0da38f1, the version that was reviewed and scanned here. Newer commits reach this catalog only after a new review. License: Apache-2.0, by Rohit Ghumare.
The user wants to resume work. Optional cwd override: $ARGUMENTS
Quick start
memory_sessions { "project": "<current-project-id>", "limit": 20 }Pick the most recent session whose cwd matches this project, then:
memory_recall { "query": "<session top concepts>", "project": "<current-project-id>", "limit": 10 }.
When an agent is requested, pass the same agentId to both calls.
Expected output:
Resuming 7f3a9c2 "Auth refresh rework".
Open question: should logout revoke all device tokens or just the current one?
Next step: decide revoke scope, then update auth/logout.ts.Why
Match the session by directory boundary, not raw prefix, so a sibling repo never gets mistaken for this one. Never invent observations for an empty session.
Workflow
- Resolve the project path: if
$ARGUMENTSis given, normalize it to absolute (path.resolve(process.cwd(), $ARGUMENTS)); else use the cwd. - Call
memory_sessionswith the exact project identifier when known, andagentIdwhen requested. Otherwise follownextCursoruntil the matching directory is found or pagination ends. Preserve filters between pages. Pick the most recent session whose normalizedcwdmatches by directory boundary: equality, ORcwd.startsWith(projectPath + sep), ORprojectPath.startsWith(cwd + sep). Prefercompletedoverabandoned. No match: report that this project has no matching session and stop. Do not substitute a different project's session. - If the session ended on an unanswered user-facing question, surface it FIRST.
Look in
summaryor recentconversationobservations whosenarrativeends in?. - Summarize: title/summary, key files, key decisions or errors, using
memory_recallon the top concepts, limit 10, preserving the chosen project and agent scope. Check each result's session or project provenance before including it; a query alone does not enforce scope. - End with one concrete "next step?" pointer.
Anti-patterns
WRONG: session.cwd.startsWith(projectPath) matches /repo-a-staging when the
project is /repo-a, resuming the wrong repo's session.
RIGHT: session.cwd === projectPath || session.cwd.startsWith(projectPath + sep),
a directory-boundary check that cannot cross sibling repos.
Checklist
- cwd override resolved to an absolute, normalized path.
- Match used a directory-boundary check, not a raw prefix.
- Unanswered question (if any) leads the response.
- Empty session is reported plainly, with an offer to start fresh.
See also
recap,session-history,recall: same session data, broader views.
Troubleshooting
See TROUBLESHOOTING.md if memory_sessions or memory_recall is not available.
The user wants to resume work. Optional cwd override: $ARGUMENTS
Quick start
memory_sessions { "project": "<current-project-id>", "limit": 20 }Pick the most recent session whose cwd matches this project, then:
memory_recall { "query": "<session top concepts>", "project": "<current-project-id>", "limit": 10 }.
When an agent is requested, pass the same agentId to both calls.
Expected output:
Resuming 7f3a9c2 "Auth refresh rework".
Open question: should logout revoke all device tokens or just the current one?
Next step: decide revoke scope, then update auth/logout.ts.Why
Match the session by directory boundary, not raw prefix, so a sibling repo never gets mistaken for this one. Never invent observations for an empty session.
Workflow
- Resolve the project path: if
$ARGUMENTSis given, normalize it to absolute (path.resolve(process.cwd(), $ARGUMENTS)); else use the cwd. - Call
memory_sessionswith the exact project identifier when known, andagentIdwhen requested. Otherwise follownextCursoruntil the matching directory is found or pagination ends. Preserve filters between pages. Pick the most recent session whose normalizedcwdmatches by directory boundary: equality, ORcwd.startsWith(projectPath + sep), ORprojectPath.startsWith(cwd + sep). Prefercompletedoverabandoned. No match: report that this project has no matching session and stop. Do not substitute a different project's session. - If the session ended on an unanswered user-facing question, surface it FIRST.
Look in
summaryor recentconversationobservations whosenarrativeends in?. - Summarize: title/summary, key files, key decisions or errors, using
memory_recallon the top concepts, limit 10, preserving the chosen project and agent scope. Check each result's session or project provenance before including it; a query alone does not enforce scope. - End with one concrete "next step?" pointer.
Anti-patterns
WRONG: session.cwd.startsWith(projectPath) matches /repo-a-staging when the
project is /repo-a, resuming the wrong repo's session.
RIGHT: session.cwd === projectPath || session.cwd.startsWith(projectPath + sep),
a directory-boundary check that cannot cross sibling repos.
Checklist
- cwd override resolved to an absolute, normalized path.
- Match used a directory-boundary check, not a raw prefix.
- Unanswered question (if any) leads the response.
- Empty session is reported plainly, with an offer to start fresh.
See also
recap,session-history,recall: same session data, broader views.
Troubleshooting
See TROUBLESHOOTING.md if memory_sessions or memory_recall is not available.
Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-11-07
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Hidden InstructionsPrompt Injection · TROUBLESHOOTING.md:1
- Session PersistenceRogue Agent · TROUBLESHOOTING.md:35
Learn more about NVIDIA SkillSpector.