memoryintelligence-mcp 0.2.0__tar.gz → 0.2.1__tar.gz

{memoryintelligence_mcp-0.2.0 → memoryintelligence_mcp-0.2.1}/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to `memoryintelligence-mcp` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/); this project uses [Semantic Versioning](https://semver.org/).
 
+## [0.2.1] — 2026-07-05
+
+### Fixed — one shared vault with the MemorySpace Desktop (MI#653)
+`0.2.0` noted that `mi-mcp` defaulted its local `.umo` vault to `~/MemoryIntelligence`
+while the MemorySpace Desktop app reads `~/Somewhere` — two separate folders, so a
+memory captured or backfilled through `mi-mcp` never showed up in the Desktop app, and
+told you to point `MI_VAULT` there by hand. This release makes that automatic.
+
+- **`mi-mcp wire` / `setup` now point the vault at `~/Somewhere`** — they write
+  `export MI_VAULT="$HOME/Somewhere"` into the launcher (`run-mi-mcp.sh`), so `mi-mcp`
+  and the Desktop resolve **one** vault out of the box. It's a default only: it's
+  guarded so an explicit `MI_VAULT` you set yourself (env or MCP config) still wins.
+- **`paths.py`'s default is unchanged** (`~/MemoryIntelligence`) — existing installs are
+  never silently moved; the unification happens the next time you run `wire`.
+- **`mi-mcp doctor` reports the effective vault** and whether it matches the Desktop's,
+  reading the value the launcher will actually use — so the check goes green once wired.
+
+**To pick this up:** upgrade, then **re-run `mi-mcp wire`** (upgrading alone doesn't
+rewrite the launcher), and restart Claude Desktop. `mi-mcp doctor` should show the vault
+as `~/Somewhere`. Files already backfilled into `~/MemoryIntelligence` by `0.2.0` stay
+where they are — move them into `~/Somewhere` (or re-run `backfill`) if you want them in
+the app; `doctor` flags the mismatch.
+
 ## [0.2.0] — 2026-07-04
 
