ai-memory-cli 0.1.1__tar.gz → 0.1.6__tar.gz

{ai_memory_cli-0.1.1/src/ai_memory_cli.egg-info → ai_memory_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-memory-cli
-Version: 0.1.1
+Version: 0.1.6
 Summary: Python CLI for AI Memory terminal capture and offline sync.
 Author: AI Memory
 License-Expression: MIT
@@ -50,15 +50,49 @@ python -m pip install -e .
 python -m ai_memory_cli auth --token TOKEN_FROM_WEBSITE --api-url https://api.your-domain.com
 python -m ai_memory_cli init --project my-project --repo owner/repo --workspace .
 python -m ai_memory_cli workspace connect --path . --repo owner/repo --editor vscode --package-manager pip
-python -m ai_memory_cli watch
+watch
 ```
 
+The `auth` command verifies the website-issued token with FastAPI before it is saved locally. After verification,
+the CLI stores a SHA-512 user hash for this computer, binds the token to that hash on the server, and starts the
+background sync agent once on Windows.
+
+`watch` is a shortcut for `python -m ai_memory_cli watch`. If Windows Device Guard blocks the generated launcher, keep using `python -m ai_memory_cli watch`.
+On Windows the shortcut is installed as `watch.cmd`; the Python Scripts folder must be on `PATH` for bare `watch` to resolve.
+
 Use `python -m ai_memory_cli run -- COMMAND` when you only want to record one command.
 
 On Windows, `python -m ai_memory_cli ...` is the safest form because it avoids PATH issues and Device Guard policies that can block pip's generated `ai-memory.exe` launcher. Also avoid angle bracket placeholders in CMD because they are treated as file redirection.
 
 Inside `watch`, type the real command you want to capture, for example `python --version`. Do not type `python -m ai_memory_cli run -- ...` inside `watch`, or you will capture the nested CLI command too.
 
+## Background agent
+
+After `auth`, the background agent starts once and is installed in the Windows Startup folder so queued terminal
+hashes keep syncing whenever the API is reachable. Use these commands when you need manual control:
+
+```powershell
+python -m ai_memory_cli agent status
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent start
+```
+
+The agent does not secretly capture every terminal on the computer. Commands are captured when they run through:
+
+```powershell
+python -m ai_memory_cli watch
+python -m ai_memory_cli run -- python --version
+```
+
+To remove the startup task:
+
+```powershell
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent uninstall
+```
+
+Agent logs are written to `%USERPROFILE%\.ai-memory-cli\logs\agent.log`.
+
 ## Storage
 
 The CLI stores config and unsynced events in a separate folder:
@@ -68,6 +102,15 @@ The CLI stores config and unsynced events in a separate folder:
 
 Set `AI_MEMORY_CLI_HOME` to override this location.
 
+Accepted command observations are also written as plain daily hash logs:
+
+- Windows: `%USERPROFILE%\.ai-memory-cli\history\YYYY-MM-DD.log`
+- macOS/Linux: `~/.ai-memory-cli/history/YYYY-MM-DD.log`
+
+These files include time/date, event hash, command hash, output hash, source, exit code, and working-folder name. They do not store raw command text or raw output.
+
+If a command is clearly invalid, such as a pasted prompt (`ai-memory> python --version`) or a shell "not recognized" error, the CLI skips storing it as an event.
+
 ## Privacy and dedupe
 
 The CLI does not send raw commands or raw output to the backend. It sends:

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6}/README.md

@@ -28,15 +28,49 @@ python -m pip install -e .
 python -m ai_memory_cli auth --token TOKEN_FROM_WEBSITE --api-url https://api.your-domain.com
 python -m ai_memory_cli init --project my-project --repo owner/repo --workspace .
 python -m ai_memory_cli workspace connect --path . --repo owner/repo --editor vscode --package-manager pip
-python -m ai_memory_cli watch
+watch
 ```
 
+The `auth` command verifies the website-issued token with FastAPI before it is saved locally. After verification,
+the CLI stores a SHA-512 user hash for this computer, binds the token to that hash on the server, and starts the
+background sync agent once on Windows.
+
+`watch` is a shortcut for `python -m ai_memory_cli watch`. If Windows Device Guard blocks the generated launcher, keep using `python -m ai_memory_cli watch`.
+On Windows the shortcut is installed as `watch.cmd`; the Python Scripts folder must be on `PATH` for bare `watch` to resolve.
+
 Use `python -m ai_memory_cli run -- COMMAND` when you only want to record one command.
 
 On Windows, `python -m ai_memory_cli ...` is the safest form because it avoids PATH issues and Device Guard policies that can block pip's generated `ai-memory.exe` launcher. Also avoid angle bracket placeholders in CMD because they are treated as file redirection.
 
 Inside `watch`, type the real command you want to capture, for example `python --version`. Do not type `python -m ai_memory_cli run -- ...` inside `watch`, or you will capture the nested CLI command too.
 
+## Background agent
+
+After `auth`, the background agent starts once and is installed in the Windows Startup folder so queued terminal
+hashes keep syncing whenever the API is reachable. Use these commands when you need manual control:
+
+```powershell
+python -m ai_memory_cli agent status
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent start
+```
+
+The agent does not secretly capture every terminal on the computer. Commands are captured when they run through:
+
+```powershell
+python -m ai_memory_cli watch
+python -m ai_memory_cli run -- python --version
+```
+
+To remove the startup task:
+
+```powershell
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent uninstall
+```
+
+Agent logs are written to `%USERPROFILE%\.ai-memory-cli\logs\agent.log`.
+
 ## Storage
 
 The CLI stores config and unsynced events in a separate folder:
@@ -46,6 +80,15 @@ The CLI stores config and unsynced events in a separate folder:
 
 Set `AI_MEMORY_CLI_HOME` to override this location.
 
