engraphis 0.8.8__tar.gz → 0.9.2__tar.gz

{engraphis-0.8.8/engraphis.egg-info → engraphis-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engraphis
-Version: 0.8.8
+Version: 0.9.2
 Summary: Local-first AI memory engine for agents — Ebbinghaus decay, interaction-aware recall, bi-temporal facts, hybrid retrieval, and an MCP server. You bring the LLM.
 Author: The Engraphis Authors
 License: Apache-2.0
@@ -67,10 +67,15 @@ Requires-Dist: sqlcipher3-binary>=0.5.0; extra == "test"
 Dynamic: license-file
 
 # Engraphis
-https://engraphis.com/
 
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](https://github.com/Coding-Dev-Tools/engraphis)
+[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://github.com/Coding-Dev-Tools/engraphis/blob/main/LICENSE)
 [![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-support-yellow?style=for-the-badge&logo=buy-me-a-coffee)](https://buymeacoffee.com/Jaixii)
 
+https://engraphis.com/
+
+https://discord.com/invite/Wfr2ejBmY
+
 **Give your AI agents a memory. See it, search it, and watch it self-maintain — all in a beautiful WebUI on your own machine.**
 
 <br>
@@ -95,14 +100,14 @@ engraphis-dashboard
 Opens `http://127.0.0.1:8700` in your browser. No cloud, no signup, no API key for memory.
 Everything lives in a single SQLite file on your machine.
 
-**You'll see the full product** — a dark-themed, sidebar-navigated dashboard with 12 tabs:
+**You'll see the full product** — a dark-themed (with multiple theme options in left sidebar), sidebar-navigated dashboard with 12 tabs:
 
 | Tab | What you see |
 |-----|-------------|
 | **Overview** | Live memory counts, memory-type mix, and a health summary at a glance |
 | **Analytics** *(Pro)* | Growth, retention distribution, decay forecast, resolver mix, and top entities — plus a one-click shareable HTML report and a cross-workspace portfolio view |
 | **Recall** | Hybrid search across the memory bank — each result shows its score breakdown (retention, semantic, lexical, graph, importance, recency) |
-| **Memories** | Browse and curate every memory by workspace — click into a full reader with type and retention pills |
+| **Memories** | Browse and curate every memory by workspace — click into a full reader with type and retention pills, drag-to-reorder, inline title/type edits |
 | **Proactive** | "What should I know right now" — importance × recency × retention, plus the last session handoff |
 | **Why** | The current answer to a question, and the facts it superseded |
 | **Timeline** | Bi-temporal history of a topic — what was believed, and when |
@@ -110,9 +115,9 @@ Everything lives in a single SQLite file on your machine.
 | **Knowledge Graph** | Interactive force-directed graph of entities and their relationships — click any node to see every linked memory |
 | **Consolidate** | Run a consolidation sweep on demand — see what got distilled and what got pruned |
 | **Automation** *(Pro)* | Scheduled consolidation + retention policies that keep the store clean on autopilot (dashboard config, plus `scripts/auto_maintain` for cron / Task Scheduler) |
-| **Workspaces** | Manage workspace isolation boundaries — switch the active workspace, browse, and organize memory |
-| **Team** | Multi-user access with admin / member / viewer roles (Team) |
-| **Settings** | License activation (Pro/Team), appearance, and engine/store info |
+| **Workspaces** | Create, rename, describe, copy, merge, and delete workspaces; import files & folders; drag-and-drop upload |
+| **Team** | Multi-user access with PBKDF2 logins, password reset, admin / member / viewer roles, seat management, and team audit log (Team) |
+| **Settings** | License activation (Pro/Team), cloud sync, appearance, and engine/store info |
 
 The dashboard is powered by the v2 engine — the same `MemoryService` that backs the MCP server
 and the Python library. What you see in the UI is what your agents get.
@@ -124,6 +129,7 @@ and the Python library. What you see in the UI is what your agents get.
 | **Windows** | Double-click **Engraphis Dashboard** on your Desktop or Start Menu (install: `engraphis-dashboard --install-shortcuts`) |
 | **macOS** | Double-click **Engraphis Dashboard.app** on your Desktop (install: same command) |
 | **Linux** | Desktop entry in Applications → Development (GNOME/KDE/etc.) |
+| **Docker** | `docker compose up` — see `docker-compose.yml` for the one-command deployment |
 | **Any** | `engraphis-dashboard` in a terminal |
 
 ### Accessibility-first inspection, built in
@@ -159,6 +165,9 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 - **Code-aware** — AST-powered symbol graph: `engraphis_index_repo` → `engraphis_search_code`.
 - **Sleep-time consolidation** — scheduled job distills recurring episodes, reports its compaction.
 - **Scoped** — `workspace → repo → session` hierarchy.
+- **Encryption at rest** — optional SQLCipher (AES-256) whole-database encryption via `ENGRAPHIS_DB_KEY`. No plaintext fallback when a key is set.
+- **Cloud sync** — cross-device and cross-team memory sync with deterministic CRDT merge (folder transport for self-hosting, managed relay for zero-setup). One-click "Sync now" or automatic cadence in the dashboard.
+- **Import & ingest** — drag-and-drop file upload, server-side folder import, and LLM-powered fact extraction from raw text.
 
