memoryintelligence-mcp 0.1.6__tar.gz → 0.1.8__tar.gz

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/CHANGELOG.md

@@ -3,6 +3,41 @@
 All notable changes to `memoryintelligence-mcp` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/); this project uses [Semantic Versioning](https://semver.org/).
 
+## [0.1.8] — 2026-06-10
+
+### Changed
+- **The MCP server id is now `memoryintelligence`** (was `memory-intelligence`).
+  This is the id under `mcpServers` in your config and the name in
+  `claude mcp add …`. It now matches the brand/package token everywhere else
+  (`MemoryIntelligence`, `memoryintelligence-mcp`) instead of splitting the word
+  with a dash.
+- **Auto-migration:** `mi-mcp wire`/`setup` removes the old `memory-intelligence`
+  entry from every surface (file configs **and** `claude mcp remove`) before
+  adding the new id, so an upgrade leaves no duplicate/orphan. `mi-mcp doctor`
+  flags a leftover legacy entry and tells you to re-wire. **Action on upgrade:
+  run `mi-mcp wire` once.** (Hand-edited configs: rename the key yourself.)
+
+## [0.1.7] — 2026-06-09
+
+### Changed
+- **Hidden files now live under `~/.memoryintelligence/`** (was `~/.mi/`), matching
+  the visible `~/MemoryIntelligence/` vault — one on-brand namespace:
+  - launcher → `~/.memoryintelligence/mcp/run-mi-mcp.sh`
+  - capture opt-in allowlist → `~/.memoryintelligence/mcp/opt-in-paths`
+  - keyfile (the Keychain fallback) → `~/.memoryintelligence/.env`
+
+  `mi-mcp setup`/`wire` write the new layout and migrate an existing
+  `~/.mi/opt-in-paths` forward non-destructively. The legacy `~/.mi/` launcher
+  and `~/.mi-env` keyfile are still **read** for one release, so existing
+  installs keep working until you re-run `wire`. `paths.py` is now the single
+  source of truth for the layout (it previously declared the new layout while the
+  CLI still wrote `~/.mi/` — that split is fixed here).
+
+### Added
+- **README "Names & locations" map** — explains the package / command / server-id
+  names (`memoryintelligence-mcp` / `mi-mcp` / `memory-intelligence`) and where
+  every file lives, so the naming no longer looks arbitrary.
+
 ## [0.1.6] — 2026-06-09
 
 ### Security
@@ -12,11 +47,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/); this project
   the key resolved from (Keychain / keyfile / env), never the key itself.
 
 ### Added
-- **MCP ↔ API contract tests** (`tests/test_api_contract.py`) — pin that every
-  client method sends only parameter values the API accepts (`explain`,
-  `pii_handling`, `retention_policy`, `scope`), so an API enum/type change can
-  never silently 422 a real call. This is the general form of the `explain`
-  bool→enum bug fixed in 0.1.3.
+- **MCP ↔ API contract tests** (`tests/test_api_contract.py`, run in CI — not
+  shipped in the published package) — pin that every client method sends only
+  parameter values the API accepts (`explain`, `pii_handling`,
+  `retention_policy`, `scope`), so an API enum/type change can never silently
+  422 a real call. This is the general form of the `explain` bool→enum bug
+  fixed in 0.1.3.
 
 ### Changed
 - Internal code-quality cleanups (narrowed a few broad `except` clauses, removed

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memoryintelligence-mcp
-Version: 0.1.6
+Version: 0.1.8
 Summary: MCP server for MemoryIntelligence — give Claude a memory you own, set up in one command
 Project-URL: Homepage, https://memoryintelligence.io
 Project-URL: Repository, https://github.com/somewhere11/memoryintelligence-mcp
@@ -72,7 +72,7 @@ API key is ever written into a config file.**
 
 ---
 
-## ✅ What works today (0.1.5)
+## ✅ What works today (0.1.7)
 
 Honest status — this is beta, so here's exactly what's live:
 
@@ -177,7 +177,7 @@ provenance — runs in the service. Your API key authenticates to *your* account
 
 1. **prompts for your API key** (hidden input);
 2. **stores it securely, outside every config** — macOS **Keychain**, or a
-   `chmod 600 ~/.mi-env` keyfile on Linux/Windows (or with `--store file`);
+   `chmod 600 ~/.memoryintelligence/.env` keyfile on Linux/Windows (or with `--store file`);
 3. **wires** the server into Claude Desktop + Claude Code (`--surfaces` to choose
    `desktop,code,cursor`), writing `env: {}` — **no key in any config file**;
 4. **opts in** the current directory so captures are allowed there (reads work
@@ -187,7 +187,7 @@ provenance — runs in the service. Your API key authenticates to *your* account
 ```bash
 mi-mcp setup                       # the happy path (interactive)
 mi-mcp setup --surfaces desktop,code,cursor
-mi-mcp setup --store file          # force the ~/.mi-env keyfile (e.g. on Linux)
+mi-mcp setup --store file          # force the ~/.memoryintelligence/.env keyfile (e.g. on Linux)
 mi-mcp setup --no-opt-in           # wire only; opt a folder in later
 ```
 
@@ -202,12 +202,12 @@ mi-mcp wire --dry-run   # preview wiring changes without writing
 
 ### How the key stays out of your configs
 
-`wire` points each host at a small launcher (`~/.mi/run-mi-mcp.sh`) that resolves
-`MI_API_KEY` **at launch**, in order:
+`wire` points each host at a small launcher (`~/.memoryintelligence/mcp/run-mi-mcp.sh`)
+that resolves `MI_API_KEY` **at launch**, in order:
 
 1. the process environment, then
 2. the macOS **Keychain** (`security find-generic-password -s MI_API_KEY`), then
-3. a gitignored `~/.mi-env` (`chmod 600`), else it fails.
+3. a `chmod 600` keyfile (`~/.memoryintelligence/.env`, or the legacy `~/.mi-env`), else it fails.
 