+Accepted command observations are also written as plain daily hash logs:
+
+- Windows: `%USERPROFILE%\.ai-memory-cli\history\YYYY-MM-DD.log`
+- macOS/Linux: `~/.ai-memory-cli/history/YYYY-MM-DD.log`
+
+These files include time/date, event hash, command hash, output hash, source, exit code, and working-folder name. They do not store raw command text or raw output.
+
+If a command is clearly invalid, such as a pasted prompt (`ai-memory> python --version`) or a shell "not recognized" error, the CLI skips storing it as an event.
+
 ## Privacy and dedupe
 
 The CLI does not send raw commands or raw output to the backend. It sends:

ai_memory_cli-0.1.6/bin/watch.cmd

@@ -0,0 +1,7 @@
+@echo off
+set "AI_MEMORY_PY=%~dp0python.exe"
+if exist "%AI_MEMORY_PY%" (
+  "%AI_MEMORY_PY%" -m ai_memory_cli watch %*
+) else (
+  python -m ai_memory_cli watch %*
+)

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ai-memory-cli"
-version = "0.1.1"
+version = "0.1.6"
 description = "Python CLI for AI Memory terminal capture and offline sync."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -29,5 +29,8 @@ dependencies = []
 [project.scripts]
 ai-memory = "ai_memory_cli.cli:main"
 
+[tool.setuptools]
+script-files = ["bin/watch.cmd"]
+
 [tool.setuptools.packages.find]
 where = ["src"]

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6}/src/ai_memory_cli/__init__.py

@@ -1,3 +1,3 @@
 """AI Memory terminal capture CLI."""
 
-__version__ = "0.1.1"
+__version__ = "0.1.6"

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6}/src/ai_memory_cli/cli.py

@@ -1,10 +1,12 @@
 from __future__ import annotations
 
 import argparse
+import getpass
 import json
 import os
 import platform
 import re
+import secrets
 import shutil
 import subprocess
 import sys
@@ -18,6 +20,8 @@ from typing import Any
 from . import __version__
 
 DEFAULT_API_URL = "http://127.0.0.1:8000"
+WINDOWS_AGENT_TASK_NAME = "AI Memory CLI Agent"
+DEFAULT_AGENT_INTERVAL_SECONDS = 60
 DEFAULT_EXCLUDES = [
     r"^\s*npm\s+run(\s|$)",
     r"^\s*npm\s+start(\s|$)",
@@ -30,6 +34,14 @@ DEFAULT_EXCLUDES = [
     r"uvicorn\b.*\s--reload(\s|$)",
     r"python(\.exe)?\s+-m\s+uvicorn\b.*\s--reload(\s|$)",
 ]
+SHELL_NOT_FOUND_PATTERNS = [
+    "is not recognized as an internal or external command",
+    "is not recognized as the name of a cmdlet",
+    "the system cannot find the file specified",
+    "the syntax of the command is incorrect",
+    "no such file or directory",
+    "command not found",
+]
 
 
 def utc_now() -> str:
@@ -42,6 +54,12 @@ def sha256_text(value: str) -> str:
     return hashlib.sha256(value.encode("utf-8", errors="replace")).hexdigest()
 
 
+def sha512_text(value: str) -> str:
+    import hashlib
+
+    return hashlib.sha512(value.encode("utf-8", errors="replace")).hexdigest()
+
+
 def cli_home() -> Path:
     configured = os.getenv("AI_MEMORY_CLI_HOME")
     if configured:
@@ -50,7 +68,7 @@ def cli_home() -> Path:
 
 
 def ensure_dirs(home: Path) -> None:
-    for folder in ["events", "outbox", "sent", "logs"]:
+    for folder in ["events", "outbox", "sent", "logs", "history"]:
         (home / folder).mkdir(parents=True, exist_ok=True)
 
 
@@ -70,6 +88,32 @@ def write_json(path: Path, payload: Any) -> None:
     tmp_path.replace(path)
 
 
+def append_log(home: Path, message: str) -> None:
+    ensure_dirs(home)
+    log_path = home / "logs" / "agent.log"
+    with log_path.open("a", encoding="utf-8") as file:
+        file.write(f"{utc_now()} {message}\n")
+
+
+def append_history(home: Path, event: dict[str, Any], state: str) -> None:
+    ensure_dirs(home)
+    timestamp = str(event.get("observed_at") or event.get("ended_at") or utc_now())
+    day = timestamp[:10] if len(timestamp) >= 10 else utc_now()[:10]
+    history_path = home / "history" / f"{day}.log"
+    fields = [
+        timestamp,
+        f"state={state}",
+        f"source={event.get('source', '-')}",
+        f"exit={event.get('exit_code', '-')}",
+        f"event={str(event.get('event_hash', ''))[:12]}",
+        f"command_hash={event.get('command_hash', '-')}",
+        f"output_hash={event.get('output_hash', '-')}",
+        f"cwd={event.get('metadata', {}).get('cwd_tail', '-')}",
+    ]
+    with history_path.open("a", encoding="utf-8") as file:
+        file.write(" ".join(fields) + "\n")
+
+
 def config_path(home: Path) -> Path:
     return home / "config.json"
 
@@ -90,10 +134,189 @@ def save_config(home: Path, config: dict[str, Any]) -> None:
     write_json(config_path(home), config)
 
