@lmzhen/dsh-evolution-core 0.1.0-rc.21 → 0.1.0-rc.22

package/lib/index.js

@@ -20,7 +20,11 @@ function evolutionIoAdapter(provider) {
 		list: (path) => provider().list(path),
 		exists: (path) => provider().exists(path),
 		rename: (path, destination) => provider().rename(path, destination),
-		copy: (path, destination) => provider().copy(path, destination)
+		copy: (path, destination) => provider().copy(path, destination),
+		size: (path) => {
+			const io = provider();
+			return io.size ? io.size(path) : Promise.resolve(null);
+		}
 	};
 }
 function nodeEvolutionIo() {
@@ -69,6 +73,13 @@ function nodeEvolutionIo() {
 				recursive: true,
 				force: true
 			});
+		},
+		async size(path) {
+			try {
+				return (await stat(path)).size;
+			} catch {
+				return null;
+			}
 		}
 	};
 }
@@ -599,6 +610,13 @@ function scanContentThreats(text, maxScanChars = 65536, options = NO_SCAN_OPTION
 * File-backed durable memory with Hermes-compatible semantics.
 * Stores are MEMORY.md and USER.md under $DSH_HOME/memories (~/.dsh/memories).
 */
+/**
+* Read-guard factor: a memory file larger than this multiple of its target's
+* char limit is treated as externally corrupted and skipped instead of being
+* read whole (aligned with claw `tools/memory.ts` size guard, which uses the
+* same 10× bound around a file that should never exceed the store limit).
+*/
+const READ_GUARD_FACTOR = 10;
 function memoryRoot(env = process.env) {
 	return join(env.DSH_HOME ?? join(homedir(), ".dsh"), "memories");
 }
@@ -633,7 +651,24 @@ var MemoryStore = class {
 	limitFor(target) {
 		return target === "memory" ? this.memoryLimit : this.userLimit;
 	}
+	/**
+	* Read-guard probe: `{ size, limit }` when the on-disk file exceeds
+	* `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown
+	* (backend without a size probe), under the bound, or the target has no
+	* limit configured.
+	*/
+	async oversizedFile(target) {
+		const size = await this.io.size?.(fileFor(this.root, target));
+		if (size === null || size === void 0) return null;
+		const limit = this.limitFor(target);
+		if (limit <= 0) return null;
+		return size > limit * READ_GUARD_FACTOR ? {
+			size,
+			limit
+		} : null;
+	}
 	async read(target) {
+		if (await this.oversizedFile(target)) return [];
 		const raw = await this.io.readText(fileFor(this.root, target));
 		return raw === null ? [] : [...new Set(normalizeEntries(raw))];
 	}
@@ -669,23 +704,45 @@ var MemoryStore = class {
 		return percent >= 80 ? ` ⚠️ Storage at ${percent}% (${chars}/${limit} chars).` : "";
 	}
 	/**
-	* Best-effort copy of the drifted on-disk file to `<file>.bak.<stamp>` before
-	* refusing the write, so an external edit stays recoverable. Failure to back
-	* up does not change the refusal semantics.
+	* Best-effort raw-copy backup of the on-disk file to `<file>.bak.<stamp>`
+	* before a refusal, so an externally modified (or oversized) file stays
+	* recoverable. Copies bytes instead of reading them so a pathologically
+	* large file is never loaded just to back it up. Failure to back up does
+	* not change the refusal semantics.
 	*/
-	async backupDrift(target) {
+	async backupFile(target) {
 		const path = fileFor(this.root, target);
-		const raw = await this.io.readText(path);
-		if (raw === null) return null;
 		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 14);
 		try {
-			await this.io.writeText(`${path}.bak.${stamp}`, raw);
+			await this.io.copy(path, `${path}.bak.${stamp}`);
 			return `${path}.bak.${stamp}`;
 		} catch {
 			return null;
 		}
 	}
+	/**
+	* Read-guard refusal for write paths. Returns the refusal result when the
+	* target file is oversized, `null` otherwise. The file is skipped for
+	* reading (never loaded), backed up by raw copy, and the model is told to
+	* fix it manually — mirroring the drift refusal so corrupted state is never
+	* silently overwritten.
+	*/
+	async oversizedRefusal(target) {
+		const oversized = await this.oversizedFile(target);
+		if (!oversized) return null;
+		const backup = await this.backupFile(target);
+		const suffix = backup ? ` A backup was saved to ${basename(backup)}.` : "";
+		return {
+			ok: false,
+			message: `Memory file is ${oversized.size} bytes (limit ${oversized.limit * READ_GUARD_FACTOR}) — skipping read.${suffix} Fix the file manually, then retry.`,
+			entries: [],
+			chars: 0,
+			limit: this.limitFor(target)
+		};
+	}
 	async add(target, facts) {
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
 		const content = facts.trim();
 		if (!content) return {
 			ok: false,
@@ -741,6 +798,8 @@ var MemoryStore = class {
 			chars: 0,
 			limit: this.limitFor(target)
 		};
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
 		const content = action === "replace" ? (facts ?? "").trim() : "";
 		if (action === "replace" && !content) return {
 			ok: false,
@@ -760,7 +819,7 @@ var MemoryStore = class {
 			};
 		}
 		if (await this.detectDrift(target)) {
-			const backup = await this.backupDrift(target);
+			const backup = await this.backupFile(target);
 			return {
 				ok: false,
 				message: `External drift detected in memory file.${backup ? ` A backup was saved to ${basename(backup)}.` : ""} Resolve the drift before retrying.`,
@@ -806,8 +865,10 @@ var MemoryStore = class {
 			chars: 0,
 			limit: this.limitFor(target)
 		};
+		const refusal = await this.oversizedRefusal(target);
+		if (refusal) return refusal;
 		if (await this.detectDrift(target)) {
-			const backup = await this.backupDrift(target);
+			const backup = await this.backupFile(target);
 			return {
 				ok: false,
 				message: `External drift detected in memory file.${backup ? ` A backup was saved to ${basename(backup)}.` : ""} Resolve the drift before retrying.`,
@@ -898,12 +959,27 @@ var MemoryStore = class {
 		const memory = await this.read("memory");
 		const user = await this.read("user");
 		const parts = [];
-		for (const [target, entries] of [["Memory", memory], ["User Profile", user]]) {
+		for (const [target, label, entries] of [[
+			"memory",
+			"Memory",
+			memory
+		], [
+			"user",
+			"User Profile",
+			user
+		]]) {
+			const oversized = entries.length === 0 ? await this.oversizedFile(target) : null;
+			if (oversized) {
+				parts.push(`## ${label} — file skipped: ${oversized.size} bytes (limit ${oversized.limit * READ_GUARD_FACTOR}); not read`);
+				continue;
+			}
 			const safe = entries.filter((entry) => !scanMemoryThreats(entry));
 			if (safe.length > 0) {
 				const body = safe.join(ENTRY_DELIMITER);
+				const limit = this.limitFor(target);
+				const pct = limit > 0 ? Math.min(100, Math.floor(body.length * 100 / limit)) : 0;
 				const note = safe.length === entries.length ? "" : ` (${entries.length - safe.length} threat-matched entries filtered)`;
-				parts.push(`## ${target} (${safe.length} entries)${note}\n${body}`);
+				parts.push(`## ${label} (${safe.length} entries) [${pct}% — ${body.length}/${limit} chars]${note}\n${body}`);
 			}
 		}
 		return parts.join("\n\n");
@@ -928,6 +1004,7 @@ var MemoryStore = class {
 	* same serialization and returns false, so a normal write is never flagged.
 	*/
 	async detectDrift(target) {
+		if (await this.oversizedFile(target)) return true;
 		const raw = await this.io.readText(fileFor(this.root, target));
 		if (raw === null) return false;
 		return render(normalizeEntries(raw)) !== raw;

