@lanonasis/recall-forge 1.1.1

package/dist/privacy/privacy-guard.js

@@ -0,0 +1,130 @@
+// Privacy Guard — two-stage protection pipeline
+// Stage 1: secret-redactor (credentials — always on)
+// Stage 2: privacy-sdk (PII — controlled by privacyMode)
+//
+// This is the module that fixes the gap: before this, redactSecrets() was only
+// wired into the `extract` CLI path. Every memory write path (memory_store tool,
+// capture hooks, local fallback) ran unredacted content through to storage.
+import { PrivacySDK } from "@lanonasis/privacy-sdk";
+import { redactSecrets } from "../extraction/secret-redactor.js";
+function topSensitivity(detected) {
+    const order = { critical: 4, high: 3, medium: 2, low: 1 };
+    if (detected.length === 0)
+        return "none";
+    return detected.reduce((top, r) => (order[r.sensitivity] ?? 0) > (order[top.sensitivity] ?? 0) ? r : top).sensitivity;
+}
+export class PrivacyGuard {
+    sdk;
+    mode;
+    locale;
+    notifyUrl;
+    logger;
+    constructor(cfg, logger) {
+        this.mode = cfg.privacyMode ?? "mask";
+        this.locale = cfg.privacyLocale ?? "US";
+        this.notifyUrl = cfg.privacyNotifyUrl ?? "";
+        this.logger = logger;
+        this.sdk = new PrivacySDK({
+            enableMasking: true,
+            enableAutoDetect: true,
+            confidenceThreshold: 0.85,
+            detectFieldNames: true,
+            gdprMode: true,
+            auditLog: false,
+        });
+    }
+    process(content) {
+        // Stage 1: credential stripping — always-on, mode does not disable this
+        const { text: stage1, secretsFound, types: secretTypes } = redactSecrets(content);
+        if (this.mode === "off") {
+            const action = secretsFound > 0 ? "redacted" : "passthrough";
+            const report = {
+                secretsFound, secretTypes, piiFound: false,
+                piiTypes: [], piiSensitivity: "none", regulations: [],
+                action, timestamp: new Date().toISOString(),
+            };
+            if (action !== "passthrough")
+                this.notify(report);
+            return { content: stage1, report };
+        }
+        // Stage 2: PII detection via privacy-sdk
+        const locale = this.locale;
+        const detected = this.sdk.detect(stage1, { locale })
+            .filter((r) => r.confidence >= 0.85);
+        const piiFound = detected.length > 0;
+        const finalContent = this.mode === "mask" && piiFound
+            ? this.sdk.detectAndMask(stage1, { locale })
+            : stage1;
+        let action = "passthrough";
+        if (secretsFound > 0 && piiFound)
+            action = "redacted+masked";
+        else if (secretsFound > 0)
+            action = "redacted";
+        else if (piiFound)
+            action = this.mode === "mask" ? "masked" : "detected";
+        const report = {
+            secretsFound,
+            secretTypes,
+            piiFound,
+            piiTypes: [...new Set(detected.map((r) => r.type))],
+            piiSensitivity: topSensitivity(detected),
+            regulations: [...new Set(detected.flatMap((r) => r.regulations))],
+            action,
+            timestamp: new Date().toISOString(),
+        };
+        if (action !== "passthrough")
+            this.notify(report);
+        return { content: finalContent, report };
+    }
+    /** Tags to merge into memory tags based on what was found */
+    tagsFrom(report) {
+        const tags = [];
+        if (report.secretsFound > 0)
+            tags.push("privacy:redacted");
+        for (const type of report.piiTypes)
+            tags.push(`pii:${type}`);
+        for (const reg of report.regulations)
+            tags.push(`compliant:${reg.toLowerCase()}`);
+        return tags;
+    }
+    /** Metadata to merge into memory.metadata — omitted entirely if passthrough */
+    metaFrom(report) {
+        if (report.action === "passthrough")
+            return undefined;
+        return {
+            privacy: {
+                action: report.action,
+                ...(report.secretsFound > 0 && { secretsFound: report.secretsFound }),
+                ...(report.secretTypes.length > 0 && { secretTypes: report.secretTypes }),
+                ...(report.piiFound && { piiTypes: report.piiTypes }),
+                ...(report.piiSensitivity !== "none" && { piiSensitivity: report.piiSensitivity }),
+                ...(report.regulations.length > 0 && { regulations: report.regulations }),
+                timestamp: report.timestamp,
+            },
+        };
+    }
+    /** Fire-and-forget webhook — never blocks the write path, never throws */
+    notify(report) {
+        if (!this.notifyUrl)
+            return;
+        fetch(this.notifyUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                event: "privacy.intervention",
+                plugin: "recall-forge",
+                action: report.action,
+                secretsFound: report.secretsFound,
+                piiTypes: report.piiTypes,
+                piiSensitivity: report.piiSensitivity,
+                regulations: report.regulations,
+                timestamp: report.timestamp,
+            }),
+        }).catch((err) => {
+            if (this.logger) {
+                const msg = err instanceof Error ? err.message : "unknown";
+                this.logger.warn(`[recall-forge] privacy webhook failed: ${msg}`);
+            }
+        });
+    }
+}

