feat: project credential resolution for observer daemon + unified status

Observer daemon now resolves per-project CEMS credentials for sessions
running in git worktrees (e.g., Codex). Previously all sessions went to
the global CEMS instance regardless of project configuration.

- CredentialResolver: walk-up → git worktree fallback → source_ref cache → global
- seed_from_state: persist api_url in state files, restore cache across restarts
- populate_session_metadata: scan first 10 JSONL lines for CWD (was only line 0)
- cems update: restart observer daemon after package upgrade
- cems status: merged status + health into unified command with daemon info
- debug dashboard: query correct CEMS instance per-session for stored memories

Author: Chocksy

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cems"
-version = "0.11.3"
+version = "0.11.4"
 description = "Continuous Evolving Memory System - Dual-layer memory with scheduled maintenance"
 readme = "README.md"
 requires-python = ">=3.11"

src/cems/cli.py

@@ -19,7 +19,7 @@
 from cems.commands.memory import update as update_memory
 from cems.commands.rule import rule
 from cems.commands.setup import setup
-from cems.commands.status import health, status
+from cems.commands.status import status
 from cems.commands.uninstall import uninstall
 from cems.commands.update import update_cmd
 
@@ -75,7 +75,6 @@ def main(ctx: click.Context, verbose: bool, api_url: str | None, api_key: str |
 
 # Register all commands
 main.add_command(status)
-main.add_command(health)
 main.add_command(add)
 main.add_command(search)
 main.add_command(list_memories, name="list")

src/cems/commands/__init__.py

@@ -4,11 +4,10 @@
 from cems.commands.maintenance import maintenance
 from cems.commands.memory import add, delete, list_memories, search, update
 from cems.commands.rule import rule
-from cems.commands.status import health, status
+from cems.commands.status import status
 
 __all__ = [
     "status",
-    "health",
     "add",
     "search",
     "list_memories",

src/cems/commands/status.py

@@ -1,58 +1,94 @@
-"""Status and health commands for CEMS CLI."""
+"""Status command for CEMS CLI.
+
+Shows a unified view of client, server, and observer daemon state.
+"""
+
+import os
+from importlib.metadata import version as pkg_version
+from pathlib import Path
 
 import click
 from rich.table import Table
 
 from cems.cli_utils import console, get_client, handle_error
 from cems.client import CEMSClientError
 
+DAEMON_PID_FILE = Path.home() / ".cems" / "observer" / "daemon.pid"
+
+
+def _get_client_version() -> str:
+    """Get installed CEMS package version."""
+    try:
+        return pkg_version("cems")
+    except Exception:
+        return "unknown"
+
+
+def _get_daemon_info() -> dict:
+    """Get observer daemon status."""
+    info: dict = {"status": "stopped", "pid": None}
+    try:
+        if DAEMON_PID_FILE.exists():
+            pid = int(DAEMON_PID_FILE.read_text().strip())
+            # Check if process is alive
+            os.kill(pid, 0)
+            info["status"] = "running"
+            info["pid"] = pid
+    except (ValueError, ProcessLookupError, PermissionError, OSError):
+        pass
+    return info
+
 
 @click.command()
 @click.pass_context
 def status(ctx: click.Context) -> None:
-    """Show CEMS status and configuration."""
-    try:
-        client = get_client(ctx)
-        data = client.status()
-
-        table = Table(title="CEMS Status")
-        table.add_column("Setting", style="cyan")
-        table.add_column("Value", style="green")
+    """Show CEMS status — client, server, and daemon."""
+    client_version = _get_client_version()
 
-        table.add_row("Server", client.api_url)
-        table.add_row("User ID", data.get("user_id", "?"))
-        table.add_row("Team ID", data.get("team_id") or "(not set)")
-        table.add_row("Status", data.get("status", "unknown"))
-        table.add_row("Backend", data.get("backend", "?"))
-        table.add_row("Vector Store", data.get("vector_store", "?"))
-        table.add_row("Query Synthesis", str(data.get("query_synthesis", False)))
+    # --- Client ---
+    api_url = ctx.obj.get("api_url") or "(not configured)"
+    console.print()
+    console.print("[bold]CEMS Status[/bold]")
 
