memgit 0.10.0__tar.gz → 0.11.0__tar.gz

{memgit-0.10.0 → memgit-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgit
-Version: 0.10.0
+Version: 0.11.0
 Summary: Git for AI memory — version-controlled context persistence across Claude, GPT, Gemini, Cursor, Windsurf, and more
 License: MIT
 Project-URL: Homepage, https://memgit.dev
@@ -21,7 +21,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0
 Requires-Dist: rich>=13.0
-Requires-Dist: mcp<2,>=1.0.0
+Requires-Dist: mcp<2,>=1.28.1
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-anyio>=0.0.0; extra == "dev"
@@ -475,6 +475,65 @@ memgit thread list / switch / create
 
 ---
 
+## What memgit reads from your environment
+
+memgit runs inside your agent, so the honest answer to "what does this process
+read from my environment?" should be checkable rather than a promise. The table
+below is generated from [`memgit/env.py`](memgit/env.py), and
+`tests/test_env_inventory.py` walks the package on every test run and fails if
+the code reads a name this list does not carry — or carries a name nothing
+reads. The list cannot drift away from the code.
+
+memgit reads these and nothing else. It writes none of them. None of them turn
+network access on: the cloud endpoints are overrides for a sync you have already
+opted into with `memgit cloud login`, and with no licence and no cloud login,
+memgit talks to nothing.
+
+| | Variable | What memgit does with it |
+|---|---|---|
+| Store and state | `MEMGIT_STORE` | Absolute path to the memory store. When set it is the ONLY candidate — an explicit store never silently falls back to another one. |
+|  | `MEMGIT_HOME` | Base directory for memgit's per-person state, currently the licence file (default ~/.memgit, mode 0600). |
+|  | `MEMGIT_PROJECT` | Forces the project label instead of detecting it from the working directory. |
+| Attribution | `MEMGIT_AUTHOR` | Explicit author stamped on checkpoints, for multi-agent jobs where several writers share one machine account. Wins over MEMGIT_CLIENT. |
+|  | `MEMGIT_CLIENT` | The host that launched this process (claude-code, cursor, ...), stamped into checkpoints so a memory says where it came from. |
+|  | `USER` | Fallback author name when neither MEMGIT_AUTHOR nor MEMGIT_CLIENT is set. |
+|  | `USERNAME` | Windows fallback for USER. |
+| Licensing (memgit Pro) | `MEMGIT_LICENSE_KEY` | memgit Pro licence key. Never printed in full — `memgit pro status` shows the last four characters. |
+|  | `MEMGIT_POLAR_API` | Overrides the licence-validation API base URL (testing). |
+|  | `MEMGIT_POLAR_ORG_ID` | Overrides the Polar organisation the licence is checked against. |
+| Cloud sync | `MEMGIT_CLOUD_API` | Overrides the memgit cloud API base URL. |
+|  | `MEMGIT_CLOUD_APP` | Overrides the memgit cloud web app base URL used in printed links. |
+|  | `MEMGIT_CLOUD_NO_CACHE` | Set to 1/true/yes to keep decrypted keys out of credentials.json; the passphrase is then re-prompted per command. |
+| Tuning | `MEMGIT_LOCK_TIMEOUT` | Seconds a writer waits for the store lock before giving up (default 10). |
+|  | `MEMGIT_IDLE_EVICT_SECONDS` | Idle seconds before the MCP server drops its in-memory caches while staying connected (default 900). |
+|  | `MEMGIT_HOUSEKEEPING_INTERVAL` | Seconds between the MCP server's housekeeping passes. |
+| Set by other software | `CLAUDE_PROJECT_DIR` | Set by Claude Code for hook processes; used as one input to project detection when the working directory is not the project root. |
+|  | `PYTEST_CURRENT_TEST` | Set by pytest. Its presence suppresses automatic backups, so a test run never writes into a real backup location. |
+
+### How the project label is decided
+
+Memories are project-scoped, so a wrong label files a memory where you will not
+find it again. The label comes from the first of these that yields one, and
+there is exactly one detection path shared by the MCP server, the CLI and the
+hooks — so a label derived at save time and one derived at recall time cannot
+disagree:
+
+1. `MEMGIT_PROJECT` — a forced label, taken verbatim
+2. the `cwd` a host reports in its hook payload (the real workspace, even when
+   the process working directory is elsewhere)
+3. `CLAUDE_PROJECT_DIR`
+4. the process working directory
+
+When none of them yields a label — running from `$HOME`, for instance — a write
+is **quarantined** under `_unknown` rather than filed globally, and
+`memgit doctor --relabel` moves it once you say where it belongs. Folding a
+free-text label onto an existing project (`log-report` → `Downloads-log-report`)
+happens only when the input is a trailing segment of exactly one known label and
+that label already holds memories; anything ambiguous is left alone, and every
+fold is reported rather than done silently.
+
+---
+
 ## TOON format — compact, readable, diffable
 