 
+def ensure_local_identity(home: Path, config: dict[str, Any]) -> str:
+    secret = str(config.get("local_identity_secret") or "").strip()
+    if not secret:
+        secret = secrets.token_urlsafe(96)
+        config["local_identity_secret"] = secret
+        config["local_identity_created_at"] = utc_now()
+
+    local_user_hash = sha512_text(
+        "\0".join(
+            [
+                secret,
+                str(home),
+                platform.node() or "unknown-host",
+                getpass.getuser() or "unknown-user",
+                platform.system(),
+            ]
+        )
+    )
+    config["local_user_hash"] = local_user_hash
+    return local_user_hash
+
+
+def client_identity(home: Path, config: dict[str, Any]) -> dict[str, Any]:
+    local_user_hash = ensure_local_identity(home, config)
+    return {
+        "name": "ai-memory-cli",
+        "version": __version__,
+        "local_user_hash": local_user_hash,
+        "user_hash": config.get("user_hash") or "",
+        "github_user": config.get("github_user") or "",
+        "session_id": config.get("session_id") or "",
+        "storage_home_hash": sha256_text(str(home)),
+        "hostname_hash": sha256_text(platform.node() or "unknown"),
+        "username_hash": sha256_text(getpass.getuser() or "unknown"),
+        "platform": platform.system(),
+        "python": platform.python_version(),
+        "auth_verified_at": config.get("auth_verified_at") or "",
+    }
+
+
+def agent_state_path(home: Path) -> Path:
+    return home / "agent.json"
+
+
+def scheduler_python_executable(background: bool = True) -> str:
+    executable = Path(sys.executable)
+    if os.name == "nt" and background:
+        pythonw = executable.with_name("pythonw.exe")
+        if pythonw.exists():
+            return str(pythonw)
+    return str(executable)
+
+
+def windows_startup_dir() -> Path:
+    appdata = os.getenv("APPDATA")
+    if not appdata:
+        raise SystemExit("APPDATA is not set; cannot locate the Windows Startup folder.")
+    return Path(appdata) / "Microsoft" / "Windows" / "Start Menu" / "Programs" / "Startup"
+
+
+def windows_startup_script_path() -> Path:
+    return windows_startup_dir() / "AI Memory CLI Agent.vbs"
+
+
+def write_windows_startup_script(interval: int, limit: int) -> Path:
+    startup_dir = windows_startup_dir()
+    startup_dir.mkdir(parents=True, exist_ok=True)
+    script_path = windows_startup_script_path()
+    python_executable = scheduler_python_executable(background=False)
+    command = f'"{python_executable}" -m ai_memory_cli agent run --interval {interval} --limit {limit}'
+    escaped_command = command.replace('"', '""')
+    script_path.write_text(
+        "\n".join(
+            [
+                "Set shell = CreateObject(\"WScript.Shell\")",
+                f"shell.Run \"{escaped_command}\", 0, False",
+                "",
+            ]
+        ),
+        encoding="utf-8",
+    )
+    return script_path
+
+
+def start_detached_agent(interval: int, limit: int) -> int:
+    python_executable = scheduler_python_executable(background=True)
+    command = [
+        python_executable,
+        "-m",
+        "ai_memory_cli",
+        "agent",
+        "run",
+        "--interval",
+        str(interval),
+        "--limit",
+        str(limit),
+    ]
+    creationflags = 0
+    if os.name == "nt":
+        creationflags = subprocess.DETACHED_PROCESS | subprocess.CREATE_NEW_PROCESS_GROUP
+        if hasattr(subprocess, "CREATE_NO_WINDOW"):
+            creationflags |= subprocess.CREATE_NO_WINDOW
+
+    process = subprocess.Popen(
+        command,
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        close_fds=True,
+        creationflags=creationflags,
+    )
+    return int(process.pid)
+
+
+def is_process_running(pid: Any) -> bool:
+    try:
+        pid_int = int(pid)
+    except (TypeError, ValueError):
+        return False
+    if pid_int <= 0:
+        return False
+
+    if os.name == "nt":
+        result = subprocess.run(
+            ["tasklist", "/FI", f"PID eq {pid_int}", "/FO", "CSV", "/NH"],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        return result.returncode == 0 and str(pid_int) in result.stdout
+
+    try:
+        os.kill(pid_int, 0)
+        return True
+    except OSError:
+        return False
+
+
+def ensure_agent_started_once(home: Path, config: dict[str, Any]) -> None:
+    agent_config = config.get("agent") if isinstance(config.get("agent"), dict) else {}
+    interval = int(agent_config.get("interval_seconds") or DEFAULT_AGENT_INTERVAL_SECONDS)
+    limit = int(agent_config.get("limit") or 50)
+    state = read_json(agent_state_path(home), {})
+
+    if is_process_running(state.get("pid")):
+        print(f"AI Memory sync agent already running: pid={state.get('pid')}")
+        return
+
+    if os.name == "nt":
+        script_path = write_windows_startup_script(interval, limit)
+        pid = start_detached_agent(interval, limit)
+        config["agent"] = {
+            **agent_config,
+            "method": "startup",
+            "interval_seconds": interval,
+            "limit": limit,
+            "startup_script": str(script_path),
+            "last_started_pid": pid,
+            "last_started_at": utc_now(),
+        }
+        save_config(home, config)
+        append_log(home, f"auth started detached agent pid={pid}")
+        print(f"AI Memory sync agent started once: pid={pid}")
+        print(f"Startup sync installed at: {script_path}")
+        return
+
+    print("Automatic startup agent install is only implemented for Windows.")
+    print("Start sync manually with: python -m ai_memory_cli agent run")
+
+
 def normalize_command(command: str) -> str:
     return " ".join(command.strip().split())
 