package/dist/privacy/privacy-log.d.ts

@@ -0,0 +1,6 @@
+import type { PrivacyReport } from "./privacy-guard.js";
+export declare class PrivacyLogWriter {
+    private resolvePath;
+    constructor(resolvePath: (p: string) => string);
+    write(report: PrivacyReport): Promise<void>;
+}

package/dist/privacy/privacy-log.js

@@ -0,0 +1,44 @@
+// Privacy Log Writer — daily markdown audit trail
+// Writes to workspace/memory/privacy/YYYY-MM-DD.md when an intervention occurs.
+// Only writes when action !== 'passthrough'. Silent on all errors.
+import { promises as fs } from "fs";
+import { join } from "path";
+export class PrivacyLogWriter {
+    resolvePath;
+    constructor(resolvePath) {
+        this.resolvePath = resolvePath;
+    }
+    async write(report) {
+        if (report.action === "passthrough")
+            return;
+        try {
+            const today = report.timestamp.slice(0, 10);
+            const filePath = this.resolvePath(join("memory", "privacy", `${today}.md`));
+            const dir = filePath.substring(0, filePath.lastIndexOf("/"));
+            await fs.mkdir(dir, { recursive: true });
+            // Check if file exists to decide whether to write the header
+            let needsHeader = false;
+            try {
+                await fs.access(filePath);
+            }
+            catch {
+                needsHeader = true;
+            }
+            let entry = "";
+            if (needsHeader) {
+                entry += `# Privacy Shield Log — ${today}\n\n`;
+                entry += `| Time | Action | Secrets | PII Types | Sensitivity | Regulations |\n`;
+                entry += `|------|--------|---------|-----------|-------------|-------------|\n`;
+            }
+            const time = report.timestamp.slice(11, 19);
+            const pii = report.piiTypes.join(", ") || "—";
+            const regs = report.regulations.join(", ") || "—";
+            const sensitivity = report.piiSensitivity !== "none" ? report.piiSensitivity : "—";
+            entry += `| ${time} | ${report.action} | ${report.secretsFound} | ${pii} | ${sensitivity} | ${regs} |\n`;
+            await fs.appendFile(filePath, entry, "utf-8");
+        }
+        catch {
+            // Never throws — log failure must not affect memory write
+        }
+    }
+}

package/dist/tools/memory-forget.d.ts

@@ -0,0 +1,3 @@
+import type { OpenClawPluginApi } from "../plugin-sdk-stub.js";
+import type { LanonasisClient } from "../client.js";
+export declare function registerMemoryForgetTool(api: OpenClawPluginApi, client: LanonasisClient): void;