 Standard markdown memory file:

{memgit-0.10.0 → memgit-0.11.0}/README.md

@@ -441,6 +441,65 @@ memgit thread list / switch / create
 
 ---
 
+## What memgit reads from your environment
+
+memgit runs inside your agent, so the honest answer to "what does this process
+read from my environment?" should be checkable rather than a promise. The table
+below is generated from [`memgit/env.py`](memgit/env.py), and
+`tests/test_env_inventory.py` walks the package on every test run and fails if
+the code reads a name this list does not carry — or carries a name nothing
+reads. The list cannot drift away from the code.
+
+memgit reads these and nothing else. It writes none of them. None of them turn
+network access on: the cloud endpoints are overrides for a sync you have already
+opted into with `memgit cloud login`, and with no licence and no cloud login,
+memgit talks to nothing.
+
+| | Variable | What memgit does with it |
+|---|---|---|
+| Store and state | `MEMGIT_STORE` | Absolute path to the memory store. When set it is the ONLY candidate — an explicit store never silently falls back to another one. |
+|  | `MEMGIT_HOME` | Base directory for memgit's per-person state, currently the licence file (default ~/.memgit, mode 0600). |
+|  | `MEMGIT_PROJECT` | Forces the project label instead of detecting it from the working directory. |
+| Attribution | `MEMGIT_AUTHOR` | Explicit author stamped on checkpoints, for multi-agent jobs where several writers share one machine account. Wins over MEMGIT_CLIENT. |
+|  | `MEMGIT_CLIENT` | The host that launched this process (claude-code, cursor, ...), stamped into checkpoints so a memory says where it came from. |
+|  | `USER` | Fallback author name when neither MEMGIT_AUTHOR nor MEMGIT_CLIENT is set. |
+|  | `USERNAME` | Windows fallback for USER. |
+| Licensing (memgit Pro) | `MEMGIT_LICENSE_KEY` | memgit Pro licence key. Never printed in full — `memgit pro status` shows the last four characters. |
+|  | `MEMGIT_POLAR_API` | Overrides the licence-validation API base URL (testing). |
+|  | `MEMGIT_POLAR_ORG_ID` | Overrides the Polar organisation the licence is checked against. |
+| Cloud sync | `MEMGIT_CLOUD_API` | Overrides the memgit cloud API base URL. |
+|  | `MEMGIT_CLOUD_APP` | Overrides the memgit cloud web app base URL used in printed links. |
+|  | `MEMGIT_CLOUD_NO_CACHE` | Set to 1/true/yes to keep decrypted keys out of credentials.json; the passphrase is then re-prompted per command. |
+| Tuning | `MEMGIT_LOCK_TIMEOUT` | Seconds a writer waits for the store lock before giving up (default 10). |
+|  | `MEMGIT_IDLE_EVICT_SECONDS` | Idle seconds before the MCP server drops its in-memory caches while staying connected (default 900). |
+|  | `MEMGIT_HOUSEKEEPING_INTERVAL` | Seconds between the MCP server's housekeeping passes. |
+| Set by other software | `CLAUDE_PROJECT_DIR` | Set by Claude Code for hook processes; used as one input to project detection when the working directory is not the project root. |
+|  | `PYTEST_CURRENT_TEST` | Set by pytest. Its presence suppresses automatic backups, so a test run never writes into a real backup location. |
+
+### How the project label is decided
+
+Memories are project-scoped, so a wrong label files a memory where you will not
+find it again. The label comes from the first of these that yields one, and
+there is exactly one detection path shared by the MCP server, the CLI and the
+hooks — so a label derived at save time and one derived at recall time cannot
+disagree:
+
+1. `MEMGIT_PROJECT` — a forced label, taken verbatim
+2. the `cwd` a host reports in its hook payload (the real workspace, even when
+   the process working directory is elsewhere)
+3. `CLAUDE_PROJECT_DIR`
+4. the process working directory
+
+When none of them yields a label — running from `$HOME`, for instance — a write
+is **quarantined** under `_unknown` rather than filed globally, and
+`memgit doctor --relabel` moves it once you say where it belongs. Folding a
+free-text label onto an existing project (`log-report` → `Downloads-log-report`)
+happens only when the input is a trailing segment of exactly one known label and
+that label already holds memories; anything ambiguous is left alone, and every
+fold is reported rather than done silently.
+
+---
+
 ## TOON format — compact, readable, diffable
 