 ### Added — the local vault (Path A), previously built on `main` but never released

memoryintelligence_mcp-0.2.1/PKG-INFO

@@ -0,0 +1,237 @@
+Metadata-Version: 2.4
+Name: memoryintelligence-mcp
+Version: 0.2.1
+Summary: MCP server for MemoryIntelligence — give Claude a memory you own, set up in one command
+Project-URL: Homepage, https://memoryintelligence.io
+Project-URL: Repository, https://github.com/somewhere11/memoryintelligence-mcp
+Project-URL: Issues, https://github.com/somewhere11/memoryintelligence-mcp/issues
+Project-URL: Changelog, https://github.com/somewhere11/memoryintelligence-mcp/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://memoryintelligence.io/docs/api-reference
+Author-email: Somewhere <connect@somewheremedia.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai,claude,llm,mcp,memory,memory-intelligence,model-context-protocol
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: httpx<1.0,>=0.27.0
+Requires-Dist: mcp[cli]<2.0,>=1.0.0
+Requires-Dist: pydantic<3.0,>=2.5.0
+Provides-Extra: dev
+Requires-Dist: cryptography<46,>=42.0; extra == 'dev'
+Requires-Dist: fastembed<1.0,>=0.3.0; extra == 'dev'
+Requires-Dist: numpy<3,>=1.24; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.4.0; extra == 'dev'
+Provides-Extra: local
+Requires-Dist: cryptography<46,>=42.0; extra == 'local'
+Requires-Dist: fastembed<1.0,>=0.3.0; extra == 'local'
+Requires-Dist: numpy<3,>=1.24; extra == 'local'
+Description-Content-Type: text/markdown
+
+# MemoryIntelligence MCP Server
+
+[![PyPI](https://img.shields.io/pypi/v/memoryintelligence-mcp.svg)](https://pypi.org/project/memoryintelligence-mcp/)
+[![Python](https://img.shields.io/pypi/pyversions/memoryintelligence-mcp.svg)](https://pypi.org/project/memoryintelligence-mcp/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![MCP](https://img.shields.io/badge/MCP-server-blue.svg)](https://modelcontextprotocol.io)
+
+> ## Stop paying AI to reread the same context.
+
+Receipted memory for your AI, via MCP. What you tell your assistant becomes
+**structured memory you own** — recalled by meaning, with **every answer cited to
+its source**. Works with Claude Desktop, Claude Code, Cursor, VS Code, and any MCP client.
+
+## Start in 30 seconds
+
+```bash
+pip install memoryintelligence-mcp     # or: pipx / uvx / uv tool install
+mi-mcp setup                           # paste your key once — wires everything
+# restart your assistant, then just talk to it:
+#   "remember we picked Postgres for billing — we needed transactions"
+#   (new session)  "what did we decide about the billing database?"
+```
+
+`mi-mcp setup` stores your key **securely** (macOS Keychain, or a `chmod 600`
+keyfile), wires your assistants, opts the current folder in for capture, and
+verifies it — in one command. **Your API key is never written into a config file.**
+
+**👉 [Get a free API key](https://memoryintelligence.io/portal)** ·
+[Product](https://memoryintelligence.io) ·
+[Issues](https://github.com/somewhere11/memoryintelligence-mcp/issues)
+
+## What you get
+
+Three tools, ready the moment it's wired — a compatible host (Claude Desktop,
+Claude Code, Cursor) **recalls and captures on its own**, no prompts to memorize:
+
+| Tool | What it does | Try saying |
+|------|-------------|-----------|
+| `mi_capture` | Save a decision, fact, or preference | *"Remember we chose Postgres for billing — we needed transactions."* |
+| `mi_ask` | Search your memory by meaning, with citations | *"What did we decide about the billing database?"* |
+| `mi_list` | Browse recent memories | *"List what I've saved this week."* |
+
+And four things that make it more than a notepad:
+
+- **Receipted** — every recall cites the memory it came from. It cites, it doesn't guess.
+- **Reusable** — capture once, recall by meaning across every session and every tool.
+- **Owned** — memories are portable structured objects in *your* account, not locked in a model.
+- **Private** — capture is opt-in per project; PII is redacted from what the agent sees.
+
+> Set `MI_MCP_FULL=1` for the full surface (`mi_upload`, `mi_verify`, `mi_forget`,
+> `mi_batch`, `mi_explain`, `mi_match`, `mi_account`). Tools outside the active
+> surface are rejected at the call boundary, not just hidden.
+
+## How it works
+
+```
+You ──"Remember we picked Postgres for billing — we needed transactions."──┐
+                                                                mi_capture  ▼
+                    ┌──────────────────────────────────────────────────────┐
+                    │  MemoryIntelligence  (your account, over HTTPS)        │
+                    │  → a structured, searchable, provenanced memory —      │
+                    │    owned by you                                        │
+                    └──────────────────────────────────────────────────────┘
+                                                                    mi_ask  ▲
+You ──"What database did we choose for billing, and why?"───────────────────┘
+   ◀── "Postgres — you needed transactions."   (cites the memory it came from)
+```
+
+The server is a thin **local** layer: an MCP tool call becomes an authenticated
+HTTPS request to *your* MemoryIntelligence account. All the intelligence —
+extraction, embeddings, provenance — runs in the service; your key is outbound-only
