, at: Date.now(), projectId: typeof project?.id === 'string' ? project.id : undefined };
+        }
+        // Outside a known project there is nothing narrower to scope to.
+        return cached.projectId ? { ...rest, projectId: cached.projectId } : rest;
+    };
+}

package/dist/repo-key.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Normalizes a git remote to `host/owner/repo` (no scheme, credentials, port or
+ * `.git`). Local paths and unrecognized forms return undefined.
+ */
+export declare function normalizeRemote(remote: string): string | undefined;
+/** Repository key for a checkout (worktrees share their main checkout's remote). */
+export declare function repoKey(workspace: string): string | undefined;

package/dist/repo-key.js

@@ -0,0 +1,91 @@
+import { readFileSync, statSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+// Same shape the engine accepts: lowercase host plus 1–8 path segments.
+const REPO_KEY = /^[a-z0-9][a-z0-9.-]{0,252}(\/[a-z0-9._~-]{1,200}){1,8}$/;
+function smallFile(path, limit) {
+    try {
+        const file = statSync(path);
+        if (!file.isFile() || file.size > limit)
+            return undefined;
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The shared git directory holding `config`; worktrees point to it through `commondir`. */
+function commonGitDir(workspace) {
+    const dotGit = resolve(workspace, '.git');
+    try {
+        if (statSync(dotGit).isDirectory())
+            return dotGit;
+    }
+    catch {
+        return undefined;
+    }
+    const marker = /^gitdir:\s*(.+)$/m.exec(smallFile(dotGit, 4096) ?? '');
+    if (!marker)
+        return undefined;
+    const gitdir = resolve(workspace, marker[1].trim());
+    const common = smallFile(resolve(gitdir, 'commondir'), 4096)?.trim();
+    return common ? resolve(gitdir, common) : gitdir;
+}
+function originUrl(config) {
+    let section = '';
+    let first;
+    for (const line of config.split(/\r?\n/)) {
+        const header = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+        if (header) {
+            section = header[1].trim();
+            continue;
+        }
+        const url = /^\s*url\s*=\s*(.+?)\s*$/.exec(line);
+        if (!url || !section.startsWith('remote '))
+            continue;
+        if (section === 'remote "origin"')
+            return url[1];
+        first ??= url[1];
+    }
+    return first;
+}
+/**
+ * Normalizes a git remote to `host/owner/repo` (no scheme, credentials, port or
+ * `.git`). Local paths and unrecognized forms return undefined.
+ */
+export function normalizeRemote(remote) {
+    const value = remote.trim();
+    let host;
+    let path;
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/.exec(value);
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            return undefined;
+        }
+        if (url.protocol === 'file:')
+            return undefined;
+        host = url.hostname;
+        path = url.pathname;
+    }
+    else if (scp) {
+        host = scp[1];
+        path = scp[2];
+    }
+    else {
+        return undefined;
+    }
+    const key = `${host}/${path.replace(/^\/+|\/+$/g, '').replace(/\.git$/i, '')}`.toLowerCase();
+    return REPO_KEY.test(key) && !key.endsWith('.git') ? key : undefined;
+}
+/** Repository key for a checkout (worktrees share their main checkout's remote). */
+export function repoKey(workspace) {
+    const gitDir = commonGitDir(workspace);
+    if (!gitDir || dirname(gitDir) === gitDir)
+        return undefined;
+    const config = smallFile(resolve(gitDir, 'config'), 64 * 1024);
+    const url = config ? originUrl(config) : undefined;
+    return url ? normalizeRemote(url) : undefined;
+}

