memgit 0.9.1__tar.gz → 0.11.0__tar.gz

{memgit-0.9.1 → memgit-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memgit
-Version: 0.9.1
+Version: 0.11.0
 Summary: Git for AI memory — version-controlled context persistence across Claude, GPT, Gemini, Cursor, Windsurf, and more
 License: MIT
 Project-URL: Homepage, https://memgit.dev
@@ -21,7 +21,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0
 Requires-Dist: rich>=13.0
-Requires-Dist: mcp>=1.0.0
+Requires-Dist: mcp<2,>=1.28.1
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-anyio>=0.0.0; extra == "dev"
@@ -298,6 +298,33 @@ Since 0.8.0 it also **starts itself**: a project's first guide is created automa
 
 ---
 
+## memgit Pro — one memory across every machine
+
+The local engine, the store, the MCP server and every command below are MIT and never
+gated. **Pro** is the hosted layer for people who work on more than one machine or with a
+team: end-to-end-encrypted sync where the server stores ciphertext only, unlocked by one
+licence key.
+
+```bash
+memgit pro activate <key>     # validate the key with Polar and store it (mode 0600)
+memgit pro status             # Free / Pro, last verification, expiry
+memgit pro deactivate         # remove the key from this machine
+```
+
+- Buy a key at [memgit.dev/#pricing](https://memgit.dev/#pricing) — $12/month or $99/year,
+  billed by Polar (merchant of record, taxes handled). The key arrives by email and in your
+  Polar purchases page.
+- The only bytes that leave your machine are the key and memgit's public organisation id,
+  sent to Polar's validation endpoint. **No memory content is ever sent.**
+- Headless hosts: set `MEMGIT_LICENSE_KEY=<key>` in the MCP server's environment; it is
+  validated with the same cache and never written to disk.
+- Fail-open: a key that verified in the last 14 days keeps working offline; a rejected key
+  drops to Free with a clear message. A lapsed plan never locks your data — reads, pulls and
+  exports keep working.
+- If this store is logged in to memgit cloud, `pro activate` also upgrades that account.
+
+---
+
 ## Backups that actually happen
 
 memgit's premise is that the AI is the operator — but backup used to require a human to remember `memgit git init --remote <url>` and keep pushing. On this project's own store that meant 1,734 memories on one disk with no copy anywhere, five weeks in. A maintenance task that needs a human command is a task that will not happen.
@@ -414,6 +441,10 @@ memgit setup gemini-cli
 memgit setup hooks                # Claude Code hooks: resume at start, per-prompt recall,
                                   # capture guard + auto-sync at stop (--no-recall / --no-guard)
 
+# Pro (licence key)
+memgit pro activate <key>         # Polar-issued key; unlocks hosted E2E sync
+memgit pro status / deactivate
+
 # Server
 memgit serve                      # MCP stdio (Claude Code, Cursor, Windsurf, Cline)
 memgit serve --http               # HTTP REST (ChatGPT Custom Actions, Gemini)
@@ -444,6 +475,65 @@ memgit thread list / switch / create
 