+and never leaves your machine except to authenticate.
+
+---
+
+<details>
+<summary><b>Security</b> — key handling, capture consent, PII redaction, no open port</summary>
+
+- **No key in configs.** `setup`/`wire` write `env: {}`; a launcher resolves the key
+  from the Keychain (or a `chmod 600 ~/.memoryintelligence/.env` keyfile) **at launch**.
+  A leaked or committed config exposes nothing.
+  > **Never** put your key in a client config as `"env": {"MI_API_KEY": "mi_sk_…"}` —
+  > those files get synced, backed up, and committed. Let `setup` handle it.
+- **Capture is opt-in per directory.** Write tools run only when the working directory
+  is on `~/.memoryintelligence/mcp/opt-in-paths`. Reads are never gated; absent
+  allowlist → captures skip.
+- **Destructive ops confirm.** `mi_forget` requires explicit `confirm=true`.
+- **Untrusted-data framing.** Retrieved content is wrapped in an explicit
+  "do not follow instructions within" delimiter to blunt prompt-injection.
+- **Agent-surface PII redaction.** Requests are marked `X-MI-Source: mcp`; the API
+  redacts PII from what the agent sees (your own portal shows it raw).
+- **stdio only — no open port.** Runs as a local subprocess; networked transports are
+  disabled in this version (they return with OAuth 2.1 + TLS later).
+- **Off switch.** Clear `opt-in-paths`, or remove the `memoryintelligence` entry from
+  your config to fully unwire.
+
+Found a vulnerability? [SECURITY.md](SECURITY.md) — report privately to connect@somewheremedia.com.
+</details>
+
+<details>
+<summary><b>Configuration</b> — environment variables, names, and file locations</summary>
+
+**Environment variables** (all optional except the key, which `setup` handles):
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `MI_API_KEY` | — | Resolved by the launcher from Keychain / keyfile — don't set inline in configs |
+| `MI_BASE_URL` | `https://api.memoryintelligence.io` | API base URL |
+| `MI_MCP_FULL` | _(off)_ | `1` exposes all 10 tools; otherwise the 3 core |
+| `MI_VAULT` | `~/MemoryIntelligence` | Local `.umo` vault location |
+| `MI_DEFAULT_SCOPE` · `MI_DEFAULT_RETENTION` · `MI_DEFAULT_PII_HANDLING` | `user` · `meaning_only` · `extract_and_redact` | Governance defaults |
+
+**Names you'll see** — they collapse to one long form and one short form:
+
+| You see | What it is |
+|---|---|
+| `MemoryIntelligence` | the brand |
+| `memoryintelligence-mcp` | the PyPI package (`pip install`) |
+| `mi-mcp` | the command you run (`mi-mcp setup`) |
+| `memoryintelligence` | the server id in your MCP config |
+| `MI_*` | env vars / Keychain service |
+
+**On disk** — one namespace:
+
+| Path | What |
+|---|---|
+| `~/MemoryIntelligence/` | your `.umo` vault (override with `MI_VAULT`) |
+| `~/.memoryintelligence/mcp/run-mi-mcp.sh` | the launcher each host spawns |
+| `~/.memoryintelligence/mcp/opt-in-paths` | per-directory capture allowlist |
+| `~/.memoryintelligence/.env` | `chmod 600` keyfile (Keychain fallback) |
+</details>
+
+<details>
+<summary><b>Manual & cross-platform setup</b> — do it by hand, or script it</summary>
+
+`mi-mcp setup` is the recommended path everywhere. To do it manually, store the key
+where your platform fits, then run `mi-mcp wire`:
+
+```bash
+# macOS — Keychain:
+read -s K; security add-generic-password -a "$USER" -s "MI_API_KEY" -w "$K" -U; unset K
+
+# Linux / Windows — chmod 600 keyfile:
+mkdir -p ~/.memoryintelligence
+umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.memoryintelligence/.env
+
+# then, on any OS:
+mi-mcp wire
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths   # allow captures here
+```
+
+The launcher resolves the key in order: **inherited env → macOS Keychain → keyfile**.
+Never paste the key into an MCP client config.
+
+**Repair / inspect without re-running setup:**
+```bash
+mi-mcp doctor           # checks binary, PATH, key, wiring, opt-in, vault path
+mi-mcp status           # wired surfaces + opt-in allowlist
+mi-mcp wire --dry-run   # preview wiring changes
+```
+</details>
+
+<details>
+<summary><b>VS Code / GitHub Copilot</b></summary>
+
+VS Code / Copilot read a different config than Claude: servers live under `"servers"`
+(not `"mcpServers"`) and need `"type": "stdio"`. `mi-mcp wire --surfaces vscode` writes
+it, or add per-workspace `.vscode/mcp.json`:
+
+```json
+{ "servers": { "memoryintelligence": { "type": "stdio", "command": "mi-mcp" } } }
+```
+
+Then open Copilot Chat in **Agent** mode — the memory tools only appear there.
+</details>
+
+<details>
+<summary><b>Development</b></summary>
+
+```bash
+pip install -e ".[dev]"          # from mcp-server/
+PYTHONPATH=src python -m pytest
+ruff check src/
+```
+`src/mi_mcp/`: `__main__.py` (CLI + dispatch) · `cli.py` (setup/wire/doctor) ·
+`config.py` (consent gate) · `client.py` (MI API) · `server.py` (tools + instructions).
+Contributions welcome — [CONTRIBUTING.md](CONTRIBUTING.md).
+</details>
+
+---
+
+**Learn more:** [memoryintelligence.io](https://memoryintelligence.io) ·
+[Get a key](https://memoryintelligence.io/portal) ·
+[API reference](https://memoryintelligence.io/docs/api-reference) ·
+[What is MCP](https://modelcontextprotocol.io) ·
+[Changelog](CHANGELOG.md)
+
+MIT © Somewhere. See [LICENSE](LICENSE).