 So a leaked or committed config file exposes **nothing**.
 
@@ -220,12 +220,12 @@ So a leaked or committed config file exposes **nothing**.
 ## Security
 
 - **No key in configs.** `setup`/`wire` write `env: {}`; the launcher resolves the
-  key from the Keychain (or `~/.mi-env`) at runtime. Nothing sensitive lands in a
-  config file.
+  key from the Keychain (or the `~/.memoryintelligence/.env` keyfile) at runtime.
+  Nothing sensitive lands in a config file.
 - **Capture is opt-in per directory.** Write tools (`mi_capture`/`mi_batch`/
   `mi_upload`) only run when the server's working directory is on the
-  `~/.mi/opt-in-paths` allowlist. Reads are never gated. Absent allowlist → all
-  captures are skipped.
+  `~/.memoryintelligence/mcp/opt-in-paths` allowlist. Reads are never gated. Absent
+  allowlist → all captures are skipped.
 - **Destructive ops require confirmation.** `mi_forget` (irreversible delete)
   requires an explicit `confirm=true` argument — a human-in-the-loop guard against
   injected or accidental deletes.
@@ -248,8 +248,8 @@ So a leaked or committed config file exposes **nothing**.
 - **Privacy.** Content you capture is sent to your MemoryIntelligence account over
   HTTPS; nothing else is transmitted, and the server does not log conversation
   content or your API key. See [memoryintelligence.io/privacy](https://memoryintelligence.io/privacy).
-- **Off switch.** Clear `~/.mi/opt-in-paths` (captures skip) or remove the
-  `memory-intelligence` entry from your Claude config to fully unwire.
+- **Off switch.** Clear `~/.memoryintelligence/mcp/opt-in-paths` (captures skip) or
+  remove the `memoryintelligence` entry from your Claude config to fully unwire.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) — report privately to
 connect@somewheremedia.com.
@@ -258,7 +258,7 @@ connect@somewheremedia.com.
 
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
-| `MI_API_KEY` | Yes | — | Your MI API key (resolved by the launcher from the Keychain / `~/.mi-env` — don't set inline in configs) |
+| `MI_API_KEY` | Yes | — | Your MI API key (resolved by the launcher from the Keychain / `~/.memoryintelligence/.env` — don't set inline in configs) |
 | `MI_BASE_URL` | No | `https://api.memoryintelligence.io` | API base URL |
 | `MI_MCP_FULL` | No | _(off)_ | `1` exposes all 10 tools; otherwise only the 3 core |
 | `MI_TRANSPORT` | No | `stdio` | `stdio` only in this version (networked transports disabled) |
@@ -268,6 +268,35 @@ connect@somewheremedia.com.
 | `MI_DEFAULT_RETENTION` | No | `meaning_only` | Default retention policy |
 | `MI_DEFAULT_PII_HANDLING` | No | `extract_and_redact` | Default PII handling |
 
+## Names & locations
+
+You'll see a few related names. They differ because each ecosystem has its own
+rules (PyPI lowercases, Python imports can't contain hyphens, MCP server ids are
+lowercase-hyphen) — but they collapse to one **long form** and one **short form**:
+
+| You see | What it is | Why this form |
+|---|---|---|
+| `MemoryIntelligence` | the brand | display name |
+| `memoryintelligence-mcp` | the **PyPI package** (`pip install` / `uvx`) | PyPI normalizes to lowercase + hyphens |
+| `mi-mcp` | the **command** you run (`mi-mcp setup`) | short for daily use (`memoryintelligence-mcp` is an alias) |
+| `mi_mcp` | the Python import package | must be a valid identifier — no hyphens |
+| `memoryintelligence` | the **server id** in your MCP config | matches the brand token (renamed from `memory-intelligence` in 0.1.8) |
+| `MI_*` (e.g. `MI_API_KEY`) | environment variables / Keychain service | short prefix |
+
+And everything written to disk lives under one on-brand namespace:
+
+| Path | What |
+|---|---|
+| `~/MemoryIntelligence/` | visible vault — your `.umo` files (override with `MI_VAULT`) |
+| `~/.memoryintelligence/mcp/run-mi-mcp.sh` | the launcher each MCP host spawns |
+| `~/.memoryintelligence/mcp/opt-in-paths` | per-directory capture allowlist |
+| `~/.memoryintelligence/.env` | `chmod 600` keyfile (the Keychain fallback) |
+| macOS Keychain (`MI_API_KEY`) | preferred key storage — never on disk |
+
+> Upgrading from ≤ 0.1.6? The old `~/.mi/` launcher and `~/.mi-env` keyfile still
+> work (they're read as a fallback). Re-run `mi-mcp wire` to move to the new paths;
+> your opt-in list is migrated forward automatically.
+
 ## Manual setup (cross-platform / advanced)
 
 `mi-mcp setup` is the recommended path on every OS. If you'd rather do it by hand
@@ -279,15 +308,16 @@ then run `mi-mcp wire`:
 ```bash
 read -s K; security add-generic-password -a "$USER" -s "MI_API_KEY" -w "$K" -U; unset K
 mi-mcp wire
-echo "$(pwd)" >> ~/.mi/opt-in-paths
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths
 ```
 
-**Linux / Windows (WSL or Git Bash) — `~/.mi-env` keyfile:**
+**Linux / Windows (WSL or Git Bash) — `~/.memoryintelligence/.env` keyfile:**
 
 ```bash
-umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.mi-env   # chmod 600
+mkdir -p ~/.memoryintelligence
+umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.memoryintelligence/.env   # chmod 600
 mi-mcp wire
-echo "$(pwd)" >> ~/.mi/opt-in-paths
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths
 ```
 
