vault-go 0.28.0 → 0.29.1

package/README.md

@@ -148,6 +148,10 @@ Projects and sessions: `vault_go_projects`, `vault_go_project_create`, `vault_go
 
 Capture and recall: `vault_go_event`, `vault_go_remember`, `vault_go_forget`, `vault_go_search`, `vault_go_search_index`, `vault_go_retrieve`, `vault_go_observations`, `vault_go_timeline`, `vault_go_context`, `vault_go_file_context`, `vault_go_feed`, `vault_go_memory`, `vault_go_tool_uses`, `vault_go_stats`.
 
+Projects are matched by path first and then by repository: vault-go reads the checkout's `origin` remote, normalizes it to `host/owner/repo` and records it as the project's `repoKey`. A clone on another machine or user joins the oldest project with the same `repoKey` instead of creating a new one, and projects created before this are backfilled the first time a capture matches them by path.
+
+A folder without git joins the nearest existing project above it instead of becoming a project of its own; a git checkout always keeps its own project.
+
 Read tools (`vault_go_search`, `vault_go_search_index`, `vault_go_feed`, `vault_go_retrieve` and query-anchored `vault_go_timeline`) are scoped to the project of the MCP server's working directory when no `projectId` is given; a git worktree maps to its main checkout. Pass `scope: "account"` to search every project of the account. Outside a known project they fall back to the account, and no project is created. Memories marked private stay out of search and feed results unless `includePrivate: true` is set.
 
 `vault_go_retrieve` lets the central memory engine choose a bounded retrieval path while every explicit retrieval tool remains available. `vault_go_decision_status` reports sanitized rollout/circuit state. Jev and its credential remain in the engine; a healthy deployment does not by itself prove provider availability or decision quality. `vault_go_decide` sends a caller-authored state plus up to 8 typed questions (`noul`, `choice`, `score`) to the central Jev and returns probabilities; it runs only in `full` rollout, one call at a time, refuses secrets, e-mails, identifiers, URLs and absolute local paths before anything leaves Vault, and persists nothing. The caller still owns the decision.

package/dist/cloud.d.ts

@@ -18,6 +18,7 @@ export interface VaultMemoryApi {
     health(): Promise<unknown>;
     projects(): Promise<unknown>;
     createProject(input: Record<string, unknown>): Promise<unknown>;
+    updateProject?(id: string, input: Record<string, unknown>): Promise<unknown>;
     startSession(input: Record<string, unknown>): Promise<unknown>;
     endSession(id: string): Promise<unknown>;
     event(input: Record<string, unknown>): Promise<unknown>;
@@ -65,6 +66,7 @@ export declare class VaultCloudClient implements VaultMemoryApi {
     rotateDevice(id: string): Promise<unknown>;
     deviceAction(id: string, token: string, action: 'heartbeat' | 'disconnect', body?: Record<string, unknown>): Promise<unknown>;
     projects(): Promise<unknown>;
+    updateProject(id: string, input: Record<string, unknown>): Promise<unknown>;
     createProject(input: Record<string, unknown>): Promise<unknown>;
     startSession(input: Record<string, unknown>): Promise<unknown>;
     endSession(id: string): Promise<unknown>;

package/dist/cloud.js

@@ -80,6 +80,9 @@ export class VaultCloudClient {
     async projects() {
         return this.request('/memory/projects');
     }
+    async updateProject(id, input) {
+        return this.request(`/memory/projects/${encodeURIComponent(id)}`, { method: 'PATCH', body: input });
+    }
     async createProject(input) {
         return this.request('/memory/projects', { method: 'POST', body: input });
     }

package/dist/hooks.js

@@ -1,10 +1,11 @@
 import { redact } from './capture-privacy.js';
 export { redact } from './capture-privacy.js';
 import { createHash, randomUUID } from "node:crypto";
-import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { applyCustomModeContext } from './custom-modes.js';
 import { VaultCloudClient } from "./cloud.js";
+import { repoKey } from "./repo-key.js";
 import { vaultHome } from "./config.js";
 import { enqueueGeneration } from "./hook-queue.js";
 import { transcriptCaptureEnabled } from './transcript-config.js';
@@ -66,18 +67,42 @@ function projectRoots(workspace) {
         return fallback;
     }
 }
-function matchWorkspaceProject(projects, roots) {
+function matchWorkspaceProject(projects, roots, key, inGit = true) {
     if (!Array.isArray(projects))
         throw new Error("Resposta de projetos inválida");
-    return roots.map((cwd) => projects.find((item) => item &&
+    const byPath = roots.map((cwd) => projects.find((item) => item &&
         typeof item === "object" &&
         typeof item.rootPath === "string" &&
         Boolean(String(item.rootPath).trim()) &&
         resolvedPath(String(item.rootPath)) === cwd)).find(Boolean);
+    if (byPath)
+        return byPath;
+    // Why: a clone on another machine or user shares the repository, not the path.
+    // Projects arrive newest first; the oldest one with this key is the canonical one.
+    const byRepo = key
+        ? projects.filter((item) => item && typeof item === "object" && item.repoKey === key).at(-1)
+        : undefined;
+    if (byRepo || inGit)
+        return byRepo;
+    // Why: a folder without git used to become its own project, splitting memories
+    // between an umbrella folder and its subfolders. Prefer the nearest existing ancestor.
+    const cwd = roots[0];
+    return projects
+        .filter((item) => {
+        if (!item || typeof item !== "object" || typeof item.rootPath !== "string")
+            return false;
+        const path = String(item.rootPath).trim();
+        if (!path)
+            return false;
+        const ancestor = relative(resolvedPath(path), cwd);
+        return Boolean(ancestor) && ancestor !== ".." && !ancestor.startsWith(`..${sep}`) && !isAbsolute(ancestor);
+    })
+        .sort((a, b) => resolvedPath(String(b.rootPath)).length - resolvedPath(String(a.rootPath)).length)[0];
 }
 /** The existing project for a working directory (worktrees map to their main checkout); never creates one. */
 export async function findWorkspaceProject(cloud, cwd) {
-    return matchWorkspaceProject(await cloud.projects(), projectRoots(root(cwd)));
+    const workspace = root(cwd);
+    return matchWorkspaceProject(await cloud.projects(), projectRoots(workspace), repoKey(workspace), existsSync(resolve(workspace, ".git")));
 }
 function canonicalFile(file, workspace, project) {
     const absolute = resolve(workspace, file);
@@ -186,7 +211,8 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
     const projects = await cloud.projects();
     if (!Array.isArray(projects))
         throw new Error("Resposta de projetos inválida");
-    let project = matchWorkspaceProject(projects, roots);
+    const key = repoKey(workspace);
+    let project = matchWorkspaceProject(projects, roots, key, existsSync(resolve(workspace, ".git")));
     const cwd = project ? resolvedPath(String(project.rootPath)) : roots[0];
     if (!project && reading)
         return hookOutput(event, "", adapter);
@@ -194,8 +220,13 @@ export async function executeHook(adapter, event, value, cloud = new VaultCloudC
         project = record(await cloud.createProject({
             name: (basename(cwd) || "workspace").padEnd(3, "_").slice(0, 80),
             rootPath: cwd,
+            ...(key ? { repoKey: key } : {}),
         }));
     }
+    else if (!reading && key && !project.repoKey && typeof project.id === "string" && cloud.updateProject) {
+        // Backfill projects created before repository keys; never blocks capture.
+        await cloud.updateProject(project.id, { repoKey: key }).catch(() => undefined);
+    }
     if (typeof project.id !== "string")
         throw new Error("Projeto inválido");
     const limits = {