memoryintelligence_mcp-0.2.1/README.md

@@ -0,0 +1,198 @@
+# MemoryIntelligence MCP Server
+
+[![PyPI](https://img.shields.io/pypi/v/memoryintelligence-mcp.svg)](https://pypi.org/project/memoryintelligence-mcp/)
+[![Python](https://img.shields.io/pypi/pyversions/memoryintelligence-mcp.svg)](https://pypi.org/project/memoryintelligence-mcp/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![MCP](https://img.shields.io/badge/MCP-server-blue.svg)](https://modelcontextprotocol.io)
+
+> ## Stop paying AI to reread the same context.
+
+Receipted memory for your AI, via MCP. What you tell your assistant becomes
+**structured memory you own** — recalled by meaning, with **every answer cited to
+its source**. Works with Claude Desktop, Claude Code, Cursor, VS Code, and any MCP client.
+
+## Start in 30 seconds
+
+```bash
+pip install memoryintelligence-mcp     # or: pipx / uvx / uv tool install
+mi-mcp setup                           # paste your key once — wires everything
+# restart your assistant, then just talk to it:
+#   "remember we picked Postgres for billing — we needed transactions"
+#   (new session)  "what did we decide about the billing database?"
+```
+
+`mi-mcp setup` stores your key **securely** (macOS Keychain, or a `chmod 600`
+keyfile), wires your assistants, opts the current folder in for capture, and
+verifies it — in one command. **Your API key is never written into a config file.**
+
+**👉 [Get a free API key](https://memoryintelligence.io/portal)** ·
+[Product](https://memoryintelligence.io) ·
+[Issues](https://github.com/somewhere11/memoryintelligence-mcp/issues)
+
+## What you get
+
+Three tools, ready the moment it's wired — a compatible host (Claude Desktop,
+Claude Code, Cursor) **recalls and captures on its own**, no prompts to memorize:
+
+| Tool | What it does | Try saying |
+|------|-------------|-----------|
+| `mi_capture` | Save a decision, fact, or preference | *"Remember we chose Postgres for billing — we needed transactions."* |
+| `mi_ask` | Search your memory by meaning, with citations | *"What did we decide about the billing database?"* |
+| `mi_list` | Browse recent memories | *"List what I've saved this week."* |
+
+And four things that make it more than a notepad:
+
+- **Receipted** — every recall cites the memory it came from. It cites, it doesn't guess.
+- **Reusable** — capture once, recall by meaning across every session and every tool.
+- **Owned** — memories are portable structured objects in *your* account, not locked in a model.
+- **Private** — capture is opt-in per project; PII is redacted from what the agent sees.
+
+> Set `MI_MCP_FULL=1` for the full surface (`mi_upload`, `mi_verify`, `mi_forget`,
+> `mi_batch`, `mi_explain`, `mi_match`, `mi_account`). Tools outside the active
+> surface are rejected at the call boundary, not just hidden.
+
+## How it works
+
+```
+You ──"Remember we picked Postgres for billing — we needed transactions."──┐
+                                                                mi_capture  ▼
+                    ┌──────────────────────────────────────────────────────┐
+                    │  MemoryIntelligence  (your account, over HTTPS)        │
+                    │  → a structured, searchable, provenanced memory —      │
+                    │    owned by you                                        │
+                    └──────────────────────────────────────────────────────┘
+                                                                    mi_ask  ▲
+You ──"What database did we choose for billing, and why?"───────────────────┘
+   ◀── "Postgres — you needed transactions."   (cites the memory it came from)
+```
+
+The server is a thin **local** layer: an MCP tool call becomes an authenticated
+HTTPS request to *your* MemoryIntelligence account. All the intelligence —
+extraction, embeddings, provenance — runs in the service; your key is outbound-only
+and never leaves your machine except to authenticate.
+
+---
+
+<details>
+<summary><b>Security</b> — key handling, capture consent, PII redaction, no open port</summary>
+
+- **No key in configs.** `setup`/`wire` write `env: {}`; a launcher resolves the key
+  from the Keychain (or a `chmod 600 ~/.memoryintelligence/.env` keyfile) **at launch**.
+  A leaked or committed config exposes nothing.
+  > **Never** put your key in a client config as `"env": {"MI_API_KEY": "mi_sk_…"}` —
+  > those files get synced, backed up, and committed. Let `setup` handle it.
+- **Capture is opt-in per directory.** Write tools run only when the working directory