 **Or just an environment variable** (any OS — exported in your shell profile):
@@ -297,8 +327,9 @@ export MI_API_KEY="mi_sk_..."     # the launcher reads the inherited env first
 ```
 
 The launcher resolves the key in order: **inherited env → macOS Keychain →
-`~/.mi-env`**. `security add-generic-password` is macOS-only, so on Linux/Windows
-use the keyfile or env var — never paste the key into an MCP client config.
+`~/.memoryintelligence/.env`** (the legacy `~/.mi-env` is still read).
+`security add-generic-password` is macOS-only, so on Linux/Windows use the keyfile
+or env var — never paste the key into an MCP client config.
 
 ## Development
 

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/README.md

@@ -37,7 +37,7 @@ API key is ever written into a config file.**
 
 ---
 
-## ✅ What works today (0.1.5)
+## ✅ What works today (0.1.7)
 
 Honest status — this is beta, so here's exactly what's live:
 
@@ -142,7 +142,7 @@ provenance — runs in the service. Your API key authenticates to *your* account
 
 1. **prompts for your API key** (hidden input);
 2. **stores it securely, outside every config** — macOS **Keychain**, or a
-   `chmod 600 ~/.mi-env` keyfile on Linux/Windows (or with `--store file`);
+   `chmod 600 ~/.memoryintelligence/.env` keyfile on Linux/Windows (or with `--store file`);
 3. **wires** the server into Claude Desktop + Claude Code (`--surfaces` to choose
    `desktop,code,cursor`), writing `env: {}` — **no key in any config file**;
 4. **opts in** the current directory so captures are allowed there (reads work
@@ -152,7 +152,7 @@ provenance — runs in the service. Your API key authenticates to *your* account
 ```bash
 mi-mcp setup                       # the happy path (interactive)
 mi-mcp setup --surfaces desktop,code,cursor
-mi-mcp setup --store file          # force the ~/.mi-env keyfile (e.g. on Linux)
+mi-mcp setup --store file          # force the ~/.memoryintelligence/.env keyfile (e.g. on Linux)
 mi-mcp setup --no-opt-in           # wire only; opt a folder in later
 ```
 
@@ -167,12 +167,12 @@ mi-mcp wire --dry-run   # preview wiring changes without writing
 
 ### How the key stays out of your configs
 
-`wire` points each host at a small launcher (`~/.mi/run-mi-mcp.sh`) that resolves
-`MI_API_KEY` **at launch**, in order:
+`wire` points each host at a small launcher (`~/.memoryintelligence/mcp/run-mi-mcp.sh`)
+that resolves `MI_API_KEY` **at launch**, in order:
 
 1. the process environment, then
 2. the macOS **Keychain** (`security find-generic-password -s MI_API_KEY`), then
-3. a gitignored `~/.mi-env` (`chmod 600`), else it fails.
+3. a `chmod 600` keyfile (`~/.memoryintelligence/.env`, or the legacy `~/.mi-env`), else it fails.
 
 So a leaked or committed config file exposes **nothing**.
 
@@ -185,12 +185,12 @@ So a leaked or committed config file exposes **nothing**.
 ## Security
 
 - **No key in configs.** `setup`/`wire` write `env: {}`; the launcher resolves the
-  key from the Keychain (or `~/.mi-env`) at runtime. Nothing sensitive lands in a
-  config file.
+  key from the Keychain (or the `~/.memoryintelligence/.env` keyfile) at runtime.
+  Nothing sensitive lands in a config file.
 - **Capture is opt-in per directory.** Write tools (`mi_capture`/`mi_batch`/
   `mi_upload`) only run when the server's working directory is on the
-  `~/.mi/opt-in-paths` allowlist. Reads are never gated. Absent allowlist → all
-  captures are skipped.
+  `~/.memoryintelligence/mcp/opt-in-paths` allowlist. Reads are never gated. Absent
+  allowlist → all captures are skipped.
 - **Destructive ops require confirmation.** `mi_forget` (irreversible delete)
   requires an explicit `confirm=true` argument — a human-in-the-loop guard against
   injected or accidental deletes.
@@ -213,8 +213,8 @@ So a leaked or committed config file exposes **nothing**.
 - **Privacy.** Content you capture is sent to your MemoryIntelligence account over
   HTTPS; nothing else is transmitted, and the server does not log conversation
   content or your API key. See [memoryintelligence.io/privacy](https://memoryintelligence.io/privacy).
-- **Off switch.** Clear `~/.mi/opt-in-paths` (captures skip) or remove the
-  `memory-intelligence` entry from your Claude config to fully unwire.
+- **Off switch.** Clear `~/.memoryintelligence/mcp/opt-in-paths` (captures skip) or
+  remove the `memoryintelligence` entry from your Claude config to fully unwire.
 
 Found a vulnerability? See [SECURITY.md](SECURITY.md) — report privately to
 connect@somewheremedia.com.
@@ -223,7 +223,7 @@ connect@somewheremedia.com.
 
 | Variable | Required | Default | Description |
 |----------|----------|---------|-------------|
-| `MI_API_KEY` | Yes | — | Your MI API key (resolved by the launcher from the Keychain / `~/.mi-env` — don't set inline in configs) |
+| `MI_API_KEY` | Yes | — | Your MI API key (resolved by the launcher from the Keychain / `~/.memoryintelligence/.env` — don't set inline in configs) |
 | `MI_BASE_URL` | No | `https://api.memoryintelligence.io` | API base URL |
 | `MI_MCP_FULL` | No | _(off)_ | `1` exposes all 10 tools; otherwise only the 3 core |
 | `MI_TRANSPORT` | No | `stdio` | `stdio` only in this version (networked transports disabled) |
@@ -233,6 +233,35 @@ connect@somewheremedia.com.
 | `MI_DEFAULT_RETENTION` | No | `meaning_only` | Default retention policy |
 | `MI_DEFAULT_PII_HANDLING` | No | `extract_and_redact` | Default PII handling |
 
+## Names & locations
+
+You'll see a few related names. They differ because each ecosystem has its own
+rules (PyPI lowercases, Python imports can't contain hyphens, MCP server ids are
+lowercase-hyphen) — but they collapse to one **long form** and one **short form**:
+
+| You see | What it is | Why this form |
+|---|---|---|
+| `MemoryIntelligence` | the brand | display name |
+| `memoryintelligence-mcp` | the **PyPI package** (`pip install` / `uvx`) | PyPI normalizes to lowercase + hyphens |
+| `mi-mcp` | the **command** you run (`mi-mcp setup`) | short for daily use (`memoryintelligence-mcp` is an alias) |
+| `mi_mcp` | the Python import package | must be a valid identifier — no hyphens |
+| `memoryintelligence` | the **server id** in your MCP config | matches the brand token (renamed from `memory-intelligence` in 0.1.8) |
+| `MI_*` (e.g. `MI_API_KEY`) | environment variables / Keychain service | short prefix |
+
+And everything written to disk lives under one on-brand namespace:
+
+| Path | What |
+|---|---|
+| `~/MemoryIntelligence/` | visible vault — your `.umo` files (override with `MI_VAULT`) |
+| `~/.memoryintelligence/mcp/run-mi-mcp.sh` | the launcher each MCP host spawns |
+| `~/.memoryintelligence/mcp/opt-in-paths` | per-directory capture allowlist |
+| `~/.memoryintelligence/.env` | `chmod 600` keyfile (the Keychain fallback) |
+| macOS Keychain (`MI_API_KEY`) | preferred key storage — never on disk |
+
+> Upgrading from ≤ 0.1.6? The old `~/.mi/` launcher and `~/.mi-env` keyfile still
+> work (they're read as a fallback). Re-run `mi-mcp wire` to move to the new paths;
+> your opt-in list is migrated forward automatically.
+
 ## Manual setup (cross-platform / advanced)
 
 `mi-mcp setup` is the recommended path on every OS. If you'd rather do it by hand
@@ -244,15 +273,16 @@ then run `mi-mcp wire`:
 ```bash
 read -s K; security add-generic-password -a "$USER" -s "MI_API_KEY" -w "$K" -U; unset K
 mi-mcp wire
-echo "$(pwd)" >> ~/.mi/opt-in-paths
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths
 ```
 
-**Linux / Windows (WSL or Git Bash) — `~/.mi-env` keyfile:**
+**Linux / Windows (WSL or Git Bash) — `~/.memoryintelligence/.env` keyfile:**
 