 ---
 
+## What memgit reads from your environment
+
+memgit runs inside your agent, so the honest answer to "what does this process
+read from my environment?" should be checkable rather than a promise. The table
+below is generated from [`memgit/env.py`](memgit/env.py), and
+`tests/test_env_inventory.py` walks the package on every test run and fails if
+the code reads a name this list does not carry — or carries a name nothing
+reads. The list cannot drift away from the code.
+
+memgit reads these and nothing else. It writes none of them. None of them turn
+network access on: the cloud endpoints are overrides for a sync you have already
+opted into with `memgit cloud login`, and with no licence and no cloud login,
+memgit talks to nothing.
+
+| | Variable | What memgit does with it |
+|---|---|---|
+| Store and state | `MEMGIT_STORE` | Absolute path to the memory store. When set it is the ONLY candidate — an explicit store never silently falls back to another one. |
+|  | `MEMGIT_HOME` | Base directory for memgit's per-person state, currently the licence file (default ~/.memgit, mode 0600). |
+|  | `MEMGIT_PROJECT` | Forces the project label instead of detecting it from the working directory. |
+| Attribution | `MEMGIT_AUTHOR` | Explicit author stamped on checkpoints, for multi-agent jobs where several writers share one machine account. Wins over MEMGIT_CLIENT. |
+|  | `MEMGIT_CLIENT` | The host that launched this process (claude-code, cursor, ...), stamped into checkpoints so a memory says where it came from. |
+|  | `USER` | Fallback author name when neither MEMGIT_AUTHOR nor MEMGIT_CLIENT is set. |
+|  | `USERNAME` | Windows fallback for USER. |
+| Licensing (memgit Pro) | `MEMGIT_LICENSE_KEY` | memgit Pro licence key. Never printed in full — `memgit pro status` shows the last four characters. |
+|  | `MEMGIT_POLAR_API` | Overrides the licence-validation API base URL (testing). |
+|  | `MEMGIT_POLAR_ORG_ID` | Overrides the Polar organisation the licence is checked against. |
+| Cloud sync | `MEMGIT_CLOUD_API` | Overrides the memgit cloud API base URL. |
+|  | `MEMGIT_CLOUD_APP` | Overrides the memgit cloud web app base URL used in printed links. |
+|  | `MEMGIT_CLOUD_NO_CACHE` | Set to 1/true/yes to keep decrypted keys out of credentials.json; the passphrase is then re-prompted per command. |
+| Tuning | `MEMGIT_LOCK_TIMEOUT` | Seconds a writer waits for the store lock before giving up (default 10). |
+|  | `MEMGIT_IDLE_EVICT_SECONDS` | Idle seconds before the MCP server drops its in-memory caches while staying connected (default 900). |
+|  | `MEMGIT_HOUSEKEEPING_INTERVAL` | Seconds between the MCP server's housekeeping passes. |
+| Set by other software | `CLAUDE_PROJECT_DIR` | Set by Claude Code for hook processes; used as one input to project detection when the working directory is not the project root. |
+|  | `PYTEST_CURRENT_TEST` | Set by pytest. Its presence suppresses automatic backups, so a test run never writes into a real backup location. |
+
+### How the project label is decided
+
+Memories are project-scoped, so a wrong label files a memory where you will not
+find it again. The label comes from the first of these that yields one, and
+there is exactly one detection path shared by the MCP server, the CLI and the
+hooks — so a label derived at save time and one derived at recall time cannot
+disagree:
+
+1. `MEMGIT_PROJECT` — a forced label, taken verbatim
+2. the `cwd` a host reports in its hook payload (the real workspace, even when
+   the process working directory is elsewhere)
+3. `CLAUDE_PROJECT_DIR`
+4. the process working directory
+
+When none of them yields a label — running from `$HOME`, for instance — a write
+is **quarantined** under `_unknown` rather than filed globally, and
+`memgit doctor --relabel` moves it once you say where it belongs. Folding a
+free-text label onto an existing project (`log-report` → `Downloads-log-report`)
+happens only when the input is a trailing segment of exactly one known label and
+that label already holds memories; anything ambiguous is left alone, and every
+fold is reported rather than done silently.
+
+---
+
 ## TOON format — compact, readable, diffable
 
 Standard markdown memory file:

{memgit-0.9.1 → memgit-0.11.0}/README.md

@@ -264,6 +264,33 @@ Since 0.8.0 it also **starts itself**: a project's first guide is created automa
 
 ---
 
+## memgit Pro — one memory across every machine
+
+The local engine, the store, the MCP server and every command below are MIT and never
+gated. **Pro** is the hosted layer for people who work on more than one machine or with a
+team: end-to-end-encrypted sync where the server stores ciphertext only, unlocked by one
+licence key.
+
+```bash
+memgit pro activate <key>     # validate the key with Polar and store it (mode 0600)
+memgit pro status             # Free / Pro, last verification, expiry
+memgit pro deactivate         # remove the key from this machine
+```
+
+- Buy a key at [memgit.dev/#pricing](https://memgit.dev/#pricing) — $12/month or $99/year,
+  billed by Polar (merchant of record, taxes handled). The key arrives by email and in your
+  Polar purchases page.
+- The only bytes that leave your machine are the key and memgit's public organisation id,
+  sent to Polar's validation endpoint. **No memory content is ever sent.**
+- Headless hosts: set `MEMGIT_LICENSE_KEY=<key>` in the MCP server's environment; it is
+  validated with the same cache and never written to disk.
+- Fail-open: a key that verified in the last 14 days keeps working offline; a rejected key
+  drops to Free with a clear message. A lapsed plan never locks your data — reads, pulls and
+  exports keep working.
+- If this store is logged in to memgit cloud, `pro activate` also upgrades that account.
+
+---
+
 ## Backups that actually happen
 