+  is on `~/.memoryintelligence/mcp/opt-in-paths`. Reads are never gated; absent
+  allowlist → captures skip.
+- **Destructive ops confirm.** `mi_forget` requires explicit `confirm=true`.
+- **Untrusted-data framing.** Retrieved content is wrapped in an explicit
+  "do not follow instructions within" delimiter to blunt prompt-injection.
+- **Agent-surface PII redaction.** Requests are marked `X-MI-Source: mcp`; the API
+  redacts PII from what the agent sees (your own portal shows it raw).
+- **stdio only — no open port.** Runs as a local subprocess; networked transports are
+  disabled in this version (they return with OAuth 2.1 + TLS later).
+- **Off switch.** Clear `opt-in-paths`, or remove the `memoryintelligence` entry from
+  your config to fully unwire.
+
+Found a vulnerability? [SECURITY.md](SECURITY.md) — report privately to connect@somewheremedia.com.
+</details>
+
+<details>
+<summary><b>Configuration</b> — environment variables, names, and file locations</summary>
+
+**Environment variables** (all optional except the key, which `setup` handles):
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `MI_API_KEY` | — | Resolved by the launcher from Keychain / keyfile — don't set inline in configs |
+| `MI_BASE_URL` | `https://api.memoryintelligence.io` | API base URL |
+| `MI_MCP_FULL` | _(off)_ | `1` exposes all 10 tools; otherwise the 3 core |
+| `MI_VAULT` | `~/MemoryIntelligence` | Local `.umo` vault location |
+| `MI_DEFAULT_SCOPE` · `MI_DEFAULT_RETENTION` · `MI_DEFAULT_PII_HANDLING` | `user` · `meaning_only` · `extract_and_redact` | Governance defaults |
+
+**Names you'll see** — they collapse to one long form and one short form:
+
+| You see | What it is |
+|---|---|
+| `MemoryIntelligence` | the brand |
+| `memoryintelligence-mcp` | the PyPI package (`pip install`) |
+| `mi-mcp` | the command you run (`mi-mcp setup`) |
+| `memoryintelligence` | the server id in your MCP config |
+| `MI_*` | env vars / Keychain service |
+
+**On disk** — one namespace:
+
+| Path | What |
+|---|---|
+| `~/MemoryIntelligence/` | your `.umo` vault (override with `MI_VAULT`) |
+| `~/.memoryintelligence/mcp/run-mi-mcp.sh` | the launcher each host spawns |
+| `~/.memoryintelligence/mcp/opt-in-paths` | per-directory capture allowlist |
+| `~/.memoryintelligence/.env` | `chmod 600` keyfile (Keychain fallback) |
+</details>
+
+<details>
+<summary><b>Manual & cross-platform setup</b> — do it by hand, or script it</summary>
+
+`mi-mcp setup` is the recommended path everywhere. To do it manually, store the key
+where your platform fits, then run `mi-mcp wire`:
+
+```bash
+# macOS — Keychain:
+read -s K; security add-generic-password -a "$USER" -s "MI_API_KEY" -w "$K" -U; unset K
+
+# Linux / Windows — chmod 600 keyfile:
+mkdir -p ~/.memoryintelligence
+umask 077 && printf 'MI_API_KEY="%s"\n' "$YOUR_KEY" > ~/.memoryintelligence/.env
+
+# then, on any OS:
+mi-mcp wire
+echo "$(pwd)" >> ~/.memoryintelligence/mcp/opt-in-paths   # allow captures here
+```
+
+The launcher resolves the key in order: **inherited env → macOS Keychain → keyfile**.
+Never paste the key into an MCP client config.
+
+**Repair / inspect without re-running setup:**
+```bash
+mi-mcp doctor           # checks binary, PATH, key, wiring, opt-in, vault path
+mi-mcp status           # wired surfaces + opt-in allowlist
+mi-mcp wire --dry-run   # preview wiring changes
+```
+</details>
+
+<details>
+<summary><b>VS Code / GitHub Copilot</b></summary>
+
+VS Code / Copilot read a different config than Claude: servers live under `"servers"`
+(not `"mcpServers"`) and need `"type": "stdio"`. `mi-mcp wire --surfaces vscode` writes
+it, or add per-workspace `.vscode/mcp.json`:
+
+```json
+{ "servers": { "memoryintelligence": { "type": "stdio", "command": "mi-mcp" } } }
+```
+
+Then open Copilot Chat in **Agent** mode — the memory tools only appear there.
+</details>
+
+<details>
+<summary><b>Development</b></summary>
+
+```bash
+pip install -e ".[dev]"          # from mcp-server/
+PYTHONPATH=src python -m pytest
+ruff check src/
+```
+`src/mi_mcp/`: `__main__.py` (CLI + dispatch) · `cli.py` (setup/wire/doctor) ·
+`config.py` (consent gate) · `client.py` (MI API) · `server.py` (tools + instructions).
+Contributions welcome — [CONTRIBUTING.md](CONTRIBUTING.md).
+</details>
+
+---
+
+**Learn more:** [memoryintelligence.io](https://memoryintelligence.io) ·
+[Get a key](https://memoryintelligence.io/portal) ·
+[API reference](https://memoryintelligence.io/docs/api-reference) ·
+[What is MCP](https://modelcontextprotocol.io) ·
+[Changelog](CHANGELOG.md)
+
+MIT © Somewhere. See [LICENSE](LICENSE).