 
+def clean_watch_command(command: str) -> str:
+    cleaned = command.strip()
+    while cleaned.lower().startswith("ai-memory>"):
+        cleaned = cleaned[len("ai-memory>") :].strip()
+    cleaned = re.sub(r"^[A-Za-z]:\\[^>]*>\s*", "", cleaned).strip()
+    return cleaned
+
+
 def normalize_output(stdout: str, stderr: str) -> str:
     combined = f"stdout:\n{stdout}\nstderr:\n{stderr}"
     lines = [line.rstrip() for line in combined.replace("\r\n", "\n").replace("\r", "\n").split("\n")]
@@ -123,6 +346,13 @@ def is_excluded(command: str, config: dict[str, Any]) -> bool:
     return any(re.search(pattern, command, flags=re.IGNORECASE) for pattern in patterns)
 
 
+def is_shell_not_found(stdout: str, stderr: str, exit_code: int | None) -> bool:
+    if exit_code in (None, 0):
+        return False
+    combined = f"{stdout}\n{stderr}".lower()
+    return any(pattern in combined for pattern in SHELL_NOT_FOUND_PATTERNS)
+
+
 def api_url(config: dict[str, Any]) -> str:
     return str(config.get("api_url") or DEFAULT_API_URL).rstrip("/")
 
@@ -158,6 +388,58 @@ def http_json(
     return json.loads(response_body)
 
 
+def describe_http_error(exc: urllib.error.HTTPError) -> str:
+    try:
+        body = exc.read().decode("utf-8", errors="replace")
+        payload = json.loads(body) if body else {}
+        detail = payload.get("detail") if isinstance(payload, dict) else None
+        if detail:
+            return str(detail)
+        if body:
+            return body[:500]
+    except Exception:
+        pass
+    return f"HTTP {exc.code} {exc.reason}"
+
+
+def verify_cli_auth(home: Path, config: dict[str, Any], token: str) -> dict[str, Any]:
+    identity = client_identity(home, config)
+    response = http_json(
+        "POST",
+        f"{api_url(config)}/cli/auth/verify",
+        {"client": identity},
+        token,
+    )
+    if not response.get("verified"):
+        raise RuntimeError("CLI token was not verified by the backend.")
+
+    config["token"] = token
+    config["token_hash"] = sha256_text(token)
+    config["token_tail"] = response.get("token_tail") or ""
+    config["session_id"] = response.get("session_id") or ""
+    config["github_user"] = response.get("github_user") or response.get("github_account_name") or ""
+    config["user_hash"] = response.get("user_hash") or ""
+    config["bound_local_user_hash"] = response.get("bound_local_user_hash") or identity["local_user_hash"]
+    config["auth_verified_at"] = response.get("verified_at") or utc_now()
+    config["server_account_storage_dir"] = response.get("account_storage_dir") or ""
+    return response
+
+
+def require_verified_auth(home: Path, config: dict[str, Any]) -> str:
+    token = require_token(config)
+    if config.get("auth_verified_at") and config.get("user_hash") and config.get("local_user_hash"):
+        return token
+
+    try:
+        verify_cli_auth(home, config, token)
+        save_config(home, config)
+        return token
+    except urllib.error.HTTPError as exc:
+        raise SystemExit(f"CLI auth is not verified: {describe_http_error(exc)}") from exc
+    except Exception as exc:
+        raise SystemExit(f"CLI auth is not verified. Run website auth again when the local server is available: {exc}") from exc
+
+
 def make_terminal_event(
     command: str,
     stdout: str,
@@ -263,6 +545,14 @@ def sync_events(home: Path, config: dict[str, Any], limit: int = 50, quiet: bool
         if not quiet:
             print("No CLI token saved. Events remain queued until python -m ai_memory_cli auth is configured.")
         return 0
+    if not (config.get("auth_verified_at") and config.get("user_hash")):
+        try:
+            verify_cli_auth(home, config, token)
+            save_config(home, config)
+        except Exception as exc:
+            if not quiet:
+                print(f"CLI auth is not verified yet. Events remain queued: {exc}")
+            return 0
     paths = sorted((home / "outbox").glob("*.json"))[:limit]
     if not paths:
         if not quiet:
@@ -276,12 +566,7 @@ def sync_events(home: Path, config: dict[str, Any], limit: int = 50, quiet: bool
 
     payload = {
         "events": events,
-        "client": {
-            "name": "ai-memory-cli",
-            "version": __version__,
-            "storage_home_hash": sha256_text(str(home)),
-            "hostname_hash": sha256_text(platform.node() or "unknown"),
-        },
+        "client": client_identity(home, config),
     }
     response = http_json("POST", f"{api_url(config)}/cli/events/terminal", payload, token)
     accepted = {item.get("event_hash") for item in response.get("events", []) if item.get("event_hash")}
@@ -296,6 +581,7 @@ def sync_events(home: Path, config: dict[str, Any], limit: int = 50, quiet: bool
 
 
 def capture_command(home: Path, config: dict[str, Any], command: str, include_excluded: bool, source: str) -> int:
+    require_verified_auth(home, config)
     workspace = Path(str(config.get("workspace_path") or ".")).expanduser()
     cwd = workspace if workspace.exists() else Path.cwd()
 
@@ -322,6 +608,10 @@ def capture_command(home: Path, config: dict[str, Any], command: str, include_ex
     if completed.stderr:
         print(completed.stderr, end="", file=sys.stderr)
 