 ```bash
-umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.mi-env   # chmod 600
+mkdir -p ~/.memoryintelligence
+umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.memoryintelligence/.env   # chmod 600
 mi-mcp wire
-echo "$(pwd)" >> ~/.mi/opt-in-paths
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths
 ```
 
 **Or just an environment variable** (any OS — exported in your shell profile):
@@ -262,8 +292,9 @@ export MI_API_KEY="mi_sk_..."     # the launcher reads the inherited env first
 ```
 
 The launcher resolves the key in order: **inherited env → macOS Keychain →
-`~/.mi-env`**. `security add-generic-password` is macOS-only, so on Linux/Windows
-use the keyfile or env var — never paste the key into an MCP client config.
+`~/.memoryintelligence/.env`** (the legacy `~/.mi-env` is still read).
+`security add-generic-password` is macOS-only, so on Linux/Windows use the keyfile
+or env var — never paste the key into an MCP client config.
 
 ## Development
 

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "memoryintelligence-mcp"
-version = "0.1.6"
+version = "0.1.8"
 description = "MCP server for MemoryIntelligence — give Claude a memory you own, set up in one command"
 readme = "README.md"
 license = "MIT"

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/src/mi_mcp/__init__.py

@@ -1,3 +1,3 @@
 """MI MCP Server — MemoryIntelligence tools for Claude."""
 
-__version__ = "0.1.6"
+__version__ = "0.1.8"

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/src/mi_mcp/cli.py

@@ -2,9 +2,9 @@
 
 Security model (build-spec §13.3): the API key NEVER goes into any MCP client
 config. ``wire`` writes ``{command: <wrapper>, args: [], env: {}}`` and renders
-a wrapper (``~/.mi/run-mi-mcp.sh``) that resolves ``MI_API_KEY`` at launch from
-the macOS Keychain, then ``~/.mi-env``, else fails. So a leaked config file
-exposes nothing.
+a wrapper (``~/.memoryintelligence/mcp/run-mi-mcp.sh``) that resolves
+``MI_API_KEY`` at launch from the macOS Keychain, then the on-disk keyfile,
+else fails. So a leaked config file exposes nothing.
 
   setup  — one command: store the key, wire hosts, opt in this dir, verify.
            (alias: ``init``). The frictionless front door for new users.
@@ -13,8 +13,12 @@ exposes nothing.
   status — show which surfaces are wired + the capture opt-in allowlist.
 