package/dist/tools/memory-forget.js

@@ -0,0 +1,109 @@
+export function registerMemoryForgetTool(api, client) {
+    api.registerTool({
+        name: "memory_forget",
+        description: "Delete a memory by ID or semantic query. Query mode requires high confidence.",
+        parameters: {
+            type: "object",
+            properties: {
+                id: {
+                    type: "string",
+                    description: "Memory ID or displayed prefix to delete",
+                },
+                query: {
+                    type: "string",
+                    description: "Semantic query to find memory (deletes if single high-confidence match)",
+                },
+            },
+        },
+        async execute(_id, params) {
+            try {
+                const id = params.id;
+                const query = params.query;
+                // ID path
+                if (id) {
+                    const candidate = id.trim();
+                    if (!candidate) {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: "Memory ID is required.",
+                                },
+                            ],
+                        };
+                    }
+                    if (candidate.length < 8) {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: `Memory ID prefix must be at least 8 characters or a full UUID: ${candidate}`,
+                                },
+                            ],
+                        };
+                    }
+                    const resolvedId = await client.resolveMemoryId(candidate);
+                    await client.deleteMemory(resolvedId);
+                    return {
+                        content: [
+                            { type: "text", text: `Forgotten: ${resolvedId}` },
+                        ],
+                    };
+                }
+                // Query path
+                if (query) {
+                    const results = await client.searchMemories({
+                        query,
+                        threshold: 0.7,
+                        limit: 5,
+                    });
+                    if (!results || results.length === 0) {
+                        return {
+                            content: [{ type: "text", text: "No matching memories found." }],
+                        };
+                    }
+                    // Single high-confidence match (>0.9)
+                    if (results.length === 1 && (results[0].similarity || 0) > 0.9) {
+                        await client.deleteMemory(results[0].id);
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: `Forgotten: **${results[0].title}** (id: ${results[0].id})`,
+                                },
+                            ],
+                        };
+                    }
+                    // Multiple results - return candidate list
+                    const lines = results.map((r, i) => `${i + 1}. [${r.memory_type ?? r.type}] **${r.title}** (score: ${(r.similarity || r.similarity_score || 0).toFixed(2)}) - id: ${r.id}`);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Multiple matches found. Specify which to delete:\n\n${lines.join("\n")}`,
+                            },
+                        ],
+                    };
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Provide either 'id' or 'query' parameter.",
+                        },
+                    ],
+                };
+            }
+            catch (err) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Forget error: ${err instanceof Error ? err.message : "unknown"}`,
+                        },
+                    ],
+                };
+            }
+        },
+    });
+}

package/dist/tools/memory-get.d.ts

@@ -0,0 +1,3 @@
+import type { OpenClawPluginApi } from "../plugin-sdk-stub.js";
+import type { LanonasisClient } from "../client.js";
+export declare function registerMemoryGetTool(api: OpenClawPluginApi, client: LanonasisClient): void;

package/dist/tools/memory-get.js

@@ -0,0 +1,46 @@
+export function registerMemoryGetTool(api, client) {
+    api.registerTool({
+        name: "memory_get",
+        description: "Fetch full memory content by ID.",
+        parameters: {
+            type: "object",
+            properties: {
+                id: {
+                    type: "string",
+                    description: "Memory ID or displayed prefix",
+                },
+            },
+            required: ["id"],
+        },
+        async execute(_id, params) {
+            try {
+                const id = params.id;
+                const memory = await client.getMemory(id);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `ID: ${memory.id}\n**${memory.title}** [${memory.type}]\n\n${memory.content}`,
+                        },
+                    ],
+                    details: memory,
+                };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "unknown";
+                if (message.includes("404")) {
+                    return {
+                        content: [
+                            { type: "text", text: `Memory not found: ${params.id}` },
+                        ],
+                    };
+                }
+                return {
+                    content: [
+                        { type: "text", text: `Error: ${message}` },
+                    ],
+                };
+            }
+        },
+    });
+}

package/dist/tools/memory-search.d.ts

@@ -0,0 +1,4 @@
+import type { OpenClawPluginApi } from "../plugin-sdk-stub.js";
+import type { LanonasisClient } from "../client.js";
+import type { LanonasisConfig } from "../config.js";
+export declare function registerMemorySearchTool(api: OpenClawPluginApi, client: LanonasisClient, cfg: LanonasisConfig): void;

