Five high-confidence findings from the post-merge reviewer pass:
1. memory.update MCP tool description claimed "Project is upserted if it
doesn't exist", but the handler used resolveProjectId and would error.
Matched the description to the actual behavior (call project.identify
first) — keeps parity with memory.write.
2. updateMemoryAction's UPDATE statement was missing the userId guard.
The preceding scoped SELECT made it not exploitable in practice, but
it diverged from deleteMemoryAction's pattern. Added the guard for
defense in depth.
3. putSnippet's UPDATE statement had the same missing userId guard —
fixed the same way.
4. MemoryUpdateInput's refine for scope='user' accepted both
project=undefined AND project=""; the snippets refine only accepted
undefined. Tightened MemoryUpdateInput to require undefined, matching
the snippets rule. Web actions already coerce "" → undefined before
parsing, so no caller is affected.
5. 0002_snippets_scope.sql created two indexes unconditionally —
replaced with CREATE INDEX IF NOT EXISTS so re-runs after a
drizzle-kit push won't trip.
Also adds .claude/ to .gitignore so worktree directories from
multi-agent builds aren't accidentally committed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extends both the Web UI edit form and the memory.update MCP tool so
existing memories can be reclassified between user-global and
project-attached scopes without delete+rewrite. Schema refines enforce
the user/project consistency invariants; audit log captures from/to
scope and projectKey on transitions.
Replaces the debug /me + /connect pages with a real authed app shell.
Pages
- / — anonymous landing; redirects to /dashboard once signed in
- /dashboard — recent memories + top projects, quick "new memory" action
- /memories — searchable list with hybrid (vector+FTS+tags) scoring;
per-result rank breakdown shown inline
- /memories/[id] — view + inline edit toggle + delete
- /memories/new — create form with project autocomplete
- /projects — list with memory counts and last-activity
- /projects/[key] — that project's memories
- /settings — read-only Authentik profile + link to tokens
- /settings/tokens — list / create / revoke CLI tokens
Old URLs preserved as redirects:
- /me → /dashboard
- /connect → /settings/tokens
Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
rows are tagged actor='web' to distinguish from MCP writes
Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
for tracked tokens. Legacy tokens minted before this change (no jti)
are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
shadowdaoandClaude Opus 4.7