 ---
 
@@ -172,6 +181,8 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 | Bi-temporal graph | partial | ✓ | **✓** |
 | Native multi-repo model | ✗ | ✗ | **✓ (unique)** |
 | Code-aware (AST/symbol graph) | ✗ | ✗ | **✓ (unique)** |
+| Cloud sync (CRDT merge) | ✗ | ✗ | **✓ (deterministic, no conflict copies)** |
+| Encryption at rest | ✗ | ✗ | **✓ (SQLCipher)** |
 | MCP-native for coding agents | ✓ | ✗ | **✓** |
 
 ---
@@ -179,10 +190,11 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 ## Install
 
 ```bash
-pip install "engraphis[all]"    # dashboard + MCP server + code graph + everything
-pip install "engraphis[server]" # dashboard + REST API
-pip install "engraphis[mcp]"    # MCP server only
-pip install engraphis           # core library — numpy only, fully offline
+pip install "engraphis[all]"        # dashboard + MCP server + code graph + encryption + everything
+pip install "engraphis[server]"     # dashboard + REST API
+pip install "engraphis[mcp]"        # MCP server only
+pip install "engraphis[encryption]" # SQLCipher encryption-at-rest extra
+pip install engraphis               # core library — numpy only, fully offline
 ```
 
 > First run downloads `all-MiniLM-L6-v2` (~80 MB). Without it, the engine falls back
@@ -198,6 +210,16 @@ engraphis-dashboard                   # → http://127.0.0.1:8700
 engraphis-dashboard --install-shortcuts   # → Desktop + Start Menu icons
 ```
 
+### Docker
+
+```bash
+docker compose up                     # → http://127.0.0.1:8700
+```
+
+The default entrypoint is `engraphis-dashboard --no-open`. Set `ENGRAPHIS_API_TOKEN` to require
+authentication, `ENGRAPHIS_DB_KEY` to encrypt the database at rest, and `ENGRAPHIS_LICENSE_KEY`
+to unlock Pro/Team features. See `docker-compose.yml` for all options.
+
 ---
 
 ## Quickstart — MCP server (for coding agents)
@@ -232,22 +254,27 @@ The same `MemoryService` backs the dashboard and the MCP server.
 ## Free forever vs. Pro
 
 The engine, dashboard, MCP server, and governance tools are free and Apache-2.0,
-permanently. A license key (verified **offline** — no phone-home) unlocks the paid layer.
-**Pro is $10/mo ($100/yr), Team is $20/seat/mo ($200/seat/yr)** — and you can unlock every
-Pro feature with a **3-day free trial right in the dashboard** (Settings → License), no key
-and no card.
+permanently. A license key unlocks the paid layer — **verified offline** (no phone-home)
+for self-hosted keys, or **cloud-enforced** (machine-bound lease, revocable) for
+commercial deployments. **Pro is $10/mo ($100/yr), Team is $20/seat/mo ($200/seat/yr)** —
+and you can unlock every Pro feature with a **3-day free trial right in the dashboard**
+(Settings → License), no key and no card.
 
 | | Free (available now) | Pro — $10/mo or $100/yr | Team — $20/seat/mo or $200/seat/yr |
 |---|---|---|---|
 | Dashboard WebUI (with built-in inspector) | ✓ | ✓ | ✓ |
 | Memory engine + 18 MCP tools | ✓ | ✓ | ✓ |
 | Version-chain diffs, offline knowledge graph | ✓ | ✓ | ✓ |
+| Cloud sync (folder + managed relay) | | ✓ | ✓ |
+| Auto-sync (hands-off cadence) | | ✓ | ✓ |
 | Analytics: growth, retention, decay forecast + entities | | ✓ | ✓ |
 | Analytics HTML report (self-contained, shareable) | | ✓ | ✓ |
 | Automated maintenance: scheduled consolidation + retention policies | | ✓ | ✓ |
 | Signed compliance export (checksummed bi-temporal bundle) | | ✓ | ✓ |
 | Priority support | | ✓ | ✓ |
 | Multi-user dashboard: logins, roles, seat management | | | ✓ |
+| Team audit log + CSV export | | | ✓ |
+| Team invite emails (vendor relay, zero email setup) | | | ✓ |
 
 ---
 
@@ -258,6 +285,8 @@ and no card.
 | Write | `engraphis_remember` | Store a fact; deterministically resolved (add/reinforce/supersede) |
 | Write | `engraphis_record_event` | Append a lightweight episodic log entry |
 | Write | `engraphis_link` | Explicitly connect two related memories |
+| Write | `engraphis_ingest` | Store raw text; Engraphis extracts the discrete facts worth keeping |
+| Write | `engraphis_consolidate` | Run one sleep-time consolidation sweep: distill recurring episodes |
 | Read | `engraphis_recall` | Hybrid vector + lexical + graph recall |
 | Read | `engraphis_recall_grounded` | Cited answer from retrieved memories — or abstain |
 | Read | `engraphis_recall_proactive` | "What should I know right now" — no query needed |
@@ -273,6 +302,58 @@ and no card.
 
 ---
 
+## Cloud sync
+
+Cloud sync keeps your memory store consistent across all your machines — and, on the Team
+tier, across a group — without giving up local-first ownership. It ships two transports:
+
+- **Folder transport** — any shared directory (Dropbox, iCloud, Syncthing, a git repo, a
+  mounted drive). Zero infrastructure.
+- **Managed relay** — HTTPS against the Engraphis relay, authenticated by your license key.
+  One-click in the dashboard or `python -m scripts.sync --relay`.
+
+Sync is a **state-based CRDT**: deterministic merge, no conflict copies, no data loss.
+Every field resolves by a commutative, idempotent rule so `merge(A, B) == merge(B, A)`.
+See [`docs/SYNC.md`](docs/SYNC.md) for architecture, security model, and CLI usage.
+
+---
+
+## Encryption at rest
+