 memgit's premise is that the AI is the operator — but backup used to require a human to remember `memgit git init --remote <url>` and keep pushing. On this project's own store that meant 1,734 memories on one disk with no copy anywhere, five weeks in. A maintenance task that needs a human command is a task that will not happen.
@@ -380,6 +407,10 @@ memgit setup gemini-cli
 memgit setup hooks                # Claude Code hooks: resume at start, per-prompt recall,
                                   # capture guard + auto-sync at stop (--no-recall / --no-guard)
 
+# Pro (licence key)
+memgit pro activate <key>         # Polar-issued key; unlocks hosted E2E sync
+memgit pro status / deactivate
+
 # Server
 memgit serve                      # MCP stdio (Claude Code, Cursor, Windsurf, Cline)
 memgit serve --http               # HTTP REST (ChatGPT Custom Actions, Gemini)
@@ -410,6 +441,65 @@ memgit thread list / switch / create
 
 ---
 
+## What memgit reads from your environment
+
+memgit runs inside your agent, so the honest answer to "what does this process
+read from my environment?" should be checkable rather than a promise. The table
+below is generated from [`memgit/env.py`](memgit/env.py), and
+`tests/test_env_inventory.py` walks the package on every test run and fails if
+the code reads a name this list does not carry — or carries a name nothing
+reads. The list cannot drift away from the code.
+
+memgit reads these and nothing else. It writes none of them. None of them turn
+network access on: the cloud endpoints are overrides for a sync you have already
+opted into with `memgit cloud login`, and with no licence and no cloud login,
+memgit talks to nothing.
+
+| | Variable | What memgit does with it |
+|---|---|---|
+| Store and state | `MEMGIT_STORE` | Absolute path to the memory store. When set it is the ONLY candidate — an explicit store never silently falls back to another one. |
+|  | `MEMGIT_HOME` | Base directory for memgit's per-person state, currently the licence file (default ~/.memgit, mode 0600). |
+|  | `MEMGIT_PROJECT` | Forces the project label instead of detecting it from the working directory. |
+| Attribution | `MEMGIT_AUTHOR` | Explicit author stamped on checkpoints, for multi-agent jobs where several writers share one machine account. Wins over MEMGIT_CLIENT. |
+|  | `MEMGIT_CLIENT` | The host that launched this process (claude-code, cursor, ...), stamped into checkpoints so a memory says where it came from. |
+|  | `USER` | Fallback author name when neither MEMGIT_AUTHOR nor MEMGIT_CLIENT is set. |
+|  | `USERNAME` | Windows fallback for USER. |
+| Licensing (memgit Pro) | `MEMGIT_LICENSE_KEY` | memgit Pro licence key. Never printed in full — `memgit pro status` shows the last four characters. |
+|  | `MEMGIT_POLAR_API` | Overrides the licence-validation API base URL (testing). |
+|  | `MEMGIT_POLAR_ORG_ID` | Overrides the Polar organisation the licence is checked against. |
+| Cloud sync | `MEMGIT_CLOUD_API` | Overrides the memgit cloud API base URL. |
+|  | `MEMGIT_CLOUD_APP` | Overrides the memgit cloud web app base URL used in printed links. |
+|  | `MEMGIT_CLOUD_NO_CACHE` | Set to 1/true/yes to keep decrypted keys out of credentials.json; the passphrase is then re-prompted per command. |
+| Tuning | `MEMGIT_LOCK_TIMEOUT` | Seconds a writer waits for the store lock before giving up (default 10). |
+|  | `MEMGIT_IDLE_EVICT_SECONDS` | Idle seconds before the MCP server drops its in-memory caches while staying connected (default 900). |
+|  | `MEMGIT_HOUSEKEEPING_INTERVAL` | Seconds between the MCP server's housekeeping passes. |
+| Set by other software | `CLAUDE_PROJECT_DIR` | Set by Claude Code for hook processes; used as one input to project detection when the working directory is not the project root. |
+|  | `PYTEST_CURRENT_TEST` | Set by pytest. Its presence suppresses automatic backups, so a test run never writes into a real backup location. |
+
+### How the project label is decided
+
+Memories are project-scoped, so a wrong label files a memory where you will not
+find it again. The label comes from the first of these that yields one, and
+there is exactly one detection path shared by the MCP server, the CLI and the
+hooks — so a label derived at save time and one derived at recall time cannot
+disagree:
+
+1. `MEMGIT_PROJECT` — a forced label, taken verbatim
+2. the `cwd` a host reports in its hook payload (the real workspace, even when
+   the process working directory is elsewhere)
+3. `CLAUDE_PROJECT_DIR`
+4. the process working directory
+
+When none of them yields a label — running from `$HOME`, for instance — a write
+is **quarantined** under `_unknown` rather than filed globally, and
+`memgit doctor --relabel` moves it once you say where it belongs. Folding a
+free-text label onto an existing project (`log-report` → `Downloads-log-report`)
+happens only when the input is a trailing segment of exactly one known label and
+that label already holds memories; anything ambiguous is left alone, and every
+fold is reported rather than done silently.
+
+---
+
 ## TOON format — compact, readable, diffable
 