+    if is_shell_not_found(completed.stdout or "", completed.stderr or "", completed.returncode):
+        print("ai-memory: skipped invalid command; nothing was stored.")
+        return completed.returncode
+
     event = make_terminal_event(
         command=command,
         stdout=completed.stdout or "",
@@ -336,6 +626,7 @@ def capture_command(home: Path, config: dict[str, Any], command: str, include_ex
     )
     created, event_path = store_event(home, event)
     state = "stored" if created else "deduped"
+    append_history(home, event, state)
     print(f"ai-memory: {state} terminal hash {event['event_hash'][:12]} at {event_path}")
 
     try:
@@ -368,17 +659,33 @@ def command_auth(args: argparse.Namespace) -> int:
     config = load_config(home)
     if args.api_url:
         config["api_url"] = args.api_url.rstrip("/")
-    config["token"] = args.token.strip()
-    config["token_hash"] = sha256_text(args.token.strip())
+
+    token = args.token.strip()
+    config["pending_token_hash"] = sha256_text(token)
+    try:
+        response = verify_cli_auth(home, config, token)
+    except urllib.error.HTTPError as exc:
+        save_config(home, config)
+        raise SystemExit(f"CLI auth failed: {describe_http_error(exc)}") from exc
+    except Exception as exc:
+        save_config(home, config)
+        raise SystemExit(f"CLI auth failed. Keep the local FastAPI server running and generate a fresh website token: {exc}") from exc
+
     config["authed_at"] = utc_now()
     save_config(home, config)
     print(f"Saved CLI auth in {config_path(home)}")
+    print(f"GitHub account: {response.get('github_user') or config.get('github_user') or '-'}")
+    print(f"Local user hash: {str(config.get('user_hash') or '')[:24]}...")
+    if response.get("account_storage_dir"):
+        print(f"Server account storage: {response['account_storage_dir']}")
+
+    if not args.no_agent:
+        ensure_agent_started_once(home, config)
 
     try:
-        health = http_json("GET", f"{api_url(config)}/health", None, None)
-        print(f"Connected to API: {health.get('service', api_url(config))}")
+        sync_events(home, config, quiet=True)
     except Exception as exc:
-        print(f"Auth saved. API check failed, sync will retry later: {exc}", file=sys.stderr)
+        print(f"Auth saved. Sync will retry later: {exc}", file=sys.stderr)
     return 0
 
 
@@ -395,7 +702,7 @@ def command_init(args: argparse.Namespace) -> int:
         config["workspace_path"] = args.workspace
     save_config(home, config)
 
-    token = require_token(config)
+    token = require_verified_auth(home, config)
     payload = {
         "project": config.get("project") or "memory-project",
         "repository": config.get("repository") or "",
@@ -408,7 +715,7 @@ def command_init(args: argparse.Namespace) -> int:
         print(f"Initialized project: {project.get('id', payload['project'])}")
     except Exception as exc:
         print(f"Project config saved locally. Server init will need retry: {exc}", file=sys.stderr)
-    print("Start terminal capture with: python -m ai_memory_cli watch")
+    print("Start terminal capture with: watch")
     return 0
 
 
@@ -421,7 +728,8 @@ def command_workspace_connect(args: argparse.Namespace) -> int:
         config["repository"] = args.repo
     save_config(home, config)
 
-    token = require_token(config)
+    token = require_verified_auth(home, config)
+    identity = client_identity(home, config)
     payload = {
         "payload": {
             "source": "ai-memory-cli",
@@ -431,6 +739,9 @@ def command_workspace_connect(args: argparse.Namespace) -> int:
             "editor": args.editor,
             "package_manager": args.package_manager,
             "cli_storage_home_hash": sha256_text(str(home)),
+            "local_user_hash": identity["local_user_hash"],
+            "user_hash": identity["user_hash"],
+            "github_user": identity["github_user"],
         }
     }
     response = http_json("POST", f"{api_url(config)}/workspace/connect", payload, token)
@@ -442,7 +753,8 @@ def command_workspace_connect(args: argparse.Namespace) -> int:
 def command_mcp_connect(args: argparse.Namespace) -> int:
     home = cli_home()
     config = load_config(home)
-    token = require_token(config)
+    token = require_verified_auth(home, config)
+    identity = client_identity(home, config)
     config["mcp_server"] = args.server
     save_config(home, config)
     payload = {
@@ -452,6 +764,9 @@ def command_mcp_connect(args: argparse.Namespace) -> int:
             "project": config.get("project") or "",
             "repository": config.get("repository") or "",
             "cli_storage_home_hash": sha256_text(str(home)),
+            "local_user_hash": identity["local_user_hash"],
+            "user_hash": identity["user_hash"],
+            "github_user": identity["github_user"],
         }
     }
     response = http_json("POST", f"{api_url(config)}/mcp/connect", payload, token)
@@ -463,7 +778,8 @@ def command_mcp_connect(args: argparse.Namespace) -> int:
 def command_chat_connect(args: argparse.Namespace) -> int:
     home = cli_home()
     config = load_config(home)
-    token = require_token(config)
+    token = require_verified_auth(home, config)
+    identity = client_identity(home, config)
     config["chat_provider"] = args.provider
     save_config(home, config)
     payload = {
@@ -473,6 +789,9 @@ def command_chat_connect(args: argparse.Namespace) -> int:
             "project": config.get("project") or "",
             "repository": config.get("repository") or "",
             "cli_storage_home_hash": sha256_text(str(home)),
+            "local_user_hash": identity["local_user_hash"],
+            "user_hash": identity["user_hash"],
+            "github_user": identity["github_user"],
         }
     }
     response = http_json("POST", f"{api_url(config)}/chat/connect", payload, token)
@@ -502,6 +821,13 @@ def command_watch(args: argparse.Namespace) -> int:
             break
         if not command:
             continue
+        cleaned_command = clean_watch_command(command)
+        if cleaned_command != command:
+            if not cleaned_command:
+                print("ai-memory: skipped pasted prompt without a command.")
+                continue
+            print(f"ai-memory: using command without pasted prompt: {cleaned_command}")
+            command = cleaned_command
         if command.lower() in {"exit", "quit"}:
             break
         capture_command(home, config, command, args.include_excluded, "watch")
@@ -511,6 +837,7 @@ def command_watch(args: argparse.Namespace) -> int:
 def command_history_import(args: argparse.Namespace) -> int:
     home = cli_home()
     config = load_config(home)
+    require_verified_auth(home, config)
     history_path = Path(args.path).expanduser() if args.path else detect_history_file()
     if not history_path or not history_path.exists():
         raise SystemExit("No shell history file found. Pass --path <history-file>.")
@@ -557,6 +884,229 @@ def command_sync(args: argparse.Namespace) -> int:
     return 0
 