+Set `ENGRAPHIS_DB_KEY` (or `ENGRAPHIS_DB_KEY_FILE`) and install the extra:
+
+```bash
+pip install "engraphis[encryption]"
+```
+
+The entire database file is transparently encrypted with AES-256 via SQLCipher — full-text
+search, the graph, and every query keep working unchanged. When a key is set, Engraphis
+**fails loud** rather than silently falling back to plaintext. Generate a strong key:
+
+```bash
+python -c "import secrets; print(secrets.token_hex(32))"
+```
+
+> An existing plaintext database cannot be opened with a key — migrate it (dump → import
+> into a fresh keyed DB). See `.env.example` for all encryption options.
+
+---
+
+## Import files & folders
+
+Drag-and-drop or server-side import, both member-gated and bounded:
+
+- **Dashboard upload** — the Workspaces tab's "Import files & folders" section accepts files
+  directly from the browser.
+- **Server-side folder import** — `MemoryService.import_folder()` reads a directory on the
+  machine running Engraphis, one memory per file, with path-traversal guards.
+- **MCP ingest** — `engraphis_ingest` accepts raw text and extracts discrete facts
+  (when `ENGRAPHIS_EXTRACTOR=llm` is configured; otherwise stores verbatim).
+
+All imported memories are marked **untrusted** by default.
+
+---
+
 ## Configuration
 
 All via environment (or `.env`):
@@ -283,12 +364,24 @@ All via environment (or `.env`):
 | `ENGRAPHIS_HOST` | `127.0.0.1` | Server bind address |
 | `ENGRAPHIS_PORT` | `8700` | Dashboard port |
 | `ENGRAPHIS_API_TOKEN` | — | If set, REST API requires `Authorization: Bearer <token>` |
+| `ENGRAPHIS_DB_KEY` | — | Encrypt the database at rest (SQLCipher). Or use `ENGRAPHIS_DB_KEY_FILE` |
 | `ENGRAPHIS_EMBED_MODEL` | `all-MiniLM-L6-v2` | sentence-transformers model |
-| `ENGRAPHIS_LLM_PROVIDER` | `openai` | `openai \| anthropic \| google \| openrouter` |
-| `ENGRAPHIS_LLM_API_KEY` | — | LLM API key (only for chat/synthesis) |
+| `ENGRAPHIS_EXTRACTOR` | `none` | `none` = store verbatim; `llm` = extract facts via LLM before storing |
+| `ENGRAPHIS_GRAPH_EXTRACTOR` | `regex` | `regex` = dependency-free NER (offline); `none` = disable graph population |
+| `ENGRAPHIS_LLM_PROVIDER` | `openai` | `openai \| anthropic \| google \| openrouter \| custom` |
+| `ENGRAPHIS_LLM_MODEL` | `gpt-4o-mini` | Model name (provider-specific) |
+| `ENGRAPHIS_LLM_API_KEY` | — | LLM API key (only for chat/synthesis and `extractor=llm`) |
+| `ENGRAPHIS_LLM_BASE_URL` | — | Base URL for openrouter / custom OpenAI-compatible endpoints |
 | `ENGRAPHIS_LICENSE_KEY` | — | Pro/Team key (or `~/.engraphis/license.key`) |
+| `ENGRAPHIS_TEAM_MODE` | — | Set `1` to enable per-user logins + roles |
+| `ENGRAPHIS_LOOP_INTERVAL` | `60` | Background consolidation loop interval in seconds (0 = disabled) |
+| `ENGRAPHIS_DECAY_HALFLIFE_DAYS` | `7` | Ebbinghaus decay half-life (higher = memories persist longer) |
+| `ENGRAPHIS_FORWARDED_ALLOW_IPS` | `127.0.0.1` | Trusted reverse-proxy IPs for TLS termination (`*` = trust all) |
+| `ENGRAPHIS_RELAY_URL` | built-in | Managed sync relay URL (Pro/Team) |
+| `ENGRAPHIS_AUTOSYNC_LOOP` | `1` | Kill switch for the in-process auto-sync loop (0 = off) |
 
-See `.env.example` for the full list.
+See `.env.example` for the full list including commercial/vendor, email delivery, and
+cloud-license enforcement options.
 
 ---
 
@@ -297,16 +390,22 @@ See `.env.example` for the full list.
 ```
 engraphis/
 ├── engraphis/
-│   ├── core/                # v2 engine — interfaces, store, recall, scoring, schema
-│   ├── backends/            # pluggable embedder / vector index / reranker / codegraph
+│   ├── core/                # v2 engine — interfaces, store, recall, scoring, schema, sync
+│   ├── backends/            # pluggable embedder / vector index / reranker / codegraph / sync transports / encryption
 │   ├── service.py           # validated MemoryService facade
 │   ├── mcp_server.py        # MCP server — 18 tools
 │   ├── dashboard_app.py     # dashboard WebUI (FastAPI)
+│   ├── autosync.py          # background auto-sync loop (Pro/Team)
+│   ├── licensing.py         # license verification (offline + cloud)
+│   ├── analytics.py         # Pro analytics engine
+│   ├── automation.py        # scheduled maintenance policies (Pro)
+│   ├── billing.py           # Polar webhook fulfillment
 │   ├── config.py / app.py   # env settings / REST server
 │   └── static/              # dashboard frontend
 ├── eval/                    # offline retrieval eval harness + datasets
-├── tests/                   # pytest suite (offline, numpy-only core)
-├── scripts/                 # start_dashboard, inspector, cli, init, consolidate
+├── tests/                   # pytest suite (300+ tests, offline numpy-only core)
+├── scripts/                 # start_dashboard, inspector, cli, init, consolidate, sync
+├── docs/                    # SYNC.md, KILO_CODE_INTEGRATION.md
 ├── Dockerfile / docker-compose.yml
 └── pyproject.toml
 ```

{engraphis-0.8.8 → engraphis-0.9.2}/README.md

@@ -1,8 +1,13 @@
 # Engraphis
-https://engraphis.com/
 
+[![Version](https://img.shields.io/badge/version-0.9.0-blue.svg)](https://github.com/Coding-Dev-Tools/engraphis)