 Standard markdown memory file:

{memgit-0.10.0 → memgit-0.11.0}/memgit/__init__.py

@@ -1,3 +1,3 @@
 """memgit — git for AI memory."""
 
-__version__ = "0.10.0"
+__version__ = "0.11.0"

{memgit-0.10.0 → memgit-0.11.0}/memgit/cli.py

@@ -118,11 +118,18 @@ def init(directory):
 
     # Step-by-step flow: find existing memories automatically and offer the
     # import, instead of making the user discover the right path themselves.
+    # Narrow on purpose: an unreadable ~/.claude tree (OSError) or a memory file
+    # that will not parse (ValueError, which UnicodeDecodeError subclasses) is a
+    # reason to skip the offer, not to abort `init`. Anything else is a bug in
+    # the importer and must reach the user rather than being swallowed here.
     try:
         from .importer import from_claude_code
         found = from_claude_code()
-    except Exception:
+    except (OSError, ValueError) as exc:
         found = []
+        console.print(f'[dim]Could not scan ~/.claude/projects for existing '
+                      f'memories ({exc.__class__.__name__}: {exc}) — skipping '
+                      f'the import offer.[/dim]')
     if found:
         projects = {m.project for m in found if m.project}
         console.print(f'\nFound [bold]{len(found)}[/bold] existing Claude Code memories '
@@ -2686,6 +2693,13 @@ def git_init(remote):
 
     Then teammates run `memgit git pull` to get your memories.
     """
+    if remote:
+        from .repo import validate_git_remote
+        bad = validate_git_remote(remote)
+        if bad:
+            err.print(f'[red]{bad}[/red]')
+            raise SystemExit(1)
+
     repo = _require_repo()
     ok = repo.git_init()
     if not ok:

{memgit-0.10.0 → memgit-0.11.0}/memgit/cloud/commands.py

@@ -136,7 +136,12 @@ def cloud():
 @cloud.command()
 @click.option('--email', prompt=True)
 def signup(email):
-    """Create a memgit cloud account (30-day free trial)."""
+    """Create a memgit cloud account (free trial; the server sets the length).
+
+    The trial length is stamped by the server at signup and printed below, so this
+    help text does not hardcode it. It said "30-day" while the deployed server granted
+    14, which is a promise broken on day 15 for every reader of --help.
+    """
     _require_extra()
     from . import crypto
     from nacl import utils
@@ -345,13 +350,41 @@ def _report(res, direction):
     console.print(f'[green]{icons.get(res.action, "·")}[/green] {direction}: {res.action}{detail}{head}')
 
