feat(agent-memory): add account-scoped Agent Memory MCP server

[jonnyparris]

What

Adds apps/agent-memory, an account-scoped MCP server for persistent, semantically searchable agent memory.

Files live in an R2 bucket (agent-memory-mcp) in the selected Cloudflare account. Embeddings and on-demand reflection use Workers AI in that same account, so storage and inference are billed there. Search metadata lives in one Durable Object per account (idFromName(accountId)), matching the R2 isolation boundary.

Tools (22)

• Files: read, write, write_many, reindex, list, list_tags, get_backlinks
• Search: search
• Conversations: search_conversations, index_conversations, expand_conversation, conversation_stats
• Reminders: schedule_reminder, list_reminders, remove_reminder, check_reminders
• Reflection: run_reflection, list_pending_reflections, apply_reflection_changes, archive_reflection
• Config: get_config, set_config

Design and safety

• Uses the shared @repo/mcp-common OAuth/account helpers and accountTool account selection.
• Uses the standard MCP deployment account plus the shared staging/production OAuth KV namespaces.
• Keeps Cloudflare credentials out of Durable Object storage: embeddings are generated before DO RPC calls.
• Validates and encodes R2 object paths, preventing .. path normalization from escaping the dedicated bucket.
• Reserves internal paths (.mcp/, conversations, reminders, reflection metadata) for dedicated tools and redacts webhook secrets from config responses.
• Uses a bounded, deterministic exact-cosine vector index (5,000 entries) with SQLite persistence, tag/scope filtering, binary vectors, and a repair-oriented reindex tool.
• Bounds object size, directory listings, search results, batch concurrency, conversation payloads, reminders, reflection iterations, and model tool calls.
• Reflection is on-demand and opt-out. Low-risk fixes may be applied immediately; substantive edits remain pending for review. Source hashes prevent approved edits from overwriting files changed after reflection, and an account-level lock prevents concurrent reflection runs.
• Webhooks are bounded by timeout, reject redirects, and expose only their host through get_config.
• Removes unsupported history/rollback tools rather than advertising no-op behavior.

Account members with the required permissions share the account's memory; this is documented in the server instructions and README.

Deployment

• Staging: memory-staging.mcp.cloudflare.com
• Production: memory.mcp.cloudflare.com
• Both Streamable HTTP (/mcp) and legacy SSE (/sse) are registered in server.json.

OAuth client credentials and the cookie-encryption secret remain Wrangler secrets, consistent with the other authenticated MCP servers.

Verification

• pnpm check:deps ✅
• pnpm check:turbo — 41/41 tasks ✅
• pnpm check:format ✅
• pnpm test — 29 files / 281 tests ✅
• Agent Memory suite — 18 files / 162 tests ✅
• Staging deploy dry-run ✅
• Production deploy dry-run ✅

[mattzcarey]

Keeping this PR in draft. Staging is deployed, but normal browser OAuth is not functional yet.

Blocked until a dedicated OAuth client is provisioned with the Agent Memory staging/production callback URLs and the corresponding Worker secrets are installed.