+[![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://github.com/Coding-Dev-Tools/engraphis/blob/main/LICENSE)
 [![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-support-yellow?style=for-the-badge&logo=buy-me-a-coffee)](https://buymeacoffee.com/Jaixii)
 
+https://engraphis.com/
+
+https://discord.com/invite/Wfr2ejBmY
+
 **Give your AI agents a memory. See it, search it, and watch it self-maintain — all in a beautiful WebUI on your own machine.**
 
 <br>
@@ -27,14 +32,14 @@ engraphis-dashboard
 Opens `http://127.0.0.1:8700` in your browser. No cloud, no signup, no API key for memory.
 Everything lives in a single SQLite file on your machine.
 
-**You'll see the full product** — a dark-themed, sidebar-navigated dashboard with 12 tabs:
+**You'll see the full product** — a dark-themed (with multiple theme options in left sidebar), sidebar-navigated dashboard with 12 tabs:
 
 | Tab | What you see |
 |-----|-------------|
 | **Overview** | Live memory counts, memory-type mix, and a health summary at a glance |
 | **Analytics** *(Pro)* | Growth, retention distribution, decay forecast, resolver mix, and top entities — plus a one-click shareable HTML report and a cross-workspace portfolio view |
 | **Recall** | Hybrid search across the memory bank — each result shows its score breakdown (retention, semantic, lexical, graph, importance, recency) |
-| **Memories** | Browse and curate every memory by workspace — click into a full reader with type and retention pills |
+| **Memories** | Browse and curate every memory by workspace — click into a full reader with type and retention pills, drag-to-reorder, inline title/type edits |
 | **Proactive** | "What should I know right now" — importance × recency × retention, plus the last session handoff |
 | **Why** | The current answer to a question, and the facts it superseded |
 | **Timeline** | Bi-temporal history of a topic — what was believed, and when |
@@ -42,9 +47,9 @@ Everything lives in a single SQLite file on your machine.
 | **Knowledge Graph** | Interactive force-directed graph of entities and their relationships — click any node to see every linked memory |
 | **Consolidate** | Run a consolidation sweep on demand — see what got distilled and what got pruned |
 | **Automation** *(Pro)* | Scheduled consolidation + retention policies that keep the store clean on autopilot (dashboard config, plus `scripts/auto_maintain` for cron / Task Scheduler) |
-| **Workspaces** | Manage workspace isolation boundaries — switch the active workspace, browse, and organize memory |
-| **Team** | Multi-user access with admin / member / viewer roles (Team) |
-| **Settings** | License activation (Pro/Team), appearance, and engine/store info |
+| **Workspaces** | Create, rename, describe, copy, merge, and delete workspaces; import files & folders; drag-and-drop upload |
+| **Team** | Multi-user access with PBKDF2 logins, password reset, admin / member / viewer roles, seat management, and team audit log (Team) |
+| **Settings** | License activation (Pro/Team), cloud sync, appearance, and engine/store info |
 
 The dashboard is powered by the v2 engine — the same `MemoryService` that backs the MCP server
 and the Python library. What you see in the UI is what your agents get.
@@ -56,6 +61,7 @@ and the Python library. What you see in the UI is what your agents get.
 | **Windows** | Double-click **Engraphis Dashboard** on your Desktop or Start Menu (install: `engraphis-dashboard --install-shortcuts`) |
 | **macOS** | Double-click **Engraphis Dashboard.app** on your Desktop (install: same command) |
 | **Linux** | Desktop entry in Applications → Development (GNOME/KDE/etc.) |
+| **Docker** | `docker compose up` — see `docker-compose.yml` for the one-command deployment |
 | **Any** | `engraphis-dashboard` in a terminal |
 
 ### Accessibility-first inspection, built in
@@ -91,6 +97,9 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 - **Code-aware** — AST-powered symbol graph: `engraphis_index_repo` → `engraphis_search_code`.
 - **Sleep-time consolidation** — scheduled job distills recurring episodes, reports its compaction.
 - **Scoped** — `workspace → repo → session` hierarchy.
+- **Encryption at rest** — optional SQLCipher (AES-256) whole-database encryption via `ENGRAPHIS_DB_KEY`. No plaintext fallback when a key is set.
+- **Cloud sync** — cross-device and cross-team memory sync with deterministic CRDT merge (folder transport for self-hosting, managed relay for zero-setup). One-click "Sync now" or automatic cadence in the dashboard.
+- **Import & ingest** — drag-and-drop file upload, server-side folder import, and LLM-powered fact extraction from raw text.
 
 ---
 
@@ -104,6 +113,8 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 | Bi-temporal graph | partial | ✓ | **✓** |
 | Native multi-repo model | ✗ | ✗ | **✓ (unique)** |
 | Code-aware (AST/symbol graph) | ✗ | ✗ | **✓ (unique)** |
+| Cloud sync (CRDT merge) | ✗ | ✗ | **✓ (deterministic, no conflict copies)** |
+| Encryption at rest | ✗ | ✗ | **✓ (SQLCipher)** |
 | MCP-native for coding agents | ✓ | ✗ | **✓** |
 
 ---
@@ -111,10 +122,11 @@ embeddings. You bring the LLM only for optional chat/synthesis.
 ## Install
 
