@jacklika/dsh-memory-curator 0.1.0-alpha.5 → 0.1.0-alpha.7

package/lib/index.js

@@ -32,20 +32,40 @@ export const Config = z.object({
 function foldTitle(title) {
     return title.normalize('NFC').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
 }
+const MAX_SLUG_LENGTH = 100;
+function hashTail(title, length = 12) {
+    return createHash('sha256').update(title.normalize('NFC')).digest('hex').slice(0, length);
+}
 function slugify(title) {
-    const slug = foldTitle(title).replace(/ /g, '-');
+    let slug = foldTitle(title).replace(/ /g, '-');
     // Emoji-only and punctuation-only titles fold to nothing; a stable content
     // hash keeps them addressable and separate rather than sharing a bare ".md".
     if (slug === '')
-        return `note-${createHash('sha256').update(title.normalize('NFC')).digest('hex').slice(0, 12)}`;
+        return `note-${hashTail(title)}`;
+    // Keep generated filenames bounded on all platforms. A long CJK title would
+    // otherwise create a very long filename; truncate and append a hash so the
+    // id remains deterministic and collision-resistant.
+    if (slug.length > MAX_SLUG_LENGTH) {
+        slug = `${slug.slice(0, 64)}-${hashTail(title)}`;
+    }
     return slug;
 }
 function ensureMdExtension(id) {
     return id.endsWith('.md') ? id : `${id}.md`;
 }
+function isSafeNoteId(id) {
+    if (id === '' || id.startsWith('/') || id.startsWith('\\') || /^[A-Za-z]:/.test(id))
+        return false;
+    if (id.includes('\\'))
+        return false;
+    return !id.split('/').some(segment => segment === '..' || segment === '.');
+}
 function resolveNoteId(id, title, scope, notesDir) {
     if (id !== undefined && id !== '') {
         const withExt = ensureMdExtension(id);
+        if (!isSafeNoteId(withExt)) {
+            throw new Error(`memory-curator: invalid note id ${JSON.stringify(withExt)}: ids must be vault-relative paths without '..', '.', backslashes, leading slashes, or drive letters`);
+        }
         if (scope === 'private')
             return withExt;
         return withExt.startsWith('shared/') ? withExt : `${notesDir}/${withExt.replace(/^\//, '')}`;
@@ -150,12 +170,20 @@ export function apply(ctx, config) {
         },
         async execute(args, exec) {
             const search = await callTool(ctx, exec, 'wiki_search', { query: args.query });
+            // Mechanical per-turn summaries are useful for session replay, but they
+            // are not curated knowledge. Keep them out of proactive recall unless a
+            // caller explicitly searches the wiki. The prefix covers both the legacy
+            // flat form `auto-capture-<session>.md` and the new isolated subdir
+            // `auto-capture/<session>.md`.
+            const curated = search.hits.filter(hit => !hit.id.startsWith('shared/notes/auto-capture'));
+            // `search.total` is the vault-wide count before the search-layer cap. If
+            // any auto-capture hits made it into the capped `hits` list, remove them
+            // from the total so curated numbers stay truthful.
+            const total = search.total - (search.hits.length - curated.length);
             return {
                 query: args.query,
-                hits: search.hits.slice(0, 20),
-                // Forward the ranking's own count: `hits` is already capped upstream, so
-                // its length would understate how much actually matched.
-                total: search.total,
+                hits: curated.slice(0, 20),
+                total,
             };
         },
     })));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jacklika/dsh-memory-curator",
   "description": "Curator tools for the DSH memory vault: memory_recall before acting and memory_capture after significant work, with conflict detection and optional user approval.",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.7",
   "publishConfig": {
     "access": "public"
   },
@@ -44,6 +44,6 @@
     "@deepseek-ai/dsh-util-values": ">=0.1.7-rc.1 <0.3.0-0 || >=0.2.0-rc.1 <0.3.0-0"
   },
   "devDependencies": {
-    "@jacklika/dsh-tool-memory-filesystem": "^0.1.3-alpha.8"
+    "@jacklika/dsh-tool-memory-filesystem": "^0.1.3-alpha.9"
   }
 }