package/dist/tools/memory-search.js

@@ -0,0 +1,95 @@
+export function registerMemorySearchTool(api, client, cfg) {
+    api.registerTool({
+        name: "memory_search",
+        description: "Semantic search through memories. Returns ranked results with previews.",
+        parameters: {
+            type: "object",
+            properties: {
+                query: {
+                    type: "string",
+                    description: "Search query (required)",
+                },
+                limit: {
+                    type: "number",
+                    description: "Max results (default 5, max 10)",
+                    default: 5,
+                },
+                type: {
+                    type: "string",
+                    description: "Filter by type: context, project, knowledge, reference, personal, workflow",
+                },
+                threshold: {
+                    type: "number",
+                    description: "Similarity threshold (overrides config)",
+                },
+                agent_id: {
+                    type: "string",
+                    description: "Filter to specific agent's memories",
+                },
+            },
+            required: ["query"],
+        },
+        async execute(_id, params) {
+            try {
+                const query = params.query;
+                const limit = Math.min(params.limit || 5, 10);
+                const type = params.type;
+                const threshold = params.threshold;
+                const agentId = params.agent_id;
+                const metadata = {};
+                if (agentId)
+                    metadata.agent_id = agentId;
+                const memories = await client.searchMemories({
+                    query,
+                    threshold: threshold || cfg.searchThreshold,
+                    limit,
+                    type: type,
+                    metadata: Object.keys(metadata).length > 0 ? metadata : undefined,
+                });
+                if (!memories || memories.length === 0) {
+                    return {
+                        content: [{ type: "text", text: "No matching memories found." }],
+                    };
+                }
+                // Format: numbered list with 200 char previews
+                const lines = memories.map((m, i) => {
+                    const preview = (m.content ?? '').slice(0, 200).replace(/\n/g, " ");
+                    const score = m.similarity !== undefined
+                        ? ` (score: ${m.similarity.toFixed(2)})`
+                        : "";
+                    const type = m.memory_type ?? m.type ?? 'context';
+                    return `${i + 1}. [${type}] **${m.title}**${score}\n   ID: ${m.id}\n   ${preview}...`;
+                });
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Found ${memories.length} memories:\n\n${lines.join("\n\n")}`,
+                        },
+                    ],
+                    details: {
+                        count: memories.length,
+                        memories: memories.map((m) => ({
+                            id: m.id,
+                            title: m.title,
+                            type: m.memory_type ?? m.type,
+                            tags: m.tags,
+                            similarity: m.similarity,
+                            content_preview: (m.content ?? '').slice(0, 200),
+                        })),
+                    },
+                };
+            }
+            catch (err) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Search error: ${err instanceof Error ? err.message : "unknown"}`,
+                        },
+                    ],
+                };
+            }
+        },
+    });
+}

package/dist/tools/memory-store.d.ts

@@ -0,0 +1,5 @@
+import type { OpenClawPluginApi } from "../plugin-sdk-stub.js";
+import type { LanonasisClient } from "../client.js";
+import type { LanonasisConfig } from "../config.js";
+import type { PrivacyGuard } from "../privacy/privacy-guard.js";
+export declare function registerMemoryStoreTool(api: OpenClawPluginApi, client: LanonasisClient, cfg: LanonasisConfig, guard?: PrivacyGuard): void;