 ```bash
-pip install "engraphis[all]"    # dashboard + MCP server + code graph + everything
-pip install "engraphis[server]" # dashboard + REST API
-pip install "engraphis[mcp]"    # MCP server only
-pip install engraphis           # core library — numpy only, fully offline
+pip install "engraphis[all]"        # dashboard + MCP server + code graph + encryption + everything
+pip install "engraphis[server]"     # dashboard + REST API
+pip install "engraphis[mcp]"        # MCP server only
+pip install "engraphis[encryption]" # SQLCipher encryption-at-rest extra
+pip install engraphis               # core library — numpy only, fully offline
 ```
 
 > First run downloads `all-MiniLM-L6-v2` (~80 MB). Without it, the engine falls back
@@ -130,6 +142,16 @@ engraphis-dashboard                   # → http://127.0.0.1:8700
 engraphis-dashboard --install-shortcuts   # → Desktop + Start Menu icons
 ```
 
+### Docker
+
+```bash
+docker compose up                     # → http://127.0.0.1:8700
+```
+
+The default entrypoint is `engraphis-dashboard --no-open`. Set `ENGRAPHIS_API_TOKEN` to require
+authentication, `ENGRAPHIS_DB_KEY` to encrypt the database at rest, and `ENGRAPHIS_LICENSE_KEY`
+to unlock Pro/Team features. See `docker-compose.yml` for all options.
+
 ---
 
 ## Quickstart — MCP server (for coding agents)
@@ -164,22 +186,27 @@ The same `MemoryService` backs the dashboard and the MCP server.
 ## Free forever vs. Pro
 
 The engine, dashboard, MCP server, and governance tools are free and Apache-2.0,
-permanently. A license key (verified **offline** — no phone-home) unlocks the paid layer.
-**Pro is $10/mo ($100/yr), Team is $20/seat/mo ($200/seat/yr)** — and you can unlock every
-Pro feature with a **3-day free trial right in the dashboard** (Settings → License), no key
-and no card.
+permanently. A license key unlocks the paid layer — **verified offline** (no phone-home)
+for self-hosted keys, or **cloud-enforced** (machine-bound lease, revocable) for
+commercial deployments. **Pro is $10/mo ($100/yr), Team is $20/seat/mo ($200/seat/yr)** —
+and you can unlock every Pro feature with a **3-day free trial right in the dashboard**
+(Settings → License), no key and no card.
 