-        console.print(table)
+    table = Table(show_header=False, box=None, padding=(0, 2))
+    table.add_column("Key", style="dim")
+    table.add_column("Value")
 
-    except CEMSClientError as e:
-        handle_error(e)
+    table.add_row("", "")
+    table.add_row("[cyan bold]Client[/cyan bold]", "")
+    table.add_row("  Version", client_version)
+    table.add_row("  API URL", str(api_url))
 
+    # --- Server ---
+    table.add_row("", "")
+    table.add_row("[cyan bold]Server[/cyan bold]", "")
 
-@click.command()
-@click.pass_context
-def health(ctx: click.Context) -> None:
-    """Check server health."""
     try:
         client = get_client(ctx)
+        health = client.health()
+        server_status = health.get("status", "unknown")
+        server_version = health.get("version", "unknown")
+        db_status = health.get("database", "unknown")
+
+        color = "green" if server_status == "healthy" else "red"
+        table.add_row("  Status", f"[{color}]{server_status}[/{color}]")
+        table.add_row("  Version", server_version)
+
+        db_color = "green" if db_status == "healthy" else "yellow"
+        table.add_row("  Database", f"[{db_color}]{db_status}[/{db_color}]")
 
-        with console.status("Checking health..."):
-            result = client.health()
+    except CEMSClientError:
+        table.add_row("  Status", "[red]unreachable[/red]")
 
-        status_text = result.get("status", "unknown")
-        if status_text == "healthy":
-            console.print(f"[green]Server: {status_text}[/green]")
-        else:
-            console.print(f"[yellow]Server: {status_text}[/yellow]")
+    # --- Observer Daemon ---
+    table.add_row("", "")
+    table.add_row("[cyan bold]Observer Daemon[/cyan bold]", "")
 
-        console.print(f"Service: {result.get('service', '?')}")
-        console.print(f"Mode: {result.get('mode', '?')}")
-        console.print(f"Auth: {result.get('auth', '?')}")
-        console.print(f"Database: {result.get('database', '?')}")
+    daemon = _get_daemon_info()
+    if daemon["status"] == "running":
+        table.add_row("  Status", f"[green]running[/green] (PID {daemon['pid']})")
+    else:
+        table.add_row("  Status", "[yellow]stopped[/yellow]")
 
-    except CEMSClientError as e:
-        handle_error(e)
+    console.print(table)
+    console.print()

src/cems/commands/update.py

@@ -8,8 +8,10 @@
 """
 
 import os
+import signal
 import shutil
 import subprocess
+import time
 from datetime import datetime, timezone
 from importlib.metadata import version as pkg_version
 from pathlib import Path
@@ -159,6 +161,31 @@ def _redeploy_hooks() -> None:
         console.print("[yellow]Hook re-deploy had errors (see above)[/yellow]")
 
 
+def _restart_daemon() -> None:
+    """Stop the observer daemon so it restarts with updated code.
+
+    Sends SIGTERM to the running daemon (if any). The next hook invocation
+    will auto-respawn it via ensure_daemon_running().
+    """
+    pid_file = Path.home() / ".cems" / "observer" / "daemon.pid"
+    try:
+        if not pid_file.exists():
+            return
+        pid = int(pid_file.read_text().strip())
+        os.kill(pid, signal.SIGTERM)
+        # Wait briefly for clean shutdown
+        for _ in range(10):
+            time.sleep(0.3)
+            try:
+                os.kill(pid, 0)  # Check if still alive
+            except ProcessLookupError:
+                console.print("  Observer daemon stopped (will auto-restart)")
+                return
+        console.print("[yellow]  Observer daemon did not stop in time — it will pick up changes on next restart[/yellow]")
+    except (ValueError, ProcessLookupError, PermissionError, OSError):
+        pass
+
+
 @click.command("update")
 @click.option("--hooks", "hooks_only", is_flag=True, help="Only re-deploy hooks/skills (skip package upgrade)")
 def update_cmd(hooks_only: bool) -> None:
@@ -204,5 +231,9 @@ def update_cmd(hooks_only: bool) -> None:
     else:
         console.print("[dim]Hooks up to date, skipping re-deploy[/dim]")
 