 Standard markdown memory file:

{memgit-0.9.1 → memgit-0.11.0}/memgit/__init__.py

@@ -1,3 +1,3 @@
 """memgit — git for AI memory."""
 
-__version__ = "0.9.1"
+__version__ = "0.11.0"

{memgit-0.9.1 → memgit-0.11.0}/memgit/cli.py

@@ -118,11 +118,18 @@ def init(directory):
 
     # Step-by-step flow: find existing memories automatically and offer the
     # import, instead of making the user discover the right path themselves.
+    # Narrow on purpose: an unreadable ~/.claude tree (OSError) or a memory file
+    # that will not parse (ValueError, which UnicodeDecodeError subclasses) is a
+    # reason to skip the offer, not to abort `init`. Anything else is a bug in
+    # the importer and must reach the user rather than being swallowed here.
     try:
         from .importer import from_claude_code
         found = from_claude_code()
-    except Exception:
+    except (OSError, ValueError) as exc:
         found = []
+        console.print(f'[dim]Could not scan ~/.claude/projects for existing '
+                      f'memories ({exc.__class__.__name__}: {exc}) — skipping '
+                      f'the import offer.[/dim]')
     if found:
         projects = {m.project for m in found if m.project}
         console.print(f'\nFound [bold]{len(found)}[/bold] existing Claude Code memories '
@@ -1978,6 +1985,105 @@ def metrics(fmt_json, reset):
     console.print()
 