 | | Free (available now) | Pro — $10/mo or $100/yr | Team — $20/seat/mo or $200/seat/yr |
 |---|---|---|---|
 | Dashboard WebUI (with built-in inspector) | ✓ | ✓ | ✓ |
 | Memory engine + 18 MCP tools | ✓ | ✓ | ✓ |
 | Version-chain diffs, offline knowledge graph | ✓ | ✓ | ✓ |
+| Cloud sync (folder + managed relay) | | ✓ | ✓ |
+| Auto-sync (hands-off cadence) | | ✓ | ✓ |
 | Analytics: growth, retention, decay forecast + entities | | ✓ | ✓ |
 | Analytics HTML report (self-contained, shareable) | | ✓ | ✓ |
 | Automated maintenance: scheduled consolidation + retention policies | | ✓ | ✓ |
 | Signed compliance export (checksummed bi-temporal bundle) | | ✓ | ✓ |
 | Priority support | | ✓ | ✓ |
 | Multi-user dashboard: logins, roles, seat management | | | ✓ |
+| Team audit log + CSV export | | | ✓ |
+| Team invite emails (vendor relay, zero email setup) | | | ✓ |
 
 ---
 
@@ -190,6 +217,8 @@ and no card.
 | Write | `engraphis_remember` | Store a fact; deterministically resolved (add/reinforce/supersede) |
 | Write | `engraphis_record_event` | Append a lightweight episodic log entry |
 | Write | `engraphis_link` | Explicitly connect two related memories |
+| Write | `engraphis_ingest` | Store raw text; Engraphis extracts the discrete facts worth keeping |
+| Write | `engraphis_consolidate` | Run one sleep-time consolidation sweep: distill recurring episodes |
 | Read | `engraphis_recall` | Hybrid vector + lexical + graph recall |
 | Read | `engraphis_recall_grounded` | Cited answer from retrieved memories — or abstain |
 | Read | `engraphis_recall_proactive` | "What should I know right now" — no query needed |
@@ -205,6 +234,58 @@ and no card.
 
 ---
 
+## Cloud sync
+
+Cloud sync keeps your memory store consistent across all your machines — and, on the Team
+tier, across a group — without giving up local-first ownership. It ships two transports:
+
+- **Folder transport** — any shared directory (Dropbox, iCloud, Syncthing, a git repo, a
+  mounted drive). Zero infrastructure.
+- **Managed relay** — HTTPS against the Engraphis relay, authenticated by your license key.
+  One-click in the dashboard or `python -m scripts.sync --relay`.
+
+Sync is a **state-based CRDT**: deterministic merge, no conflict copies, no data loss.
+Every field resolves by a commutative, idempotent rule so `merge(A, B) == merge(B, A)`.
+See [`docs/SYNC.md`](docs/SYNC.md) for architecture, security model, and CLI usage.
+
+---
+
+## Encryption at rest
+
+Set `ENGRAPHIS_DB_KEY` (or `ENGRAPHIS_DB_KEY_FILE`) and install the extra:
+
+```bash
+pip install "engraphis[encryption]"
+```
+
+The entire database file is transparently encrypted with AES-256 via SQLCipher — full-text
+search, the graph, and every query keep working unchanged. When a key is set, Engraphis
+**fails loud** rather than silently falling back to plaintext. Generate a strong key:
+
+```bash
+python -c "import secrets; print(secrets.token_hex(32))"
+```
+
+> An existing plaintext database cannot be opened with a key — migrate it (dump → import
+> into a fresh keyed DB). See `.env.example` for all encryption options.
+
+---
+
+## Import files & folders
+
+Drag-and-drop or server-side import, both member-gated and bounded:
+
+- **Dashboard upload** — the Workspaces tab's "Import files & folders" section accepts files
+  directly from the browser.
+- **Server-side folder import** — `MemoryService.import_folder()` reads a directory on the
+  machine running Engraphis, one memory per file, with path-traversal guards.
+- **MCP ingest** — `engraphis_ingest` accepts raw text and extracts discrete facts
+  (when `ENGRAPHIS_EXTRACTOR=llm` is configured; otherwise stores verbatim).
+
+All imported memories are marked **untrusted** by default.
+
+---
+
 ## Configuration
 