 
+def _guard_uncommitted(repo, thread: str, allow: bool) -> None:
+    """Refuse to transmit while staged memories are not in a checkpoint.
+
+    Sync ships CHECKPOINTS. `memgit add` stages a memory but does not create
+    one, so pushing straight after `add` uploads nothing of the user's — and
+    said "created (2 objects up)" while doing it, with the receiving machine
+    reporting a clean, empty, fsck-OK store (measured 2026-09-06). Nothing in
+    that sequence errored, which is why it reads as "sync is broken" rather
+    than "you have not committed". An error naming the fix is the whole point;
+    `--allow-uncommitted` is there for anyone who means it.
+    """
+    if allow:
+        return
+    pending = repo.uncommitted_slugs(thread)
+    if not pending:
+        return
+    shown = ', '.join(pending[:5]) + (f' and {len(pending) - 5} more' if len(pending) > 5 else '')
+    console.print(
+        f'[red]✗[/red] {len(pending)} memor{"y is" if len(pending) == 1 else "ies are"} '
+        f'not committed, and sync only ships committed memory: [bold]{shown}[/bold]')
+    console.print('  [dim]commit them first:  memgit commit -m "what changed"[/dim]')
+    console.print('  [dim]or push the committed state anyway:  --allow-uncommitted[/dim]')
+    sys.exit(1)
+
+
 @cloud.command()
 @click.option('--thread', default=None, help='thread to push (default: current)')
-def push(thread):
+@click.option('--allow-uncommitted', is_flag=True,
+              help='Push committed state even though staged memories would not be sent')
+def push(thread, allow_uncommitted):
     """Encrypt and upload local checkpoints, then advance the remote ref."""
     repo, cstate, api = _ctx()
     engine = _linked(repo, cstate, api)
     th = thread or repo.current_thread()
+    _guard_uncommitted(repo, th, allow_uncommitted)
     res = _run(lambda: engine.push(th), 'push')
     _report(res, f'push {th}')
 
@@ -369,11 +402,17 @@ def pull(thread):
 
 @cloud.command('sync')
 @click.option('--thread', default=None, help='thread to sync (default: current)')
-def cloud_sync(thread):
+@click.option('--allow-uncommitted', is_flag=True,
+              help='Sync committed state even though staged memories would not be sent')
+def cloud_sync(thread, allow_uncommitted):
     """Pull then push — the everyday command."""
     repo, cstate, api = _ctx()
     engine = _linked(repo, cstate, api)
     th = thread or repo.current_thread()
+    # Guarded before the pull as well as the push: sync is the command users
+    # reach for, and finding out after a merge that half of it was a no-op is
+    # worse than being told up front which memories are not committed yet.
+    _guard_uncommitted(repo, th, allow_uncommitted)
     pulled, pushed = _run(lambda: engine.sync(th), 'sync')
     _report(pulled, f'pull {th}')
     _report(pushed, f'push {th}')