+    # Restart observer daemon so it picks up updated code
+    if hooks_only or version_changed:
+        _restart_daemon()
+
     console.print()
     console.print("[bold green]Update complete![/bold green] Restart your IDE to pick up changes.")

src/cems/debug/indexer.py

@@ -316,22 +316,23 @@ def get_observer_stats(self) -> dict:
     def get_observer_session_memories(self, sid: str) -> list[dict]:
         """Fetch stored memories for an observer session via CEMS API.
 
-        Uses credentials from ~/.cems/credentials to call the CEMS API's
-        /api/memory/list endpoint with tag_prefix filter.
-        Falls back to client-side filtering if server doesn't support tag_prefix.
+        Uses the session's api_url (from state file) when available, otherwise
+        falls back to global credentials. This ensures project-credential
+        sessions query the correct CEMS instance.
         """
-        creds = _load_cems_credentials()
-        if not creds["url"] or not creds["key"]:
+        # Try to use the session's stored API URL + resolve matching key
+        api_url, api_key = self._resolve_session_credentials(sid)
+        if not api_url or not api_key:
             return []
 
         short_id = sid[:12]
         tag_prefix = f"session:{short_id}"
         url = (
-            f"{creds['url'].rstrip('/')}/api/memory/list"
+            f"{api_url.rstrip('/')}/api/memory/list"
             f"?category=session-summary&tag_prefix={tag_prefix}&limit=50"
         )
         req = urllib.request.Request(url, headers={
-            "Authorization": f"Bearer {creds['key']}",
+            "Authorization": f"Bearer {api_key}",
             "User-Agent": "CEMS-Debug/1.0",
         })
         try:
@@ -348,6 +349,48 @@ def get_observer_session_memories(self, sid: str) -> list[dict]:
             logging.getLogger(__name__).debug(f"Failed to fetch memories for {sid}: {e}")
             return []
 
+    def _resolve_session_credentials(self, sid: str) -> tuple[str, str]:
+        """Resolve API URL and key for a session.
+
+        If the session state has an api_url that differs from global,
+        walk up from the session's CWD to find the matching project key.
+        Falls back to global credentials.
+        """
+        from cems.shared.credentials import find_project_credentials, parse_credentials_file
+
+        state_file = OBSERVER_DIR / f"{sid}.json"
+        session_api_url = ""
+        session_cwd = ""
+        if state_file.exists():
+            try:
+                data = json.loads(state_file.read_text())
+                session_api_url = data.get("api_url", "")
+                # Try to reconstruct CWD from source_ref isn't reliable,
+                # but we stored api_url which is what matters
+            except (json.JSONDecodeError, OSError):
+                pass
+
+        creds = _load_cems_credentials()
+        global_url = creds.get("url", "")
+        global_key = creds.get("key", "")
+
+        # If session used a different API URL, find matching credentials
+        if session_api_url and session_api_url.rstrip("/") != global_url.rstrip("/"):
+            # Scan known project credential files for a matching URL
+            for creds_file in Path.home().glob("Development/*/.cems/credentials"):
+                try:
+                    pcreds = parse_credentials_file(str(creds_file))
+                    purl = pcreds.get("CEMS_API_URL", "")
+                    pkey = pcreds.get("CEMS_API_KEY", "")
+                    if purl.rstrip("/") == session_api_url.rstrip("/") and pkey:
+                        return purl, pkey
+                except OSError:
+                    continue
+            # Couldn't find matching key — fall through to global
+            return session_api_url, global_key
+
+        return global_url, global_key
+
     def get_conflicts(self) -> list[dict]:
         """Fetch open memory conflicts from CEMS API."""
         creds = _load_cems_credentials()