 
+@cli.command()
+@click.option('--json', 'fmt_json', is_flag=True, help='Machine-readable output')
+@click.option('--match', default=None, type=float,
+              help='Share of a memory\'s terms a file must carry to count as '
+                   'containing the fact (default 0.5)')
+@click.option('--reads', default=None, type=int,
+              help='How many files the counterfactual reader opens (default 3)')
+@click.option('--all-projects', is_flag=True,
+              help='Every project, not just the one you are standing in')
+@click.option('--root', type=click.Path(exists=True, file_okay=False),
+              help='Directory the counterfactual reader would search (default: cwd)')
+def savings(fmt_json, match, reads, all_projects, root):
+    """What memory cost, against what finding the same fact would have cost.
+
+    The counterfactual is stated, not implied: without memgit an agent needing
+    a fact would grep this project and read the best-matching files. That path
+    is mechanical, so it can be measured. Memories no file contains are counted
+    separately and NEVER priced — without memgit those facts are not found at
+    any number of tokens, and turning that into a savings figure would be the
+    fabrication `memgit metrics` was right to refuse.
+
+    The estimate is conservative on purpose: it counts the files only, not the
+    grep output, not the turns spent choosing what to open, and not the reads
+    that miss.
+    """
+    from . import savings as sv
+    from .project import detect_project
+    repo = _require_repo()
+    search_root = Path(root) if root else Path.cwd()
+    label = None if all_projects else detect_project(search_root)
+    r = sv.measure(repo, search_root, project=label,
+                   match=match if match is not None else sv.DEFAULT_MATCH,
+                   reads=reads if reads is not None else sv.DEFAULT_READS)
+
+    if fmt_json:
+        import json as _j
+        print(_j.dumps(r, indent=2))
+        return
+
+    from rich.rule import Rule
+    from rich import box
+
+    console.print()
+    console.print(Rule('[bold cyan]memgit savings[/bold cyan]  '
+                       '[dim]measured against a stated counterfactual[/dim]'))
+    console.print()
+    console.print(f'[dim]Project:[/dim] {r["project"] or "all"}   '
+                  f'[dim]Files a reader could open:[/dim] {r["files_indexed"]:,}   '
+                  f'[dim]Reads assumed:[/dim] {r["parameters"]["reads"]}   '
+                  f'[dim]Match:[/dim] {r["parameters"]["match"]:.0%}')
+    console.print()
+
+    if r['memories_considered'] == 0:
+        console.print('[dim]No recalled memories for this project yet — nothing '
+                      'to compare. The usage ledger fills as memories get '
+                      'surfaced.[/dim]')
+        console.print()
+        return
+
+    t = Table(box=box.SIMPLE, header_style='bold')
+    t.add_column('', min_width=34)
+    t.add_column('Tokens', justify='right')
+    t.add_row('With memgit (what was injected)', f'{r["memgit_tokens"]:,}')
+    t.add_row('Without memgit (files that would be read)',
+              f'{r["without_memgit_tokens"]:,}')
+    t.add_row('[bold]Saved[/bold]', f'[bold]{r["saved_tokens"]:,}[/bold]')
+    console.print(t)
+    if r['ratio']:
+        console.print(f'  Reading costs [bold]{r["ratio"]:.0f}x[/bold] what recall '
+                      f'costs, over {r["recalls_counted"]:,} recorded recalls of '
+                      f'{r["recoverable_from_files"]:,} memories.')
+    console.print()
+
+    if r['unrecoverable_from_files']:
+        console.print(
+            f'[bold yellow]{r["unrecoverable_from_files"]:,} of '
+            f'{r["memories_considered"]:,} recalled memories are in NO file in '
+            f'this project.[/bold yellow]')
+        console.print('  [dim]Not priced, deliberately. Without memgit these are '
+                      'not found more expensively, they are not found. That is '
+                      'the claim worth making, and it is a count, not a token '
+                      'figure.[/dim]')
+        console.print()
+
+    if r['top_savers']:
+        t2 = Table(box=box.SIMPLE, header_style='bold',
+                   title='Where the saving comes from', title_justify='left')
+        t2.add_column('Memory', min_width=30)
+        t2.add_column('Recalls', justify='right')
+        t2.add_column('Recall tok', justify='right')
+        t2.add_column('Read tok', justify='right')
+        for row in r['top_savers'][:8]:
+            t2.add_row(row['slug'][:48], f'{row["hits"]:,}',
+                       f'{row["memgit_tokens_per_recall"]:,}',
+                       f'{row["without_tokens_per_recall"]:,}')
+        console.print(t2)
+        console.print()
+
+
 @cli.group(invoke_without_command=True)
 @click.pass_context
 def backup(ctx):
@@ -2587,6 +2693,13 @@ def git_init(remote):
 
     Then teammates run `memgit git pull` to get your memories.
     """
+    if remote:
+        from .repo import validate_git_remote
+        bad = validate_git_remote(remote)
+        if bad:
+            err.print(f'[red]{bad}[/red]')
+            raise SystemExit(1)
+
     repo = _require_repo()
     ok = repo.git_init()
     if not ok:
@@ -3354,6 +3467,126 @@ if __name__ == '__main__':
     cli()
 