package/dist/server.js

@@ -9,6 +9,7 @@ import { registerCrystalTools } from './crystal-tools.js';
 import { registerModeIntegrations } from './mode-integrations.js';
 import { registerKnowledgeAgentTools } from './knowledge-tools.js';
 import { redact } from './hooks.js';
+import { createProjectScope } from './project-scope.js';
 import { VaultCloudClient } from './cloud.js';
 import { getStatus, vaultHome } from './config.js';
 import { createPrivateBackup, restorePrivateBackup } from './backup.js';
@@ -172,12 +173,23 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
         inputSchema: { id: uuid },
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
     }, async ({ id }) => run(() => cloud.forget(id)));
+    const scoped = createProjectScope(cloud);
+    const scope = z
+        .enum(['project', 'account'])
+        .default('project')
+        .describe('project (padrão): só o projeto do diretório atual quando projectId não é informado; account: todos os projetos da conta.');
+    const includePrivate = z
+        .boolean()
+        .default(false)
+        .describe('Inclui memórias marcadas como privadas (por padrão ficam de fora).');
     server.registerTool('vault_go_search', {
         title: 'Pesquisar no Vault',
         description: 'Pesquisa memórias persistidas na plataforma Vault.',
         inputSchema: {
             query: z.string().trim().max(1_000).default(''),
             projectId: uuid.optional(),
+            scope,
+            includePrivate,
             kind: z.string().trim().max(100).optional(),
             memoryType: z.string().trim().max(100).optional(),
             platformSource: z.string().trim().max(100).optional(),
@@ -190,23 +202,24 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
             orderBy: z.enum(['date_asc', 'date_desc']).optional(),
         },
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
-    }, async (input) => run(() => cloud.search(input)));
+    }, async (input) => run(async () => cloud.search(await scoped(input))));
     server.registerTool('vault_go_retrieve', {
         title: 'Recuperação automática do Vault',
         description: 'Delega ao motor central a escolha tipada entre busca, contexto de arquivo, linha do tempo, base de conhecimento, grafo ou nenhum resultado. Falhas usam busca determinística.',
         inputSchema: {
             query: z.string().trim().min(1).max(1_000),
             projectId: uuid.optional(),
+            scope,
             files: z.array(z.string().trim().min(1).max(2_000)).max(50).default([]),
             knowledgeBaseId: uuid.optional(),
             limit: z.number().int().min(1).max(200).default(20),
             maxChars: z.number().int().min(1_000).max(100_000).optional(),
         },
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
-    }, async (input) => run(() => {
+    }, async (input) => run(async () => {
         if (!cloud.retrieve)
             throw new Error('Native retrieval is unavailable on this deployment.');
-        return cloud.retrieve(input);
+        return cloud.retrieve(await scoped(input));
     }));
     server.registerTool('vault_go_decision_status', {
         title: 'Status da camada de decisão',
@@ -258,6 +271,8 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
         inputSchema: {
             query: z.string().trim().max(1_000).default(''),
             projectId: uuid.optional(),
+            scope,
+            includePrivate,
             kind: z.string().trim().max(100).optional(),
             memoryType: z.string().trim().max(100).optional(),
             platformSource: z.string().trim().max(100).optional(),
@@ -270,7 +285,7 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
             orderBy: z.enum(['date_asc', 'date_desc']).optional(),
         },
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
-    }, async (input) => run(() => cloud.searchIndex(input)));
+    }, async (input) => run(async () => cloud.searchIndex(await scoped(input))));
     server.registerTool('vault_go_observations', {
         title: 'Carregar observações por ID',
         description: 'Terceira camada de recuperação: carrega em lote somente as observações escolhidas no índice ou na linha do tempo.',
@@ -286,15 +301,18 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
             anchorId: uuid.optional(),
             query: z.string().trim().min(1).max(1_000).optional(),
             projectId: uuid.optional(),
+            scope,
             platformSource: z.string().trim().min(1).max(100).optional(),
             before: z.number().int().min(0).max(100).default(5),
             after: z.number().int().min(0).max(100).default(5),
         },
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
-    }, async (input) => run(() => {
+    }, async (input) => run(async () => {
         if (Boolean(input.anchorId) === Boolean(input.query))
             throw new Error('Informe exatamente anchorId ou query.');
-        return cloud.timeline(input);
+        // An anchor already identifies its project; only query anchors are scoped.
+        const { scope: _scope, ...anchored } = input;
+        return cloud.timeline(input.anchorId ? anchored : await scoped(input));
     }));
     server.registerTool('vault_go_context', {
         title: 'Montar contexto',
@@ -329,6 +347,8 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
         description: 'Lista memórias recentes com paginação estável por cursor.',
         inputSchema: {
             projectId: uuid.optional(),
+            scope,
+            includePrivate,
             kind: z.string().trim().max(100).optional(),
             memoryType: z.string().trim().max(100).optional(),
             platformSource: z.string().trim().max(100).optional(),
@@ -336,7 +356,7 @@ export function createVaultGoServer(home = vaultHome(), cloud = new VaultCloudCl
             limit: z.number().int().min(1).max(100).default(20),
         },
         annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true },
-    }, async (input) => run(() => cloud.feed(input)));
+    }, async (input) => run(async () => cloud.feed(await scoped(input))));
     server.registerTool('vault_go_knowledge_bases', {
         title: 'Listar bases de conhecimento',
         description: 'Lista bases filtradas e persistidas na plataforma Vault.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "MCP server and installer for Vault Memory: search, capture, and use account memory across AI clients.",
   "type": "module",
   "bin": {
@@ -84,7 +84,11 @@
     "dist/mcp-clients.js",
     "dist/mcp-clients.d.ts",
     "dist/mcp-result.js",
+    "dist/project-scope.js",
     "dist/mcp-result.d.ts",
+    "dist/project-scope.d.ts",
+    "dist/repo-key.js",
+    "dist/repo-key.d.ts",
     "dist/parity-tools.js",
     "dist/parity-tools.d.ts",
     "dist/capabilities.js",
@@ -133,7 +137,7 @@
   ],
   "scripts": {
     "clean": "bun -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
-    "build": "bun run clean && tsc -p tsconfig.json",
+    "build": "bun run clean && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "bun run build && bun test src",
     "pack:check": "npm pack --dry-run",