memgit-0.11.0/memgit/env.py

@@ -0,0 +1,88 @@
+"""Every environment variable memgit reads, in one place.
+
+A memory tool runs inside someone else's agent, so "what does this process read
+from my environment?" deserves an answer that is checkable rather than a claim
+in a README. This module is that answer, and `tests/test_env_inventory.py`
+walks the package's AST on every test run and fails if the code reads a name
+that is not listed here, or if a name listed here is read nowhere — so the
+inventory cannot drift away from the code the way documentation does.
+
+memgit reads these and nothing else. It writes none of them, and it never reads
+an environment variable to decide whether to send data anywhere: the cloud
+endpoints below are overrides for a sync the user has already opted into by
+running `memgit cloud login`.
+"""
+
+from __future__ import annotations
+
+#: name -> what memgit does with it. Keep the description to one line.
+KNOWN_ENV_VARS: dict[str, str] = {
+    # ── where the store and memgit's own state live ──────────────────────────
+    'MEMGIT_STORE': (
+        'Absolute path to the memory store. When set it is the ONLY candidate '
+        '— an explicit store never silently falls back to another one.'
+    ),
+    'MEMGIT_HOME': (
+        "Base directory for memgit's per-person state, currently the licence "
+        'file (default ~/.memgit, mode 0600).'
+    ),
+    'MEMGIT_PROJECT': (
+        'Forces the project label instead of detecting it from the working '
+        'directory.'
+    ),
+
+    # ── attribution ──────────────────────────────────────────────────────────
+    'MEMGIT_AUTHOR': (
+        'Explicit author stamped on checkpoints, for multi-agent jobs where '
+        'several writers share one machine account. Wins over MEMGIT_CLIENT.'
+    ),
+    'MEMGIT_CLIENT': (
+        'The host that launched this process (claude-code, cursor, ...), '
+        'stamped into checkpoints so a memory says where it came from.'
+    ),
+    'USER': 'Fallback author name when neither MEMGIT_AUTHOR nor MEMGIT_CLIENT is set.',
+    'USERNAME': 'Windows fallback for USER.',
+
+    # ── licensing (memgit Pro) ───────────────────────────────────────────────
+    'MEMGIT_LICENSE_KEY': (
+        'memgit Pro licence key. Never printed in full — `memgit pro status` '
+        'shows the last four characters.'
+    ),
+    'MEMGIT_POLAR_API': 'Overrides the licence-validation API base URL (testing).',
+    'MEMGIT_POLAR_ORG_ID': 'Overrides the Polar organisation the licence is checked against.',
+
+    # ── cloud sync (only used after `memgit cloud login`) ────────────────────
+    'MEMGIT_CLOUD_API': 'Overrides the memgit cloud API base URL.',
+    'MEMGIT_CLOUD_APP': 'Overrides the memgit cloud web app base URL used in printed links.',
+    'MEMGIT_CLOUD_NO_CACHE': (
+        'Set to 1/true/yes to keep decrypted keys out of credentials.json; the '
+        'passphrase is then re-prompted per command.'
+    ),
+
+    # ── tuning ───────────────────────────────────────────────────────────────
+    'MEMGIT_LOCK_TIMEOUT': 'Seconds a writer waits for the store lock before giving up (default 10).',
+    'MEMGIT_IDLE_EVICT_SECONDS': (
+        'Idle seconds before the MCP server drops its in-memory caches while '
+        'staying connected (default 900).'
+    ),
+    'MEMGIT_HOUSEKEEPING_INTERVAL': 'Seconds between the MCP server\'s housekeeping passes.',
+
+    # ── set by other software, read but never written by memgit ─────────────
+    'CLAUDE_PROJECT_DIR': (
+        'Set by Claude Code for hook processes; used as one input to project '
+        'detection when the working directory is not the project root.'
+    ),
+    'PYTEST_CURRENT_TEST': (
+        'Set by pytest. Its presence suppresses automatic backups, so a test '
+        'run never writes into a real backup location.'
+    ),
+}
+
+
+def render_table() -> str:
+    """The inventory as plain aligned text, for `--help` output or a README."""
+    width = max(len(name) for name in KNOWN_ENV_VARS)
+    return '\n'.join(
+        f'{name.ljust(width)}  {purpose}'
+        for name, purpose in sorted(KNOWN_ENV_VARS.items())
+    )

{memgit-0.10.0 → memgit-0.11.0}/memgit/mcp_server.py

@@ -230,7 +230,7 @@ def _require_compatible_sdk() -> None:
     sys.stderr.write(
         f"memgit: the installed MCP SDK (mcp {found}) is not compatible with "
         f"this version of memgit — it no longer provides Server.list_tools.\n"
-        f"memgit needs mcp 1.x. Fix with:  pip install 'mcp>=1.0.0,<2'\n"
+        f"memgit needs mcp 1.x. Fix with:  pip install 'mcp>=1.28.1,<2'\n"
         f"(If you installed through npx memgit-mcp, delete "
         f"~/.memgit-npm-venv and run it again.)\n")
     raise SystemExit(1)

{memgit-0.10.0 → memgit-0.11.0}/memgit/repo.py

@@ -18,6 +18,77 @@ from .models import (
 from .store import ObjectStore, object_cache as _object_cache
 