 
+def command_agent_run(args: argparse.Namespace) -> int:
+    home = cli_home()
+    ensure_dirs(home)
+    interval = max(10, int(args.interval))
+    limit = max(1, int(args.limit))
+    state = {
+        "pid": os.getpid(),
+        "version": __version__,
+        "started_at": utc_now(),
+        "interval_seconds": interval,
+        "limit": limit,
+        "mode": "once" if args.once else "loop",
+    }
+    write_json(agent_state_path(home), state)
+    append_log(home, f"agent started pid={os.getpid()} interval={interval}s limit={limit}")
+
+    try:
+        while True:
+            config = load_config(home)
+            try:
+                synced = sync_events(home, config, limit=limit, quiet=True)
+                if synced:
+                    append_log(home, f"synced {synced} terminal event(s)")
+            except Exception as exc:
+                append_log(home, f"sync failed: {exc}")
+
+            if args.once:
+                break
+            time.sleep(interval)
+    finally:
+        state["stopped_at"] = utc_now()
+        write_json(agent_state_path(home), state)
+        append_log(home, "agent stopped")
+
+    return 0
+
+
+def command_agent_install(args: argparse.Namespace) -> int:
+    if os.name != "nt":
+        raise SystemExit("agent install currently supports Windows Task Scheduler only.")
+
+    home = cli_home()
+    config = load_config(home)
+    config["agent"] = {
+        "task_name": args.task_name,
+        "interval_seconds": args.interval,
+        "limit": args.limit,
+        "installed_at": utc_now(),
+    }
+    save_config(home, config)
+
+    if args.method in {"auto", "task"}:
+        python_executable = scheduler_python_executable(background=not args.console)
+        task_command = (
+            f'"{python_executable}" -m ai_memory_cli agent run '
+            f"--interval {int(args.interval)} --limit {int(args.limit)}"
+        )
+        result = subprocess.run(
+            [
+                "schtasks",
+                "/Create",
+                "/TN",
+                args.task_name,
+                "/SC",
+                "ONLOGON",
+                "/TR",
+                task_command,
+                "/F",
+            ],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+        )
+        if result.returncode == 0:
+            append_log(home, f"installed Windows scheduled task: {args.task_name}")
+            print(f"Installed startup agent task: {args.task_name}")
+            print("It starts when you log in. Start it now with:")
+            print("python -m ai_memory_cli agent start")
+            return 0
+
+        if args.method == "task":
+            raise SystemExit((result.stderr or result.stdout).strip())
+
+        print("Task Scheduler install failed; falling back to user Startup folder.")
+        print((result.stderr or result.stdout).strip())
+
+    script_path = write_windows_startup_script(int(args.interval), int(args.limit))
+    append_log(home, f"installed Windows startup script: {script_path}")
+    print(f"Installed startup agent script: {script_path}")
+    print("It starts when you log in. Start it now with:")
+    print("python -m ai_memory_cli agent run")
+    return 0
+
+
+def command_agent_uninstall(args: argparse.Namespace) -> int:
+    if os.name != "nt":
+        raise SystemExit("agent uninstall currently supports Windows Task Scheduler only.")
+
+    removed = False
+    result = subprocess.run(
+        ["schtasks", "/Delete", "/TN", args.task_name, "/F"],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode == 0:
+        removed = True
+
+    script_path = windows_startup_script_path()
+    if script_path.exists():
+        script_path.unlink()
+        removed = True
+
+    append_log(cli_home(), f"uninstalled Windows scheduled task: {args.task_name}")
+    if removed:
+        print("Removed startup agent registration.")
+    else:
+        print("No startup agent registration was found.")
+    return 0
+
+
+def command_agent_start(args: argparse.Namespace) -> int:
+    if os.name != "nt":
+        raise SystemExit("agent start currently supports Windows Task Scheduler only.")
+
+    home = cli_home()
+    config = load_config(home)
+    state = read_json(agent_state_path(home), {})
+    if is_process_running(state.get("pid")):
+        print(f"Agent already running: pid={state.get('pid')}")
+        return 0
+
+    result = subprocess.run(
+        ["schtasks", "/Run", "/TN", args.task_name],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode == 0:
+        print(f"Started agent task: {args.task_name}")
+        return 0
+
+    agent_config = config.get("agent") if isinstance(config.get("agent"), dict) else {}
+    interval = int(agent_config.get("interval_seconds") or DEFAULT_AGENT_INTERVAL_SECONDS)
+    limit = int(agent_config.get("limit") or 50)
+    pid = start_detached_agent(interval, limit)
+    append_log(home, f"started detached agent pid={pid}")
+    print(f"Started detached agent process: pid={pid}")
+    return 0
+
+
+def command_agent_stop(args: argparse.Namespace) -> int:
+    if os.name != "nt":
+        raise SystemExit("agent stop currently supports Windows Task Scheduler only.")
+
+    home = cli_home()
+    result = subprocess.run(
+        ["schtasks", "/End", "/TN", args.task_name],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode == 0:
+        append_log(home, f"stopped Windows scheduled task: {args.task_name}")
+        print(f"Stopped agent task: {args.task_name}")
+        return 0
+
+    state = read_json(agent_state_path(home), {})
+    pid = state.get("pid")
+    if not pid:
+        print("No running detached agent pid was found.")
+        return 0
+
+    kill = subprocess.run(
+        ["taskkill", "/PID", str(pid), "/F"],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if kill.returncode != 0:
+        raise SystemExit((kill.stderr or kill.stdout).strip())
+    append_log(home, f"stopped detached agent pid={pid}")
+    print(f"Stopped detached agent process: pid={pid}")
+    return 0
+
+
+def command_agent_status(args: argparse.Namespace) -> int:
+    home = cli_home()
+    config = load_config(home)
+    state = read_json(agent_state_path(home), {})
+    print(f"Storage: {home}")
+    print(f"API: {api_url(config)}")
+    print(f"Token: {'saved' if config.get('token') else 'missing'}")
+    if state:
+        print(f"Agent state: pid={state.get('pid', '-')} started={state.get('started_at', '-')}")
+    else:
+        print("Agent state: no local agent state file yet")
+
+    if os.name != "nt":
+        return 0
+
+    result = subprocess.run(
+        ["schtasks", "/Query", "/TN", args.task_name, "/FO", "LIST", "/V"],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode != 0:
+        print(f"Windows task: not installed ({args.task_name})")
+    else:
+        print(result.stdout.strip())
+
+    script_path = windows_startup_script_path()
+    print(f"Startup script: {'installed' if script_path.exists() else 'not installed'} ({script_path})")
+    return 0
+
+
 def command_status(_: argparse.Namespace) -> int:
     home = cli_home()
     config = load_config(home)
@@ -570,7 +1120,9 @@ def command_status(_: argparse.Namespace) -> int:
     print(f"Project: {config.get('project') or '-'}")
     print(f"Repository: {config.get('repository') or '-'}")
     print(f"Workspace: {config.get('workspace_path') or '.'}")
-    print(f"Token: {'saved' if config.get('token') else 'missing'}")
+    print(f"Token: {'verified' if config.get('auth_verified_at') and config.get('user_hash') else 'saved' if config.get('token') else 'missing'}")
+    print(f"GitHub account: {config.get('github_user') or '-'}")
+    print(f"User hash: {str(config.get('user_hash') or '-')[:24]}{'...' if config.get('user_hash') else ''}")
     print(f"Events: {event_count} total, {outbox_count} queued, {sent_count} synced receipts")
     return 0
 