 The key is stored OUTSIDE every config — in the macOS Keychain (``security``)
-or, on Linux/Windows (or by choice), a ``chmod 600 ~/.mi-env`` keyfile. Both are
+or, on Linux/Windows (or by choice), a ``chmod 600 ~/.memoryintelligence/.env``
+keyfile (the legacy ``~/.mi-env`` is still read for back-compat). Both are
 resolved by the launch wrapper at runtime, so no config file ever holds a secret.
+
+The on-disk layout (launcher, opt-in allowlist, keyfile) lives under
+``~/.memoryintelligence/`` — see ``paths.py``, the single source of truth.
 """
 
 from __future__ import annotations
@@ -29,9 +33,14 @@ import sys
 import tempfile
 from pathlib import Path
 
+from . import paths
 from .config import load_opt_in_paths
 
-SERVER_KEY = "memory-intelligence"
+SERVER_KEY = "memoryintelligence"
+# Pre-0.1.8 server ids we replace on wire so an upgrade leaves no orphaned entry.
+# (0.1.7 and earlier registered the server as "memory-intelligence" — the one
+# dash-seam that didn't match the brand/package "memoryintelligence".)
+LEGACY_SERVER_KEYS = ("memory-intelligence",)
 
 # Wrapper rendered by `wire`. __MI_MCP_BIN__ is replaced with the absolute path
 # to the mi-mcp binary (resolved at wire time) so the host can spawn it even
@@ -41,15 +50,17 @@ WRAPPER_TEMPLATE = r"""#!/usr/bin/env bash
 # Resolves MI_API_KEY at launch so the key never lives in any MCP client config.
 set -euo pipefail
 
-# 1. inherited env  →  2. macOS Keychain  →  3. ~/.mi-env  →  fail
+# 1. inherited env  →  2. macOS Keychain  →  3. keyfile (new then legacy)  →  fail
 if [[ -z "${MI_API_KEY:-}" ]]; then
   MI_API_KEY="$(security find-generic-password -a "${MI_KEYCHAIN_ACCOUNT:-$USER}" -s "MI_API_KEY" -w 2>/dev/null || true)"
 fi
-if [[ -z "${MI_API_KEY:-}" && -f "$HOME/.mi-env" ]]; then
-  set -a; . "$HOME/.mi-env"; set +a
-fi
+for __mi_envf in "$HOME/.memoryintelligence/.env" "$HOME/.mi-env"; do
+  if [[ -z "${MI_API_KEY:-}" && -f "$__mi_envf" ]]; then
+    set -a; . "$__mi_envf"; set +a
+  fi
+done
 if [[ -z "${MI_API_KEY:-}" ]]; then
-  echo "run-mi-mcp: MI_API_KEY not found (env, Keychain service 'MI_API_KEY', or ~/.mi-env)" >&2
+  echo "run-mi-mcp: MI_API_KEY not found (env, Keychain service 'MI_API_KEY', or ~/.memoryintelligence/.env)" >&2
   exit 1
 fi
 export MI_API_KEY
@@ -72,7 +83,7 @@ def _surface_paths(home: Path) -> dict[str, Path]:
 
 
 def _wrapper_path(home: Path) -> Path:
-    return home / ".mi" / "run-mi-mcp.sh"
+    return paths.wrapper_path(home=home)
 
 
 def _mi_mcp_bin() -> str:
@@ -99,8 +110,10 @@ def _wire_code_via_cli(home: Path, wrapper: Path, dry_run: bool) -> bool:
     if dry_run:
         print(f"           would run: {' '.join(add_cmd)}")
         return True
-    # idempotent: drop any existing entry (any scope) first, then add
-    subprocess.run([claude, "mcp", "remove", SERVER_KEY], capture_output=True, text=True)
+    # idempotent + migrate: drop any existing entry — current id AND the legacy
+    # pre-0.1.8 ids — before re-adding, so an upgrade leaves no orphan.
+    for key in (SERVER_KEY, *LEGACY_SERVER_KEYS):
+        subprocess.run([claude, "mcp", "remove", key], capture_output=True, text=True)
     r = subprocess.run(add_cmd, capture_output=True, text=True)
     if r.returncode != 0:
         print(f"           ! claude mcp add failed ({r.stderr.strip()[:160]}); falling back to file")
@@ -155,13 +168,14 @@ def _resolve_key(home: Path) -> tuple[str, str]:
         if r.returncode == 0 and r.stdout.strip():
             return r.stdout.strip(), "keychain"
     except (OSError, subprocess.SubprocessError):
-        pass  # `security` unavailable/failed — fall through to the ~/.mi-env keyfile
-    envf = home / ".mi-env"
-    if envf.exists():
+        pass  # `security` unavailable/failed — fall through to the keyfile
+    envf = paths.resolve_keyfile(home)  # new ~/.memoryintelligence/.env, else legacy ~/.mi-env
+    if envf is not None:
+        src = "~/.mi-env" if envf.name == ".mi-env" else "~/.memoryintelligence/.env"
         for line in envf.read_text().splitlines():
             line = line.strip()
             if line.startswith("MI_API_KEY="):
-                return line.split("=", 1)[1].strip().strip('"').strip("'"), "~/.mi-env"
+                return line.split("=", 1)[1].strip().strip('"').strip("'"), src
     return "", "none"
 
 
@@ -175,26 +189,35 @@ def do_wire(home: Path, surfaces: list[str], dry_run: bool) -> None:
     Shared by ``cmd_wire`` and ``cmd_setup``. Writes ``env: {}`` only — the key is
     never placed in a config; the wrapper resolves it at launch.
     """
-    paths = _surface_paths(home)
+    cfg_paths = _surface_paths(home)
     wrapper = _wrapper_path(home)
     bin_path = _mi_mcp_bin()
     entry = {"command": str(wrapper), "args": [], "env": {}}
 