{memoryintelligence_mcp-0.2.0 → memoryintelligence_mcp-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "memoryintelligence-mcp"
-version = "0.2.0"
+version = "0.2.1"
 description = "MCP server for MemoryIntelligence — give Claude a memory you own, set up in one command"
 readme = "README.md"
 license = "MIT"

{memoryintelligence_mcp-0.2.0 → memoryintelligence_mcp-0.2.1}/src/mi_mcp/__init__.py

@@ -1,3 +1,3 @@
 """MI MCP Server — MemoryIntelligence tools for Claude."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{memoryintelligence_mcp-0.2.0 → memoryintelligence_mcp-0.2.1}/src/mi_mcp/cli.py

@@ -30,6 +30,7 @@ import argparse
 import getpass
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -72,6 +73,16 @@ if [[ -z "${MI_API_KEY:-}" ]]; then
 fi
 export MI_API_KEY
 
+# Point the local .umo vault at the MemorySpace Desktop vault (~/Somewhere) so
+# both surfaces resolve ONE vault (#653). Without this, mi-mcp defaults to
+# ~/MemoryIntelligence and backfilled memories never appear in the Desktop (and
+# on a dev machine ~/MemoryIntelligence is the monorepo checkout itself). An
+# explicit MI_VAULT (inherited env or a config `env` entry) still wins — we only
+# fill the default.
+if [[ -z "${MI_VAULT:-}" ]]; then
+  export MI_VAULT="$HOME/Somewhere"
+fi
+
 # Resolve the mi-mcp binary. The path captured at `wire` time is tried first —
 # it's the most reliable under a host's minimal GUI PATH (e.g. Claude Desktop).
 # If a reinstall/upgrade moved it, fall back to PATH then the common install
@@ -128,6 +139,23 @@ def _wrapper_path(home: Path) -> Path:
     return paths.wrapper_path(home=home)
 
 
+def _wrapper_vault(home: Path) -> Path | None:
+    """The ``MI_VAULT`` default baked into the rendered wrapper by ``wire``, if any.
+
+    The wrapper ``export MI_VAULT="$HOME/Somewhere"``s (behind a guard) so the
+    server resolves the same vault as the Desktop (#653). ``doctor`` reads it to
+    report the vault the *server* will actually use at launch — which isn't
+    necessarily set in the shell running ``doctor``. Returns ``None`` if the
+    wrapper is absent or sets no vault default."""
+    wrapper = _wrapper_path(home)
+    if not wrapper.exists():
+        return None
+    m = re.search(r'MI_VAULT="([^"]*)"', wrapper.read_text())
+    if not m:
+        return None
+    return Path(m.group(1).replace("$HOME", str(home))).expanduser()
+
+
 def _mi_mcp_bin() -> str:
     return shutil.which("mi-mcp") or str(Path(sys.executable).parent / "mi-mcp")
 