 
+# ── git argument safety ───────────────────────────────────────────────────────
+#
+# `git_push` / `git_pull` / `memgit git init --remote` hand their `remote` and
+# `branch` straight to `subprocess.run(['git', ...])`. No shell is involved, so
+# there is nothing to quote — but argv is not inert either:
+#
+#   * git reads any argument starting with '-' as an OPTION, not as a
+#     positional. That is how a remote name becomes `--upload-pack=<cmd>` or
+#     `--receive-pack=<cmd>`, both of which are commands git then runs.
+#   * a remote URL using the `ext::` transport IS a command line by definition —
+#     git-remote-ext executes it. `fd::` is the same class.
+#   * a newline in a branch name splits config and refspec parsing downstream.
+#
+# The values arrive from a CLI argument, a teammate's checked-in config or an
+# MCP caller, so they are checked before they become argv. These return an error
+# STRING rather than raising: every caller here already reports (ok, message).
+
+_GIT_REMOTE_DENY_SCHEMES = ('ext::', 'fd::')
+
+#: git check-ref-format, restricted to what a branch name may never contain.
+_BRANCH_FORBIDDEN_CHARS = set(' \t~^:?*[\\')
+
+
+def validate_git_remote(remote: str) -> Optional[str]:
+    """Error message if `remote` is unsafe to pass to git as a remote, else None.
+
+    Accepts both a remote NAME (`origin`) and a URL, because git's positional
+    accepts either. Rejects option-shaped values and the transports whose URL is
+    an executable command.
+    """
+    if not isinstance(remote, str) or not remote.strip():
+        return 'Refusing git remote: empty'
+    if remote.startswith('-'):
+        return (f'Refusing git remote {remote!r}: a leading "-" makes git read '
+                f'it as an option, not a remote')
+    if any(c in remote for c in ('\n', '\r', '\0')):
+        return f'Refusing git remote {remote!r}: contains a control character'
+    lowered = remote.lower()
+    for scheme in _GIT_REMOTE_DENY_SCHEMES:
+        if lowered.startswith(scheme):
+            return (f'Refusing git remote {remote!r}: the "{scheme}" transport '
+                    f'runs its URL as a command')
+    return None
+
+
+def validate_git_branch(branch: str) -> Optional[str]:
+    """Error message if `branch` is not a valid, safe branch name, else None.
+
+    A subset of `git check-ref-format --branch`, applied without shelling out to
+    git so the refusal happens before any process is spawned.
+    """
+    if not isinstance(branch, str) or not branch.strip():
+        return 'Refusing git branch: empty'
+    if branch.startswith('-'):
+        return (f'Refusing git branch {branch!r}: a leading "-" makes git read '
+                f'it as an option, not a branch')
+    if any(c in branch for c in _BRANCH_FORBIDDEN_CHARS):
+        return f'Refusing git branch {branch!r}: contains a character git forbids'
+    if any(ord(c) < 0x20 or ord(c) == 0x7F for c in branch):
+        return f'Refusing git branch {branch!r}: contains a control character'
+    if '..' in branch or '@{' in branch:
+        return f'Refusing git branch {branch!r}: contains ".." or "@{{"'
+    if branch == '@' or branch.endswith('.lock') or branch.endswith('/'):
+        return f'Refusing git branch {branch!r}: not a valid ref name'
+    if branch.startswith('/') or branch.startswith('.') or branch.endswith('.'):
+        return f'Refusing git branch {branch!r}: not a valid ref name'
+    if '//' in branch:
+        return f'Refusing git branch {branch!r}: not a valid ref name'
+    return None
+
+
 def default_store_candidates() -> list[Path]:
     """Well-known store locations, in the same order `memgit init` auto-detects.
 