@@ -600,6 +1152,7 @@ def build_parser() -> argparse.ArgumentParser:
     auth = subparsers.add_parser("auth", help="Save the app-issued CLI token.")
     auth.add_argument("--token", required=True, help="Token generated by the website.")
     auth.add_argument("--api-url", default=DEFAULT_API_URL, help="FastAPI base URL.")
+    auth.add_argument("--no-agent", action="store_true", help="Do not auto-start the background sync agent after auth.")
     auth.set_defaults(func=command_auth)
 
     init = subparsers.add_parser("init", help="Save project config and call /projects/init.")
@@ -638,6 +1191,7 @@ def build_parser() -> argparse.ArgumentParser:
 
     watch = subparsers.add_parser("watch", help="Start a managed terminal that captures commands and output.")
     watch.add_argument("--include-excluded", action="store_true")
+    watch.add_argument("--version", action="version", version=f"ai-memory {__version__}")
     watch.set_defaults(func=command_watch)
 
     history = subparsers.add_parser("history", help="History import commands.")
@@ -652,6 +1206,39 @@ def build_parser() -> argparse.ArgumentParser:
     sync.add_argument("--limit", type=int, default=50)
     sync.set_defaults(func=command_sync)
 
+    agent = subparsers.add_parser("agent", help="Background sync agent commands.")
+    agent_subparsers = agent.add_subparsers(dest="agent_command", required=True)
+
+    agent_run = agent_subparsers.add_parser("run", help="Run the background sync loop.")
+    agent_run.add_argument("--interval", type=int, default=DEFAULT_AGENT_INTERVAL_SECONDS)
+    agent_run.add_argument("--limit", type=int, default=50)
+    agent_run.add_argument("--once", action="store_true")
+    agent_run.set_defaults(func=command_agent_run)
+
+    agent_install = agent_subparsers.add_parser("install", help="Install Windows startup task for the sync agent.")
+    agent_install.add_argument("--interval", type=int, default=DEFAULT_AGENT_INTERVAL_SECONDS)
+    agent_install.add_argument("--limit", type=int, default=50)
+    agent_install.add_argument("--task-name", default=WINDOWS_AGENT_TASK_NAME)
+    agent_install.add_argument("--method", choices=["auto", "task", "startup"], default="auto")
+    agent_install.add_argument("--console", action="store_true", help="Use python.exe instead of pythonw.exe for the scheduled task.")
+    agent_install.set_defaults(func=command_agent_install)
+
+    agent_uninstall = agent_subparsers.add_parser("uninstall", help="Remove Windows startup task for the sync agent.")
+    agent_uninstall.add_argument("--task-name", default=WINDOWS_AGENT_TASK_NAME)
+    agent_uninstall.set_defaults(func=command_agent_uninstall)
+
+    agent_start = agent_subparsers.add_parser("start", help="Start the installed Windows agent task now.")
+    agent_start.add_argument("--task-name", default=WINDOWS_AGENT_TASK_NAME)
+    agent_start.set_defaults(func=command_agent_start)
+
+    agent_stop = agent_subparsers.add_parser("stop", help="Stop the installed Windows agent task.")
+    agent_stop.add_argument("--task-name", default=WINDOWS_AGENT_TASK_NAME)
+    agent_stop.set_defaults(func=command_agent_stop)
+
+    agent_status = agent_subparsers.add_parser("status", help="Show background agent and Windows task state.")
+    agent_status.add_argument("--task-name", default=WINDOWS_AGENT_TASK_NAME)
+    agent_status.set_defaults(func=command_agent_status)
+
     status = subparsers.add_parser("status", help="Show local CLI state.")
     status.set_defaults(func=command_status)
 
@@ -669,3 +1256,15 @@ def main(argv: list[str] | None = None) -> int:
     except KeyboardInterrupt:
         print("Interrupted.", file=sys.stderr)
         return 130
+
+
+def watch_main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(prog="watch", description="Start AI Memory terminal capture.")
+    parser.add_argument("--include-excluded", action="store_true")