package/dist/repo-key.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Normalizes a git remote to `host/owner/repo` (no scheme, credentials, port or
+ * `.git`). Local paths and unrecognized forms return undefined.
+ */
+export declare function normalizeRemote(remote: string): string | undefined;
+/** Repository key for a checkout (worktrees share their main checkout's remote). */
+export declare function repoKey(workspace: string): string | undefined;

package/dist/repo-key.js

@@ -0,0 +1,91 @@
+import { readFileSync, statSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+// Same shape the engine accepts: lowercase host plus 1–8 path segments.
+const REPO_KEY = /^[a-z0-9][a-z0-9.-]{0,252}(\/[a-z0-9._~-]{1,200}){1,8}$/;
+function smallFile(path, limit) {
+    try {
+        const file = statSync(path);
+        if (!file.isFile() || file.size > limit)
+            return undefined;
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The shared git directory holding `config`; worktrees point to it through `commondir`. */
+function commonGitDir(workspace) {
+    const dotGit = resolve(workspace, '.git');
+    try {
+        if (statSync(dotGit).isDirectory())
+            return dotGit;
+    }
+    catch {
+        return undefined;
+    }
+    const marker = /^gitdir:\s*(.+)$/m.exec(smallFile(dotGit, 4096) ?? '');
+    if (!marker)
+        return undefined;
+    const gitdir = resolve(workspace, marker[1].trim());
+    const common = smallFile(resolve(gitdir, 'commondir'), 4096)?.trim();
+    return common ? resolve(gitdir, common) : gitdir;
+}
+function originUrl(config) {
+    let section = '';
+    let first;
+    for (const line of config.split(/\r?\n/)) {
+        const header = /^\s*\[([^\]]+)\]\s*$/.exec(line);
+        if (header) {
+            section = header[1].trim();
+            continue;
+        }
+        const url = /^\s*url\s*=\s*(.+?)\s*$/.exec(line);
+        if (!url || !section.startsWith('remote '))
+            continue;
+        if (section === 'remote "origin"')
+            return url[1];
+        first ??= url[1];
+    }
+    return first;
+}
+/**
+ * Normalizes a git remote to `host/owner/repo` (no scheme, credentials, port or
+ * `.git`). Local paths and unrecognized forms return undefined.
+ */
+export function normalizeRemote(remote) {
+    const value = remote.trim();
+    let host;
+    let path;
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/.exec(value);
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            return undefined;
+        }
+        if (url.protocol === 'file:')
+            return undefined;
+        host = url.hostname;
+        path = url.pathname;
+    }
+    else if (scp) {
+        host = scp[1];
+        path = scp[2];
+    }
+    else {
+        return undefined;
+    }
+    const key = `${host}/${path.replace(/^\/+|\/+$/g, '').replace(/\.git$/i, '')}`.toLowerCase();
+    return REPO_KEY.test(key) && !key.endsWith('.git') ? key : undefined;
+}
+/** Repository key for a checkout (worktrees share their main checkout's remote). */
+export function repoKey(workspace) {
+    const gitDir = commonGitDir(workspace);
+    if (!gitDir || dirname(gitDir) === gitDir)
+        return undefined;
+    const config = smallFile(resolve(gitDir, 'config'), 64 * 1024);
+    const url = config ? originUrl(config) : undefined;
+    return url ? normalizeRemote(url) : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "description": "MCP server and installer for Vault Memory: search, capture, and use account memory across AI clients.",
   "type": "module",
   "bin": {
@@ -87,6 +87,8 @@
     "dist/project-scope.js",
     "dist/mcp-result.d.ts",
     "dist/project-scope.d.ts",
+    "dist/repo-key.js",
+    "dist/repo-key.d.ts",
     "dist/parity-tools.js",
     "dist/parity-tools.d.ts",
     "dist/capabilities.js",