-    print(f"{'DRY-RUN: ' if dry_run else ''}wiring memory-intelligence MCP server")
+    print(f"{'DRY-RUN: ' if dry_run else ''}wiring {SERVER_KEY} MCP server")
     print(f"  wrapper → {wrapper}")
     print(f"           execs {bin_path}; resolves MI_API_KEY at launch (no key in configs)")
     if not dry_run:
         _atomic_write(wrapper, WRAPPER_TEMPLATE.replace("__MI_MCP_BIN__", bin_path), mode=0o755)
+        # Bring a legacy ~/.mi/opt-in-paths forward to the new location (no-op if
+        # there's nothing to migrate). Non-destructive — the old file is left.
+        if paths.migrate_opt_in_forward(home=home):
+            print(f"  migrated opt-in allowlist → {paths.opt_in_paths_file(home=home)}")
 
     for s in surfaces:
         if s == "code" and _wire_code_via_cli(home, wrapper, dry_run):
             continue
-        if s not in paths:
+        if s not in cfg_paths:
             print(f"  ! unknown surface '{s}' (skipped)")
             continue
-        cfg_path = paths[s]
+        cfg_path = cfg_paths[s]
         cfg = _load_json(cfg_path)
         servers = cfg.setdefault("mcpServers", {})
+        # Migrate: drop any pre-0.1.8 id (e.g. "memory-intelligence") so the
+        # rename to "memoryintelligence" doesn't leave a duplicate/orphan entry.
+        migrated = [k for k in LEGACY_SERVER_KEYS if servers.pop(k, None) is not None]
+        if migrated:
+            print(f"  {s:8} migrated id {', '.join(migrated)} → {SERVER_KEY}")
         action = "update" if SERVER_KEY in servers else "add"
         nochange = servers.get(SERVER_KEY) == entry
         servers[SERVER_KEY] = entry
@@ -219,7 +242,7 @@ def cmd_wire(argv: list[str]) -> int:
     do_wire(home, surfaces, args.dry_run)
     if not args.dry_run:
         print("\nNext steps:")
-        print(f"  1. opt in a project:  echo \"$(pwd)\" >> {home / '.mi' / 'opt-in-paths'}")
+        print(f"  1. opt in a project:  echo \"$(pwd)\" >> {paths.mcp_config_dir(home=home) / 'opt-in-paths'}")
         print("  2. restart Claude (MCP servers load at startup)")
         print("  3. mi-mcp doctor   # verify")
     return 0
@@ -251,15 +274,20 @@ def cmd_doctor(argv: list[str]) -> int:
     check("MI_API_KEY resolvable", bool(key),
           f"source={src}")
 
-    optin = home / ".mi" / "opt-in-paths"
+    optin = paths.opt_in_paths_file(home=home)
     n = len(load_opt_in_paths(optin)) if optin.exists() else 0
     check("opt-in allowlist", True,
           f"{n} entries" if optin.exists() else "absent — all captures will skip",
           critical=False)
 
     for s, p in _surface_paths(home).items():
-        wired = SERVER_KEY in _load_json(p).get("mcpServers", {})
-        check(f"{s} wired", wired, str(p) if wired else "(not wired)", critical=False)
+        servers = _load_json(p).get("mcpServers", {})
+        wired = SERVER_KEY in servers
+        legacy = [k for k in LEGACY_SERVER_KEYS if k in servers]
+        detail = str(p) if wired else "(not wired)"
+        if legacy and not wired:
+            detail = f"legacy id {', '.join(legacy)} present — run `mi-mcp wire` to migrate"
+        check(f"{s} wired", wired, detail, critical=False)
 
     print(f"\n  {'healthy ✓' if ok else 'issues found ✗'}")
     return 0 if ok else 1
@@ -276,12 +304,12 @@ def cmd_status(argv: list[str]) -> int:
         wired = SERVER_KEY in _load_json(p).get("mcpServers", {})
         print(f"  {s:8} {'wired ✓  ' if wired else 'not wired'}   {p}")
 
-    optin = home / ".mi" / "opt-in-paths"
-    paths = load_opt_in_paths(optin) if optin.exists() else []
-    print(f"\nOpt-in paths ({len(paths)}):")
-    for p in paths:
+    optin = paths.opt_in_paths_file(home=home)
+    opted = load_opt_in_paths(optin) if optin.exists() else []
+    print(f"\nOpt-in paths ({len(opted)}):")
+    for p in opted:
         print(f"  {p}")
-    if not paths:
+    if not opted:
         print("  (none — captures will be skipped until you add one)")
     return 0
 
@@ -379,13 +407,14 @@ def _store_key_keychain(key: str, account: str) -> None:
 
 
 def _store_key_file(home: Path, key: str) -> Path:
-    """Write the key to a ``chmod 600`` ``~/.mi-env`` keyfile (the launcher reads it).
+    """Write the key to a ``chmod 600`` ``~/.memoryintelligence/.env`` keyfile.
 
     The cross-platform fallback when there is no Keychain (Linux/Windows) or when
     the user explicitly chooses ``--store file``. Still NOT a config file: the
-    launch wrapper sources it at runtime; no MCP config ever holds the key.
+    launch wrapper sources it at runtime; no MCP config ever holds the key. (The
+    launcher still reads the legacy ``~/.mi-env`` too, for existing installs.)
     """
-    envf = home / ".mi-env"
+    envf = paths.keyfile_path(home)
     content = (
         "# MemoryIntelligence MCP — API key, resolved at launch by run-mi-mcp.sh.\n"
         "# Private (chmod 600). Never commit this file.\n"
@@ -396,12 +425,12 @@ def _store_key_file(home: Path, key: str) -> Path:
 
 
 def _opt_in_dir(home: Path, directory: str) -> tuple[Path, bool]:
-    """Add ``directory`` (realpath) to ``~/.mi/opt-in-paths`` if absent.
+    """Add ``directory`` (realpath) to ``~/.memoryintelligence/mcp/opt-in-paths``.
 