@@ -67,26 +138,82 @@ class Repository:
         return self.path / 'memgit.lock'
 
     def _try_break_stale_lock(self):
-        """Remove the lockfile if its owner is gone or it has aged out."""
+        """Remove the lockfile only when its owner is provably gone, or it aged out.
+
+        🔴 An EMPTY lockfile is a lock being BORN, never an abandoned one.
+        Acquisition is `os.open(O_CREAT|O_EXCL)` followed by `os.write` of the
+        owner token, and between those two calls the file exists with zero
+        bytes. The previous version read that empty file, computed `pid = 0`,
+        skipped the liveness check because `pid > 0` was false, and fell
+        through to `not pid_alive` — deleting a lock that was alive and about
+        to be used. The thread then acquired the same lock, and two writers ran
+        the read-modify-write of TOON_INDEX at once, so one memory was dropped
+        from both the index and HEAD's MindState with no error raised and a
+        clean fsck. Measured 2026-09-06: 3/120 runs lost a memory, and a
+        holder-counter saw max 3 concurrent holders with 5 exclusion
+        violations. Treating an unstamped lock as dead is the whole bug.
+        """
         lp = self._lock_path
         try:
             raw = lp.read_text().split()
-            pid = int(raw[0]) if raw else 0
             age = time.time() - lp.stat().st_mtime
         except (OSError, ValueError):
+            return  # vanished under us, or unreadable — not ours to break
+
+        aged_out = age > LOCK_STALE_SECONDS
+        if not raw:
+            # Unstamped: someone is between O_EXCL and the write. Only an
+            # aged-out lock this shape is genuinely abandoned (a crash in the
+            # window), and LOCK_STALE_SECONDS is long enough to be safe.
+            if aged_out:
+                self._unlink_lock_if(lp, expect=None)
             return
-        pid_alive = False
+
+        try:
+            pid = int(raw[0])
+        except ValueError:
+            if aged_out:
+                self._unlink_lock_if(lp, expect=None)
+            return
+
+        owner_dead = False
         if pid > 0:
             try:
                 os.kill(pid, 0)
-                pid_alive = True
-            except OSError:
-                pid_alive = False
-        if not pid_alive or age > LOCK_STALE_SECONDS:
-            try:
-                lp.unlink()
+            except ProcessLookupError:
+                owner_dead = True
             except OSError:
-                pass
+                owner_dead = False  # e.g. EPERM: alive, just not ours to signal
+        if owner_dead or aged_out:
+            self._unlink_lock_if(lp, expect=self._lock_token(raw))
+
+    @staticmethod
+    def _lock_token(raw: list[str]) -> str:
+        """The owner identity inside a lockfile: `pid uuid`, ignoring the timestamp.
+
+        The file is written as `pid uuid unixtime`. Comparing the WHOLE line
+        against a token is a bug that costs the lock its release: the token has
+        two fields, the file has three, so equality never held and every
+        acquisition leaked until it aged out.
+        """
+        return ' '.join(raw[:2])
+
+    @staticmethod
+    def _unlink_lock_if(lp: Path, expect: Optional[str]) -> None:
+        """Delete the lockfile only if it is still the one we judged.
+
+        Without this the breaker can delete a lock created by someone else in
+        the microseconds since it decided to break, and a releasing holder can
+        drop a lock that was taken over — either way turning one stale lock
+        into a live race.
+        """
+        try:
+            if expect is not None:
+                if Repository._lock_token(lp.read_text().split()) != expect:
+                    return
+            lp.unlink()
+        except OSError:
+            pass
 
     @contextmanager
     def _lock(self, timeout: float = None):
@@ -106,11 +233,17 @@ class Repository:
 
         timeout = LOCK_TIMEOUT_SECONDS if timeout is None else timeout
         deadline = time.monotonic() + timeout
+        # Token identifies THIS acquisition, not just this process: threads in
+        # one process share a pid, and release must never delete a lock that
+        # someone else has since taken.
+        token = f'{os.getpid()} {uuid.uuid4().hex}'
         while True:
             try:
                 fd = os.open(self._lock_path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)
-                os.write(fd, f'{os.getpid()} {time.time():.0f}\n'.encode())
-                os.close(fd)
+                try:
+                    os.write(fd, f'{token} {time.time():.0f}\n'.encode())
+                finally:
+                    os.close(fd)
                 break
             except FileExistsError:
                 self._try_break_stale_lock()
@@ -126,10 +259,10 @@ class Repository:
             yield
         finally:
             self._lock_depth = 0
-            try:
-                self._lock_path.unlink()
-            except OSError:
-                pass
+            # Only drop the lock if it is still OURS. If a breaker removed it
+            # and another writer acquired, unlinking here would release THEIR
+            # critical section and cascade the very race this lock prevents.
+            self._unlink_lock_if(self._lock_path, expect=token)
 