 
+# ── pro (licence-key entitlement via Polar; no extra, no telemetry) ──────────
+
+@cli.group(invoke_without_command=True)
+@click.pass_context
+def pro(ctx):
+    """memgit Pro — activate, inspect or remove a licence key.
+
+    Pro unlocks the hosted sync layer (memgit cloud) and future paid features.
+    The free CLI, store and MCP server are MIT and never gated. The only bytes
+    that leave this machine are the key and memgit's public organisation id,
+    sent to Polar's validation endpoint; no memory content is ever sent.
+    """
+    if ctx.invoked_subcommand is None:
+        ctx.invoke(pro_status)
+
+
+@pro.command('activate')
+@click.argument('key')
+@click.option('--no-cloud', is_flag=True, help='Do not also attach the key to a logged-in memgit cloud account')
+def pro_activate(key, no_cloud):
+    """Store KEY and validate it with Polar. Buy one at memgit.dev/#pricing."""
+    from . import license as lic_mod
+    from datetime import datetime, timezone
+    key = key.strip()
+    if len(key) < 8:
+        console.print('[red]✗[/red] that does not look like a licence key')
+        sys.exit(2)
+    lic = lic_mod.License(key=key)
+    now = datetime.now(timezone.utc)
+    lic = lic_mod.refresh(lic, now=now, force=True)
+    if lic.status == 'granted':
+        lic_mod.write(lic)
+        console.print(f'[green]✓[/green] memgit Pro activated for key {lic.masked}'
+                      + (f' ({lic.customer_email})' if lic.customer_email else ''))
+        if lic.expires_at:
+            console.print(f'  [dim]expires {lic.expires_at}[/dim]')
+    elif lic.status in ('revoked', 'disabled', 'invalid'):
+        console.print(f'[red]✗[/red] key {lic.masked} was rejected: {lic.error or lic.status}')
+        console.print('  [dim]Keys are issued by Polar on purchase and shown in your purchases page.[/dim]')
+        sys.exit(1)
+    else:  # unknown — offline or provider down: keep the key, verify on next run
+        lic.status = 'none'
+        lic_mod.write(lic)
+        console.print(f'[yellow]![/yellow] could not reach the licence service ({lic.error}); '
+                      f'key {lic.masked} saved and will be verified on the next run')
+    if not no_cloud and lic.status == 'granted':
+        _pro_attach_cloud(key)
+
+
+def _pro_attach_cloud(key: str) -> None:
+    """Best-effort: if this store is logged in to memgit cloud, tell the API about
+    the key so the hosted side unlocks too. Silent when not logged in."""
+    try:
+        from .cloud.state import CloudState
+        from .repo import Repository
+        repo = Repository.find()
+        if repo is None:
+            return
+        cstate = CloudState(repo.path)
+        creds = cstate.creds
+        if not creds.get('access'):
+            return
+        from .cloud.client import ApiClient, DEFAULT_API_URL
+        import os as _os
+        api_url = _os.environ.get('MEMGIT_CLOUD_API') or creds.get('api_url') or DEFAULT_API_URL
+        api = ApiClient(api_url, cstate)
+        api._check(api._request('POST', '/v1/billing/polar/activate', json={'license_key': key}))
+        console.print('[green]✓[/green] memgit cloud account upgraded to Pro')
+    except Exception as e:  # never let the hosted side break local activation
+        console.print(f'[dim]cloud: not attached ({str(e)[:80]}) — run `memgit cloud login` then re-activate[/dim]')
+
+
+@pro.command('status')
+@click.option('--json', 'fmt_json', is_flag=True, help='JSON output')
+@click.option('--offline', is_flag=True, help='Answer from the cache only; never touch the network')
+def pro_status(fmt_json, offline):
+    """Show whether this machine is entitled to memgit Pro."""
+    from . import license as lic_mod
+    from datetime import datetime, timezone
+    now = datetime.now(timezone.utc)
+    lic = lic_mod.read()
+    if lic.key and not offline and lic.needs_recheck(now):
+        lic = lic_mod.refresh(lic, now=now)
+        if lic.source == 'file':
+            try:
+                lic_mod.write(lic)
+            except OSError:
+                pass
+    ent = lic.is_entitled(now)
+    if fmt_json:
+        import json as _j
+        print(_j.dumps({'entitled': ent, 'key': lic.masked, 'status': lic.status,
+                        'validated_at': lic.validated_at, 'expires_at': lic.expires_at,
+                        'source': lic.source, 'error': lic.error}))
+        return
+    if not lic.key:
+        console.print('[bold]memgit Free[/bold] — no licence key. '
+                      f'Pro (hosted E2E sync across machines and teams): {lic_mod.PRO_URL}')
+        return
+    tier = '[green]memgit Pro[/green]' if ent else '[yellow]memgit Free (key not entitled)[/yellow]'
+    console.print(f'{tier}  key {lic.masked}  status {lic.status}'
+                  f'{"  via $MEMGIT_LICENSE_KEY" if lic.source != "file" else ""}')
+    if lic.validated_at:
+        console.print(f'  [dim]last verified {lic.validated_at}[/dim]')
+    if lic.expires_at:
+        console.print(f'  [dim]expires {lic.expires_at}[/dim]')
+    if lic.error:
+        console.print(f'  [yellow]{lic.error}[/yellow]')
+
+
+@pro.command('deactivate')
+def pro_deactivate():
+    """Remove the stored licence key from this machine."""
+    from . import license as lic_mod
+    if lic_mod.clear():
+        console.print('[green]✓[/green] licence key removed; memgit is back on the Free tier')
+    else:
+        console.print('[dim]no licence key was stored[/dim]')
+
+
 # ── cloud (E2E-encrypted team sync — optional extra) ──────────────────────────
 
 try:

{memgit-0.9.1 → memgit-0.11.0}/memgit/cloud/commands.py

@@ -136,7 +136,12 @@ def cloud():
 @cloud.command()
 @click.option('--email', prompt=True)
 def signup(email):
-    """Create a memgit cloud account (30-day free trial)."""
+    """Create a memgit cloud account (free trial; the server sets the length).
+
+    The trial length is stamped by the server at signup and printed below, so this
+    help text does not hardcode it. It said "30-day" while the deployed server granted
+    14, which is a promise broken on day 15 for every reader of --help.
+    """
     _require_extra()
     from . import crypto
     from nacl import utils
@@ -345,13 +350,41 @@ def _report(res, direction):
     console.print(f'[green]{icons.get(res.action, "·")}[/green] {direction}: {res.action}{detail}{head}')
 
 
+def _guard_uncommitted(repo, thread: str, allow: bool) -> None:
+    """Refuse to transmit while staged memories are not in a checkpoint.
+
+    Sync ships CHECKPOINTS. `memgit add` stages a memory but does not create
+    one, so pushing straight after `add` uploads nothing of the user's — and
+    said "created (2 objects up)" while doing it, with the receiving machine
+    reporting a clean, empty, fsck-OK store (measured 2026-09-06). Nothing in
+    that sequence errored, which is why it reads as "sync is broken" rather
+    than "you have not committed". An error naming the fix is the whole point;
+    `--allow-uncommitted` is there for anyone who means it.
+    """
+    if allow:
+        return
+    pending = repo.uncommitted_slugs(thread)
+    if not pending:
+        return
+    shown = ', '.join(pending[:5]) + (f' and {len(pending) - 5} more' if len(pending) > 5 else '')
+    console.print(
+        f'[red]✗[/red] {len(pending)} memor{"y is" if len(pending) == 1 else "ies are"} '
+        f'not committed, and sync only ships committed memory: [bold]{shown}[/bold]')
+    console.print('  [dim]commit them first:  memgit commit -m "what changed"[/dim]')
+    console.print('  [dim]or push the committed state anyway:  --allow-uncommitted[/dim]')
+    sys.exit(1)
+
+
 @cloud.command()
 @click.option('--thread', default=None, help='thread to push (default: current)')
-def push(thread):
+@click.option('--allow-uncommitted', is_flag=True,
+              help='Push committed state even though staged memories would not be sent')
+def push(thread, allow_uncommitted):
     """Encrypt and upload local checkpoints, then advance the remote ref."""
     repo, cstate, api = _ctx()
     engine = _linked(repo, cstate, api)
     th = thread or repo.current_thread()
+    _guard_uncommitted(repo, th, allow_uncommitted)
     res = _run(lambda: engine.push(th), 'push')
     _report(res, f'push {th}')
 
@@ -369,11 +402,17 @@ def pull(thread):
 
 @cloud.command('sync')
 @click.option('--thread', default=None, help='thread to sync (default: current)')
-def cloud_sync(thread):
+@click.option('--allow-uncommitted', is_flag=True,
+              help='Sync committed state even though staged memories would not be sent')
+def cloud_sync(thread, allow_uncommitted):
     """Pull then push — the everyday command."""
     repo, cstate, api = _ctx()
     engine = _linked(repo, cstate, api)
     th = thread or repo.current_thread()
+    # Guarded before the pull as well as the push: sync is the command users
+    # reach for, and finding out after a merge that half of it was a no-op is
+    # worse than being told up front which memories are not committed yet.
+    _guard_uncommitted(repo, th, allow_uncommitted)
     pulled, pushed = _run(lambda: engine.sync(th), 'sync')
     _report(pulled, f'pull {th}')
     _report(pushed, f'push {th}')