     Returns ``(file, added)``. Idempotent — re-running setup in the same dir does
     not duplicate the entry. Realpath normalization matches the consent gate.
     """
-    optin = home / ".mi" / "opt-in-paths"
+    optin = paths.mcp_config_dir(create=True, home=home) / "opt-in-paths"
     target = os.path.realpath(os.path.expanduser(directory))
     existing = load_opt_in_paths(optin) if optin.exists() else []
     if any(os.path.realpath(os.path.expanduser(p)) == target for p in existing):
@@ -422,7 +451,7 @@ def cmd_setup(argv: list[str]) -> int:
     ap.add_argument("--api-key", default=None,
                     help="provide the key non-interactively (else you're prompted, hidden)")
     ap.add_argument("--store", choices=["auto", "keychain", "file"], default="auto",
-                    help="where to keep the key (auto: Keychain on macOS, ~/.mi-env elsewhere)")
+                    help="where to keep the key (auto: Keychain on macOS, ~/.memoryintelligence/.env elsewhere)")
     ap.add_argument("--surfaces", default="desktop,code",
                     help="comma list of: desktop, code, cursor (default: desktop,code)")
     ap.add_argument("--opt-in", default=None, metavar="DIR",

memoryintelligence_mcp-0.1.8/src/mi_mcp/paths.py

@@ -0,0 +1,129 @@
+"""Filesystem layout for Memory Intelligence — one on-brand namespace.
+
+Single visible/hidden split, no lookalike names:
+
+  ~/MemoryIntelligence/          visible vault: the user's *.umo files (relocatable via MI_VAULT)
+  ~/.memoryintelligence/mcp/     hidden MCP config — launcher + capture opt-in allowlist
+  ~/.memoryintelligence/sdk/     hidden SDK plumbing (models, cache)
+  ~/.memoryintelligence/.env     on-disk keyfile (chmod 600) — cross-platform fallback to the Keychain
+  OS Keychain                    keys, preferred (never on disk)
+
+As of 0.1.7 ``mi-mcp setup``/``wire`` write this layout directly. The retired
+``~/.mi/`` config dir and ``~/.mi-env`` keyfile are still *read* (one-release
+fallback) so existing installs keep working until the next ``wire``; nothing is
+moved destructively. The opt-in allowlist is copied forward on ``wire``.
+
+Every resolver takes an optional ``home`` (used by the CLI's ``--home`` test
+flag and to keep read/write paths in lockstep); when ``None`` it resolves from
+``$MI_HOME`` then ``~``. This module is the SINGLE source of truth for the
+layout — the CLI and the server's consent gate both call it.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+
+HIDDEN_HOME_ENV = "MI_HOME"   # override the hidden plumbing home
+VAULT_ENV = "MI_VAULT"        # override the visible vault location
+
+
+def _home() -> Path:
+    return Path(os.path.expanduser("~"))
+
+
+def _base(home: Path | None) -> Path:
+    """The home under which the layout is rooted. An explicit ``home`` (CLI
+    ``--home``) wins; else ``~``. ``$MI_HOME`` overrides only the hidden tree."""
+    return Path(home) if home is not None else _home()
+
+
+def hidden_home(home: Path | None = None) -> Path:
+    """``~/.memoryintelligence`` (or ``$MI_HOME``, or ``<home>/.memoryintelligence``)."""
+    if home is not None:
+        return Path(home) / ".memoryintelligence"
+    override = os.environ.get(HIDDEN_HOME_ENV)
+    return Path(override).expanduser() if override else _home() / ".memoryintelligence"
+
+
+def mcp_config_dir(create: bool = False, home: Path | None = None) -> Path:
+    d = hidden_home(home) / "mcp"
+    if create:
+        d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def sdk_dir(create: bool = False, home: Path | None = None) -> Path:
+    d = hidden_home(home) / "sdk"
+    if create:
+        d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def legacy_mcp_dir(home: Path | None = None) -> Path:
+    """The retired ``~/.mi/`` directory (read-only fallback)."""
+    return _base(home) / ".mi"
+
+
+def vault_dir(create: bool = False, home: Path | None = None) -> Path:
+    """The visible ``~/MemoryIntelligence/`` vault (or ``$MI_VAULT``)."""
+    override = os.environ.get(VAULT_ENV)
+    if override:
+        d = Path(override).expanduser()
+    else:
+        d = _base(home) / "MemoryIntelligence"
+    if create:
+        d.mkdir(parents=True, exist_ok=True)
+    return d
+
+
+def wrapper_path(create: bool = False, home: Path | None = None) -> Path:
+    """The launch wrapper (``run-mi-mcp.sh``) that resolves MI_API_KEY at spawn."""
+    return mcp_config_dir(create=create, home=home) / "run-mi-mcp.sh"
+
+
+def keyfile_path(home: Path | None = None) -> Path:
+    """Preferred on-disk keyfile (``~/.memoryintelligence/.env``, chmod 600) — the
+    cross-platform fallback when there is no Keychain. Shared by mcp + sdk."""
+    return hidden_home(home) / ".env"
+
+
+def legacy_keyfile_path(home: Path | None = None) -> Path:
+    """The retired ``~/.mi-env`` keyfile, still read for back-compat (and the
+    ecosystem digest pipeline that points at it)."""
+    return _base(home) / ".mi-env"
+
+
+def resolve_keyfile(home: Path | None = None) -> Path | None:
+    """Existing keyfile to read — new location preferred, legacy fallback — or
+    ``None`` if neither exists (then only env/Keychain can supply the key)."""
+    for p in (keyfile_path(home), legacy_keyfile_path(home)):
+        if p.exists():
+            return p
+    return None
+
+
+def opt_in_paths_file(home: Path | None = None) -> Path:
+    """The capture-consent allowlist. New location preferred; falls back to the
+    legacy ``~/.mi/opt-in-paths`` if it exists and the new one doesn't."""
+    new = mcp_config_dir(home=home) / "opt-in-paths"
+    if new.exists():
+        return new
+    legacy = legacy_mcp_dir(home) / "opt-in-paths"
+    if legacy.exists():
+        return legacy
+    return new  # default to the new location for writes
+
+
+def migrate_opt_in_forward(home: Path | None = None) -> bool:
+    """Non-destructively copy the legacy opt-in allowlist to the new location if
+    the new one doesn't exist yet. Leaves ``~/.mi/`` intact. Returns True if it
+    copied."""
+    new = mcp_config_dir(home=home) / "opt-in-paths"
+    legacy = legacy_mcp_dir(home) / "opt-in-paths"
+    if new.exists() or not legacy.exists():
+        return False
+    new.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(legacy, new)
+    return True