 All via environment (or `.env`):
@@ -215,12 +296,24 @@ All via environment (or `.env`):
 | `ENGRAPHIS_HOST` | `127.0.0.1` | Server bind address |
 | `ENGRAPHIS_PORT` | `8700` | Dashboard port |
 | `ENGRAPHIS_API_TOKEN` | — | If set, REST API requires `Authorization: Bearer <token>` |
+| `ENGRAPHIS_DB_KEY` | — | Encrypt the database at rest (SQLCipher). Or use `ENGRAPHIS_DB_KEY_FILE` |
 | `ENGRAPHIS_EMBED_MODEL` | `all-MiniLM-L6-v2` | sentence-transformers model |
-| `ENGRAPHIS_LLM_PROVIDER` | `openai` | `openai \| anthropic \| google \| openrouter` |
-| `ENGRAPHIS_LLM_API_KEY` | — | LLM API key (only for chat/synthesis) |
+| `ENGRAPHIS_EXTRACTOR` | `none` | `none` = store verbatim; `llm` = extract facts via LLM before storing |
+| `ENGRAPHIS_GRAPH_EXTRACTOR` | `regex` | `regex` = dependency-free NER (offline); `none` = disable graph population |
+| `ENGRAPHIS_LLM_PROVIDER` | `openai` | `openai \| anthropic \| google \| openrouter \| custom` |
+| `ENGRAPHIS_LLM_MODEL` | `gpt-4o-mini` | Model name (provider-specific) |
+| `ENGRAPHIS_LLM_API_KEY` | — | LLM API key (only for chat/synthesis and `extractor=llm`) |
+| `ENGRAPHIS_LLM_BASE_URL` | — | Base URL for openrouter / custom OpenAI-compatible endpoints |
 | `ENGRAPHIS_LICENSE_KEY` | — | Pro/Team key (or `~/.engraphis/license.key`) |
+| `ENGRAPHIS_TEAM_MODE` | — | Set `1` to enable per-user logins + roles |
+| `ENGRAPHIS_LOOP_INTERVAL` | `60` | Background consolidation loop interval in seconds (0 = disabled) |
+| `ENGRAPHIS_DECAY_HALFLIFE_DAYS` | `7` | Ebbinghaus decay half-life (higher = memories persist longer) |
+| `ENGRAPHIS_FORWARDED_ALLOW_IPS` | `127.0.0.1` | Trusted reverse-proxy IPs for TLS termination (`*` = trust all) |
+| `ENGRAPHIS_RELAY_URL` | built-in | Managed sync relay URL (Pro/Team) |
+| `ENGRAPHIS_AUTOSYNC_LOOP` | `1` | Kill switch for the in-process auto-sync loop (0 = off) |
 
-See `.env.example` for the full list.
+See `.env.example` for the full list including commercial/vendor, email delivery, and
+cloud-license enforcement options.
 
 ---
 
@@ -229,16 +322,22 @@ See `.env.example` for the full list.
 ```
 engraphis/
 ├── engraphis/
-│   ├── core/                # v2 engine — interfaces, store, recall, scoring, schema
-│   ├── backends/            # pluggable embedder / vector index / reranker / codegraph
+│   ├── core/                # v2 engine — interfaces, store, recall, scoring, schema, sync
+│   ├── backends/            # pluggable embedder / vector index / reranker / codegraph / sync transports / encryption
 │   ├── service.py           # validated MemoryService facade
 │   ├── mcp_server.py        # MCP server — 18 tools
 │   ├── dashboard_app.py     # dashboard WebUI (FastAPI)
+│   ├── autosync.py          # background auto-sync loop (Pro/Team)
+│   ├── licensing.py         # license verification (offline + cloud)
+│   ├── analytics.py         # Pro analytics engine
+│   ├── automation.py        # scheduled maintenance policies (Pro)
+│   ├── billing.py           # Polar webhook fulfillment
 │   ├── config.py / app.py   # env settings / REST server
 │   └── static/              # dashboard frontend
 ├── eval/                    # offline retrieval eval harness + datasets
-├── tests/                   # pytest suite (offline, numpy-only core)
-├── scripts/                 # start_dashboard, inspector, cli, init, consolidate
+├── tests/                   # pytest suite (300+ tests, offline numpy-only core)
+├── scripts/                 # start_dashboard, inspector, cli, init, consolidate, sync
+├── docs/                    # SYNC.md, KILO_CODE_INTEGRATION.md
 ├── Dockerfile / docker-compose.yml
 └── pyproject.toml
 ```

{engraphis-0.8.8 → engraphis-0.9.2}/engraphis/cloud_license.py

@@ -194,7 +194,8 @@ _INVITE_TIMEOUT = 10.0
 
 
 def send_team_invite(base_url: str, key: str, to: str, name: str, role: str,
-                     invited_by: str, *, timeout: float = _INVITE_TIMEOUT) -> Tuple[bool, str]:
+                     invited_by: str, *, dashboard_url: str = "",
+                     timeout: float = _INVITE_TIMEOUT) -> Tuple[bool, str]:
     """POST a team-invite request to the vendor relay's ``/license/v1/team-invite``.
 