     # ── Discovery ─────────────────────────────────────────────────────────────
 
@@ -406,6 +539,22 @@ class Repository:
 
     # ── Commit ────────────────────────────────────────────────────────────────
 
+    def uncommitted_slugs(self, thread: Optional[str] = None) -> list[str]:
+        """Slugs staged in the index but not in the thread HEAD's MindState.
+
+        `add` writes a mnemonic and stages it; only `commit` puts it in a
+        checkpoint. Everything that leaves this machine — cloud push, git sync,
+        backup — ships CHECKPOINTS, so a staged-but-uncommitted memory is
+        invisible to all of them. Callers that are about to transmit state
+        should say so rather than reporting a successful no-op: measured
+        2026-09-06, `cloud push` answered "created (2 objects up)" while
+        shipping none of the user's memory, and the receiving machine then
+        reported a clean, empty, fsck-OK store.
+        """
+        index = self.get_index()
+        committed = self._mindstate_map(self.head_sha(thread))
+        return sorted(s for s, sha in index.items() if committed.get(s) != sha)
+
     def _mindstate_map(self, ck_sha: Optional[str]) -> dict[str, str]:
         """slug → mnem_sha map for a checkpoint's MindState ({} for None)."""
         if not ck_sha:
@@ -1385,6 +1534,10 @@ class Repository:
         except Exception:
             return None
 
+    def _check_git_args(self, remote: str, branch: str) -> Optional[str]:
+        """Error message if these git arguments are unsafe, else None."""
+        return validate_git_remote(remote) or validate_git_branch(branch)
+
     def git_push(self, remote: str = 'origin', branch: str = 'main',
                  message: str = None) -> tuple[bool, str]:
         """Write flat files then `git add + commit + push`.
@@ -1394,6 +1547,9 @@ class Repository:
         store_root = self.path.parent
         if not (store_root / '.git').exists():
             return False, 'Not a git repo — run `memgit git init` first'
+        bad = self._check_git_args(remote, branch)
+        if bad:
+            return False, bad
         self.write_flat()
         head_sha = self.head_sha() or 'none'
         commit_msg = message or f'memgit: checkpoint {head_sha[:8]}'
@@ -1422,6 +1578,9 @@ class Repository:
         store_root = self.path.parent
         if not (store_root / '.git').exists():
             return False, 'Not a git repo', 0
+        bad = self._check_git_args(remote, branch)
+        if bad:
+            return False, bad, 0
         try:
             subprocess.run(['git', 'pull', remote, branch], cwd=store_root,
                            check=True, capture_output=True)

{memgit-0.10.0 → memgit-0.11.0}/memgit/savings.py

@@ -121,8 +121,27 @@ def _tracked_files(root: Path) -> list[Path]:
     instead, which is what .gitignore was doing for us.
     """
     out = []
-    for path in root.rglob("*"):
-        if not path.is_file():
+    # `is_file()` stats the path, and a stat can fail for reasons that have
+    # nothing to do with us: /proc entries, dead symlinks, directories the user
+    # cannot traverse. An unreadable file is one fewer place a fact could have
+    # been found, never a reason to abort the whole report — `memgit savings`
+    # crashed with an unhandled PermissionError on /proc/1/map_files when run
+    # from / in a container (measured 2026-09-06).
+    try:
+        walk = root.rglob("*")
+    except OSError:
+        return out
+    while True:
+        try:
+            path = next(walk)
+        except StopIteration:
+            break
+        except OSError:
+            continue
+        try:
+            if not path.is_file():
+                continue
+        except OSError:
             continue
         if any(part in _SKIP_DIRS for part in path.parts):
             continue