{memoryintelligence_mcp-0.1.6 → memoryintelligence_mcp-0.1.8}/src/mi_mcp/server.py

@@ -42,7 +42,7 @@ logger = logging.getLogger("mi_mcp")
 # surface reduces agent decision-noise; the hidden tools stay callable by name.
 V0_VISIBLE_TOOLS = frozenset({"mi_capture", "mi_ask", "mi_list"})
 
-# Write tools — gated by the cwd consent allowlist (~/.mi/opt-in-paths, Story 8).
+# Write tools — gated by the cwd consent allowlist (~/.memoryintelligence/mcp/opt-in-paths, Story 8).
 # Read tools are never gated; reading your own memory is always safe.
 WRITE_TOOLS = frozenset({"mi_capture", "mi_batch", "mi_upload"})
 
@@ -139,7 +139,7 @@ def create_server(config: MIConfig | None = None) -> Server:
         config = MIConfig.from_env()
 
     client = MIClient(config)
-    server = Server("memory-intelligence", instructions=SERVER_INSTRUCTIONS)
+    server = Server("memoryintelligence", instructions=SERVER_INSTRUCTIONS)
 
     if os.environ.get("MI_MCP_OPT_IN_ALL") == "1":
         logger.warning(
@@ -534,7 +534,7 @@ def create_server(config: MIConfig | None = None) -> Server:
                 logger.info(f"[CONSENT] {name} skipped — cwd not opted in: {cwd}")
                 return [TextContent(type="text", text=_fmt({
                     "status": "skipped",
-                    "reason": "cwd not opted in — add it to ~/.mi/opt-in-paths (or set MI_MCP_OPT_IN_ALL=1)",
+                    "reason": "cwd not opted in — run `mi-mcp setup` here, or add it to ~/.memoryintelligence/mcp/opt-in-paths (or set MI_MCP_OPT_IN_ALL=1)",
                     "cwd": cwd,
                     "tool": name,
                 }))]

memoryintelligence_mcp-0.1.6/src/mi_mcp/paths.py

@@ -1,86 +0,0 @@
-"""Filesystem layout for Memory Intelligence (locked 2026-06-05).
-
-One brand namespace, clear visibility split — no lookalike names:
-
-  ~/MemoryIntelligence/          visible vault: the user's *.umo files (relocatable via MI_VAULT)
-  ~/.memoryintelligence/mcp/     hidden MCP config (opt-in-paths, launcher)
-  ~/.memoryintelligence/sdk/     hidden SDK plumbing (models, cache)
-  OS Keychain                    keys (never on disk)
-
-Retires the legacy ``~/.mi/`` config dir: path resolution prefers the new
-location but falls back to ``~/.mi/`` for one release so existing wiring keeps
-working. Nothing is moved destructively — the launcher relocates on the next
-``mi-mcp wire``; only the opt-in allowlist is (non-destructively) copied forward.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-from pathlib import Path
-
-HIDDEN_HOME_ENV = "MI_HOME"   # override the hidden plumbing home
-VAULT_ENV = "MI_VAULT"        # override the visible vault location
-
-
-def _home() -> Path:
-    return Path(os.path.expanduser("~"))
-
-
-def hidden_home() -> Path:
-    """``~/.memoryintelligence`` (or ``$MI_HOME``)."""
-    override = os.environ.get(HIDDEN_HOME_ENV)
-    return Path(override).expanduser() if override else _home() / ".memoryintelligence"
-
-
-def mcp_config_dir(create: bool = False) -> Path:
-    d = hidden_home() / "mcp"
-    if create:
-        d.mkdir(parents=True, exist_ok=True)
-    return d
-
-
-def sdk_dir(create: bool = False) -> Path:
-    d = hidden_home() / "sdk"
-    if create:
-        d.mkdir(parents=True, exist_ok=True)
-    return d
-
-
-def legacy_mcp_dir() -> Path:
-    """The retired ``~/.mi/`` directory."""
-    return _home() / ".mi"
-
-
-def vault_dir(create: bool = False) -> Path:
-    """The visible ``~/MemoryIntelligence/`` vault (or ``$MI_VAULT``)."""
-    override = os.environ.get(VAULT_ENV)
-    d = Path(override).expanduser() if override else _home() / "MemoryIntelligence"
-    if create:
-        d.mkdir(parents=True, exist_ok=True)
-    return d
-
-
-def opt_in_paths_file() -> Path:
-    """The capture-consent allowlist. New location preferred; falls back to the
-    legacy ``~/.mi/opt-in-paths`` if it exists and the new one doesn't."""
-    new = mcp_config_dir() / "opt-in-paths"
-    if new.exists():
-        return new
-    legacy = legacy_mcp_dir() / "opt-in-paths"
-    if legacy.exists():
-        return legacy
-    return new  # default to the new location for writes
-
-
-def migrate_opt_in_forward() -> bool:
-    """Non-destructively copy the legacy opt-in allowlist to the new location if
-    the new one doesn't exist yet. Leaves ``~/.mi/`` intact (the launcher there
-    keeps working until the next ``mi-mcp wire``). Returns True if it copied."""
-    new = mcp_config_dir() / "opt-in-paths"
-    legacy = legacy_mcp_dir() / "opt-in-paths"
-    if new.exists() or not legacy.exists():
-        return False
-    new.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copy2(legacy, new)
-    return True