     Used by a self-hosted Team dashboard (``routes.v2_team.add_user``) that has no
@@ -209,7 +210,8 @@ def send_team_invite(base_url: str, key: str, to: str, name: str, role: str,
     """
     url = base_url.rstrip("/") + "/license/v1/team-invite"
     data = json.dumps({"key": key, "to": to, "name": name, "role": role,
-                       "invited_by": invited_by}).encode("utf-8")
+                       "invited_by": invited_by, "dashboard_url": dashboard_url}
+                      ).encode("utf-8")
     req = urllib.request.Request(
         url, data=data, method="POST", headers={"Content-Type": "application/json"})
     try:

{engraphis-0.8.8 → engraphis-0.9.2}/engraphis/core/sync.py

@@ -264,14 +264,50 @@ def _reject_nonfinite(token: str):
     raise ValueError("non-finite JSON constant: %s" % token)
 
 
+_MAX_BUNDLE_DEPTH = 200  # generous; real bundles are shallow. Explicit DoS guard so
+# deeply-nested input is rejected on every Python version (3.12+'s JSON scanner no
+# longer raises RecursionError for ~1000-deep input, so we can't rely on that alone).
+
+
+def _scan_depth(s: str) -> int:
+    """Cheap max-nesting-depth scan that skips JSON string literals; used to reject
+    pathologically deep bundles without relying on the JSON scanner's RecursionError."""
+    depth = 0
+    max_depth = 0
+    in_str = False
+    esc = False
+    for ch in s:
+        if in_str:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_str = False
+            continue
+        if ch == '"':
+            in_str = True
+        elif ch in "[{":
+            depth += 1
+            if depth > max_depth:
+                max_depth = depth
+        elif ch in "]}":
+            if depth > 0:
+                depth -= 1
+    return max_depth
+
+
 def loads_strict(data: bytes):
     """Parse untrusted bundle bytes, rejecting the non-standard ``Infinity``/``NaN``
     tokens Python's ``json`` accepts by default (they later raise ``OverflowError`` in
     ``int()`` and would otherwise abort the whole sync run). Deeply-nested input that
     would raise ``RecursionError`` in the JSON scanner is normalized to ``ValueError``
     so a single hostile bundle can't crash the whole sync run (DoS)."""
+    text = data.decode("utf-8")
+    if _scan_depth(text) > _MAX_BUNDLE_DEPTH:
+        raise ValueError("bundle JSON is nested too deeply")
     try:
-        return json.loads(data.decode("utf-8"), parse_constant=_reject_nonfinite)
+        return json.loads(text, parse_constant=_reject_nonfinite)
     except RecursionError:
         raise ValueError("bundle JSON is nested too deeply")
 

{engraphis-0.8.8 → engraphis-0.9.2}/engraphis/dashboard_app.py

@@ -111,6 +111,13 @@ def create_app() -> FastAPI:
 
     @app.middleware("http")
     async def _auth_gate(request: Request, call_next):
+        from engraphis.service import set_current_user
+        # Clear any user bound to this context before we decide who (if anyone) is calling,
+        # so a personal-folder check can never inherit a stale identity from a prior request
+        # served on the same worker context. The team branch below rebinds the real user;
+        # public paths, the bearer bypass, and single-user mode all leave it cleared, which
+        # is exactly "no per-user restriction".
+        set_current_user(None)
         path = request.url.path
         if not path.startswith("/api/") or path in _PUBLIC or path.startswith("/api/docs") \
                 or path.startswith("/api/openapi"):
@@ -132,6 +139,9 @@ def create_app() -> FastAPI:
                 return JSONResponse({"error": "requires the %s role" % need},
                                     status_code=403)
             request.state.user = user
+            # Bind the identity the service reads to enforce personal-folder ownership on
+            # every workspace-scoped read/write (see MemoryService._authorize_workspace).
+            set_current_user(user)
             return await call_next(request)
         # Single-user modes: optional bearer token, exactly as before team mode existed.
         if settings.api_token and not _bearer_ok(request):

{engraphis-0.8.8 → engraphis-0.9.2}/engraphis/inspector/license_cloud.py

@@ -314,6 +314,7 @@ async def team_invite(request: Request):
     name = (body.get("name") or "").strip()[:120]
     role = (body.get("role") or "member").strip()[:32]
     invited_by = (body.get("invited_by") or "").strip().lower()
+    dashboard_url = (body.get("dashboard_url") or "").strip()[:2048]
 
     lic = reg.verify_for_feature(key, "team")          # bad/expired/wrong-plan/revoked → 402
     if not _EMAIL_RE.match(to):
@@ -330,7 +331,12 @@ async def team_invite(request: Request):
 
     from engraphis.inspector.webhooks import send_team_invite_email
     try:
-        await asyncio.to_thread(send_team_invite_email, to, name, role, invited_by=invited_by)
+        # Echo the just-verified Team key into the email so the relay-delivered invite
+        # also carries Pro activation (the key is this account's shared team key — the
+        # same one the caller already proved they hold). dashboard_url is forwarded from
+        # the admin (empty => "ask your admin"), never the relay host's own env value.
+        await asyncio.to_thread(send_team_invite_email, to, name, role,
+                                invited_by=invited_by, key=key, dashboard_url=dashboard_url)
     except Exception as exc:  # noqa: BLE001 — surface a safe message, don't leak internals
         return JSONResponse({"error": "delivery failed: %s" % exc}, status_code=502)
     return {"sent": True}