+    parser.add_argument("--version", action="version", version=f"ai-memory {__version__}")
+    args = parser.parse_args(argv)
+    try:
+        return command_watch(args)
+    except KeyboardInterrupt:
+        print("Interrupted.", file=sys.stderr)
+        return 130

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6/src/ai_memory_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ai-memory-cli
-Version: 0.1.1
+Version: 0.1.6
 Summary: Python CLI for AI Memory terminal capture and offline sync.
 Author: AI Memory
 License-Expression: MIT
@@ -50,15 +50,49 @@ python -m pip install -e .
 python -m ai_memory_cli auth --token TOKEN_FROM_WEBSITE --api-url https://api.your-domain.com
 python -m ai_memory_cli init --project my-project --repo owner/repo --workspace .
 python -m ai_memory_cli workspace connect --path . --repo owner/repo --editor vscode --package-manager pip
-python -m ai_memory_cli watch
+watch
 ```
 
+The `auth` command verifies the website-issued token with FastAPI before it is saved locally. After verification,
+the CLI stores a SHA-512 user hash for this computer, binds the token to that hash on the server, and starts the
+background sync agent once on Windows.
+
+`watch` is a shortcut for `python -m ai_memory_cli watch`. If Windows Device Guard blocks the generated launcher, keep using `python -m ai_memory_cli watch`.
+On Windows the shortcut is installed as `watch.cmd`; the Python Scripts folder must be on `PATH` for bare `watch` to resolve.
+
 Use `python -m ai_memory_cli run -- COMMAND` when you only want to record one command.
 
 On Windows, `python -m ai_memory_cli ...` is the safest form because it avoids PATH issues and Device Guard policies that can block pip's generated `ai-memory.exe` launcher. Also avoid angle bracket placeholders in CMD because they are treated as file redirection.
 
 Inside `watch`, type the real command you want to capture, for example `python --version`. Do not type `python -m ai_memory_cli run -- ...` inside `watch`, or you will capture the nested CLI command too.
 
+## Background agent
+
+After `auth`, the background agent starts once and is installed in the Windows Startup folder so queued terminal
+hashes keep syncing whenever the API is reachable. Use these commands when you need manual control:
+
+```powershell
+python -m ai_memory_cli agent status
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent start
+```
+
+The agent does not secretly capture every terminal on the computer. Commands are captured when they run through:
+
+```powershell
+python -m ai_memory_cli watch
+python -m ai_memory_cli run -- python --version
+```
+
+To remove the startup task:
+
+```powershell
+python -m ai_memory_cli agent stop
+python -m ai_memory_cli agent uninstall
+```
+
+Agent logs are written to `%USERPROFILE%\.ai-memory-cli\logs\agent.log`.
+
 ## Storage
 
 The CLI stores config and unsynced events in a separate folder:
@@ -68,6 +102,15 @@ The CLI stores config and unsynced events in a separate folder:
 
 Set `AI_MEMORY_CLI_HOME` to override this location.
 
+Accepted command observations are also written as plain daily hash logs:
+
+- Windows: `%USERPROFILE%\.ai-memory-cli\history\YYYY-MM-DD.log`
+- macOS/Linux: `~/.ai-memory-cli/history/YYYY-MM-DD.log`
+
+These files include time/date, event hash, command hash, output hash, source, exit code, and working-folder name. They do not store raw command text or raw output.
+
+If a command is clearly invalid, such as a pasted prompt (`ai-memory> python --version`) or a shell "not recognized" error, the CLI skips storing it as an event.
+
 ## Privacy and dedupe
 
 The CLI does not send raw commands or raw output to the backend. It sends:

{ai_memory_cli-0.1.1 → ai_memory_cli-0.1.6}/src/ai_memory_cli.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 LICENSE
 README.md
 pyproject.toml
+bin/watch.cmd
 src/ai_memory_cli/__init__.py
 src/ai_memory_cli/__main__.py
 src/ai_memory_cli/cli.py