package/lib/types/io.d.ts

@@ -13,6 +13,13 @@ export interface EvolutionIoLike {
     exists(path: string): Promise<boolean>;
     rename(path: string, destination: string): Promise<void>;
     copy(path: string, destination: string): Promise<void>;
+    /**
+     * Optional byte-size probe for the read guard. Return the file's size in
+     * bytes, or `null`/`undefined` when unknown (unsupported backend, missing
+     * file, stat failure). An implementation without this probe gets no guard:
+     * consumers treat an unknown size as "guard not applicable".
+     */
+    size?(path: string): Promise<number | null>;
 }
 /** Lazy adapter over an IO provider registry, shared by every evolution consumer. */
 export declare function evolutionIoAdapter(provider: () => EvolutionIoLike): EvolutionIoLike;

package/lib/types/memory-store.d.ts

@@ -37,6 +37,13 @@ export declare class MemoryStore {
     private failureCount;
     constructor(options?: MemoryStoreOptions);
     limitFor(target: MemoryTarget): number;
+    /**
+     * Read-guard probe: `{ size, limit }` when the on-disk file exceeds
+     * `limit * READ_GUARD_FACTOR` bytes, `null` when it is absent, unknown
+     * (backend without a size probe), under the bound, or the target has no
+     * limit configured.
+     */
+    private oversizedFile;
     read(target: MemoryTarget): Promise<string[]>;
     write(target: MemoryTarget, entries: string[]): Promise<void>;
     resetFailures(): void;
@@ -44,11 +51,21 @@ export declare class MemoryStore {
     /** Percent-based storage hint appended to success message once the target is ≥80% full. */
     private storageHint;
     /**
-     * Best-effort copy of the drifted on-disk file to `<file>.bak.<stamp>` before
-     * refusing the write, so an external edit stays recoverable. Failure to back
-     * up does not change the refusal semantics.
+     * Best-effort raw-copy backup of the on-disk file to `<file>.bak.<stamp>`
+     * before a refusal, so an externally modified (or oversized) file stays
+     * recoverable. Copies bytes instead of reading them so a pathologically
+     * large file is never loaded just to back it up. Failure to back up does
+     * not change the refusal semantics.
+     */
+    private backupFile;
+    /**
+     * Read-guard refusal for write paths. Returns the refusal result when the
+     * target file is oversized, `null` otherwise. The file is skipped for
+     * reading (never loaded), backed up by raw copy, and the model is told to
+     * fix it manually — mirroring the drift refusal so corrupted state is never
+     * silently overwritten.
      */
-    private backupDrift;
+    private oversizedRefusal;
     add(target: MemoryTarget, facts: string): Promise<MemoryApplyResult>;
     replace(target: MemoryTarget, oldText: string, facts: string): Promise<MemoryApplyResult>;
     remove(target: MemoryTarget, oldText: string): Promise<MemoryApplyResult>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.1.0-rc.21",
+  "version": "0.1.0-rc.22",
   "publishConfig": {
     "access": "public"
   },