@@ -379,19 +407,33 @@ def cmd_doctor(argv: list[str]) -> int:
           f"{n} entries" if optin.exists() else "absent — all captures will skip",
           critical=False)
 
-    # Vault path — surface where the local vault resolves and whether it matches the
-    # MemorySpace Desktop vault (~/Somewhere). They differ by default (#653): mi-mcp
-    # defaults to ~/MemoryIntelligence; the Desktop reads ~/Somewhere. If MI_VAULT
-    # isn't unifying them, backfilled memories won't appear in the Desktop.
-    from . import vault as _vault
-    vpath = _vault.vault_path()
+    # Vault path — where the local .umo vault resolves, and whether it matches the
+    # MemorySpace Desktop vault (~/Somewhere). By default they differ (#653): mi-mcp
+    # defaults to ~/MemoryIntelligence, the Desktop reads ~/Somewhere. `mi-mcp wire`
+    # bakes `MI_VAULT="$HOME/Somewhere"` into the wrapper to unify them, so the
+    # EFFECTIVE vault is the one the wrapper exports when it spawns the server — not
+    # necessarily what's set in this doctor shell. Resolve in that order: a live
+    # MI_VAULT (an explicit override always wins) → the wrapper's baked-in default →
+    # the paths default.
     desktop_vault = home / "Somewhere"
-    mi_vault_set = "MI_VAULT" in os.environ
+    live_vault = os.environ.get("MI_VAULT")
+    if live_vault:
+        vpath, vsrc = Path(live_vault).expanduser(), "MI_VAULT env"
+    elif (wired := _wrapper_vault(home)) is not None:
+        vpath, vsrc = wired, "wrapper (wired)"
+    else:
+        vpath, vsrc = paths.vault_dir(home=home), "default"
     matches = vpath.resolve() == desktop_vault.resolve()
-    check("vault path", matches or mi_vault_set,
-          str(vpath) if matches else
-          f"{vpath} — Desktop reads {desktop_vault}; set MI_VAULT={desktop_vault} so both share one vault (#653)",
-          critical=False)
+    # Green when it resolves to the Desktop vault, or when the user set an explicit
+    # MI_VAULT of their own (their choice wins — we don't second-guess it). Only the
+    # unresolved default (mismatch, no explicit override) gets the #653 nag.
+    green = matches or bool(live_vault)
+    if green:
+        detail = f"{vpath}  [{vsrc}]"
+    else:
+        detail = (f"{vpath} [{vsrc}] — Desktop reads {desktop_vault}; run `mi-mcp wire` "
+                  f"(bakes MI_VAULT={desktop_vault}) so both share one vault (#653)")
+    check("vault path", green, detail, critical=False)
 
     for s, p in _surface_paths(home).items():
         servers = _load_json(p).get(_surface_key(s), {})

{memoryintelligence_mcp-0.2.0 → memoryintelligence_mcp-0.2.1}/src/mi_mcp/umo_format.py

@@ -36,11 +36,14 @@ from dataclasses import dataclass
 MAGIC = b"UMO!"  # 0x554D4F21
 FORMAT_VERSION = 0x0100  # canonical FEAT-0051 v1.0
 
-# Shared cross-surface conventions (the unified local home). The Rust desktop app
-# ("Somewhere") writes these same values, so files written by the MCP and by the
-# desktop are mutually readable in one vault. owner_did is a plaintext metadata
-# label only (NOT used in decryption — that's the X25519 key), so a fixed value is
-# safe and keeps the home consistent.
+# Shared cross-surface .umo conventions. The Rust desktop app ("Somewhere") writes
+# these same values, so a file written by the MCP and one written by the desktop
+# are mutually READABLE — but only when both surfaces point at the SAME directory.
+# By default they do NOT: mi-mcp resolves ~/MemoryIntelligence while the desktop
+# reads ~/Somewhere (#653), so identical conventions in two dirs are two vaults,
+# not one. `mi-mcp wire` bakes MI_VAULT=~/Somewhere into its launcher to unify them.
+# owner_did is a plaintext metadata label only (NOT used in decryption — that's the
+# X25519 key), so a fixed value is safe and keeps the conventions consistent.
 LOCAL_OWNER_DID = "did:mi:owner-local"
 FORMAT_VERSION_STR = "0x0100"  # string form the desktop stores in public_metadata
 _HKDF_INFO = b"umo-cek-wrap-v1"