package/dist/tools/memory-store.js

@@ -0,0 +1,199 @@
+import { detectMemoryType } from "../enrichment/type-detector.js";
+import { extractTags } from "../enrichment/tag-extractor.js";
+const MEMORY_TYPES = [
+    "context",
+    "project",
+    "knowledge",
+    "reference",
+    "personal",
+    "workflow",
+];
+function normalizeOptionalString(label, value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string") {
+        throw new Error(`${label} must be a string.`);
+    }
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error(`${label} cannot be empty or whitespace-only.`);
+    }
+    return normalized;
+}
+function normalizeOptionalType(value) {
+    const normalized = normalizeOptionalString("Type", value);
+    if (!normalized)
+        return undefined;
+    if (!MEMORY_TYPES.includes(normalized)) {
+        throw new Error(`Type must be one of: ${MEMORY_TYPES.join(", ")}.`);
+    }
+    return normalized;
+}
+function normalizeTags(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        throw new Error("Tags must be an array of strings.");
+    }
+    const tags = [...new Set(value.map((tag) => {
+            if (typeof tag !== "string") {
+                throw new Error("Tags must be an array of strings.");
+            }
+            return tag.trim();
+        }).filter(Boolean))];
+    if (tags.length === 0) {
+        throw new Error("Tags cannot be empty.");
+    }
+    return tags;
+}
+export function registerMemoryStoreTool(api, client, cfg, guard) {
+    api.registerTool({
+        name: "memory_store",
+        description: "Store or update a memory. New memories are deduplicated before creation.",
+        parameters: {
+            type: "object",
+            properties: {
+                id: {
+                    type: "string",
+                    description: "Existing memory ID to update",
+                },
+                content: {
+                    type: "string",
+                    description: "Memory content (required for create, optional for update)",
+                },
+                title: {
+                    type: "string",
+                    description: "Memory title (auto-generated on create if absent)",
+                },
+                type: {
+                    type: "string",
+                    description: "Type: context, project, knowledge, reference, personal, workflow (auto-detected if absent)",
+                },
+                tags: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Tags (auto-extracted if absent)",
+                },
+            },
+        },
+        async execute(_id, params) {
+            try {
+                const id = normalizeOptionalString("Memory ID", params.id);
+                const content = normalizeOptionalString("Content", params.content);
+                let title = normalizeOptionalString("Title", params.title);
+                let type = normalizeOptionalType(params.type);
+                let tags = normalizeTags(params.tags);
+                if (id) {
+                    const updates = {};
+                    if (params.title !== undefined)
+                        updates.title = title;
+                    if (params.content !== undefined)
+                        updates.content = content;
+                    if (params.type !== undefined)
+                        updates.type = type;
+                    if (params.tags !== undefined)
+                        updates.tags = tags;
+                    if (Object.keys(updates).length === 0) {
+                        throw new Error("Provide at least one field to update when `id` is set.");
+                    }
+                    const memory = await client.updateMemory(id, updates);
+                    const resolvedType = memory.memory_type ?? memory.type;
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Updated: **${memory.title}** [${resolvedType}] (id: ${memory.id})`,
+                            },
+                        ],
+                        updated: true,
+                        id: memory.id,
+                        title: memory.title,
+                        type: resolvedType,
+                    };
+                }
+                if (!content) {
+                    throw new Error("Content is required when creating a memory.");
+                }
+                // Run privacy guard — stage 1: redact credentials, stage 2: mask PII
+                const guardResult = guard ? guard.process(content) : null;
+                const safeContent = guardResult ? guardResult.content : content;
+                // Auto-generate if absent
+                if (!title) {
+                    title = safeContent.slice(0, 80).replace(/\s+/g, " ").trim();
+                }
+                if (!type) {
+                    type = detectMemoryType(safeContent);
+                }
+                if (!tags || tags.length === 0) {
+                    const baseTags = extractTags(safeContent);
+                    const privacyTags = guardResult && guard ? guard.tagsFrom(guardResult.report) : [];
+                    tags = [...new Set([...baseTags, ...privacyTags])];
+                }
+                else if (guardResult && guard) {
+                    // Merge privacy tags with caller-supplied tags
+                    const privacyTags = guard.tagsFrom(guardResult.report);
+                    tags = [...new Set([...tags, ...privacyTags])];
+                }
+                // Dedup check using configurable threshold
+                const existing = await client.searchMemories({
+                    query: safeContent,
+                    threshold: cfg.dedupeThreshold,
+                    limit: 1,
+                });
+                if (existing && existing.length > 0) {
+                    // Structured signal: stored:false lets the agent distinguish no-op from write
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Not stored — similar memory exists: **${existing[0].title}** (id: ${existing[0].id})`,
+                            },
+                        ],
+                        stored: false,
+                        reason: "duplicate",
+                        threshold: cfg.dedupeThreshold,
+                        existingTitle: existing[0].title,
+                        existingId: existing[0].id,
+                    };
+                }
+                // Create memory (with sanitized content + privacy metadata)
+                const privacyMeta = guardResult && guard ? guard.metaFrom(guardResult.report) : undefined;
+                const memory = await client.createMemory({
+                    title,
+                    content: safeContent,
+                    type: type,
+                    tags,
+                    metadata: {
+                        agent_id: cfg.agentId,
+                        source: "openclaw",
+                        captured_at: new Date().toISOString(),
+                        ...privacyMeta,
+                    },
+                });
+                const resolvedType = memory.memory_type ?? memory.type;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Stored: **${title}** [${resolvedType}] (id: ${memory.id})`,
+                        },
+                    ],
+                    stored: true,
+                    id: memory.id,
+                    title,
+                    type: resolvedType,
+                };
+            }
+            catch (err) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Store error: ${err instanceof Error ? err.message : "unknown"}`,
+                        },
+                    ],
+                };
+            }
+        },
+    });
+}