@lotargo/memory_plugin 1.4.621 → 1.5.1

package/mcp-server/ingest/normalizer.js

@@ -30,15 +30,51 @@ export function cleanHtml(html) {
   return cleaned;
 }
 
+export function validateUrlForSsrf(urlStr) {
+  if (typeof urlStr !== "string" || !urlStr.trim()) {
+    throw new Error(`Unsupported URL for ingestion: '${urlStr}'. Only http/https URLs are supported.`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(urlStr.trim());
+  } catch {
+    throw new Error(`Invalid URL format for ingestion: '${urlStr}'`);
+  }
+
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Unsupported URL scheme '${parsed.protocol}'. Only http/https are allowed.`);
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+
+  const isBlocked =
+    hostname === "localhost" ||
+    hostname === "127.0.0.1" ||
+    hostname === "::1" ||
+    hostname === "169.254.169.254" ||
+    hostname === "metadata.google.internal" ||
+    /^127\./.test(hostname) ||
+    /^10\./.test(hostname) ||
+    /^192\.168\./.test(hostname) ||
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(hostname) ||
+    /^169\.254\./.test(hostname) ||
+    /^0\./.test(hostname);
+
+  if (isBlocked) {
+    throw new Error(`Ingestion blocked: URL '${urlStr}' targets a private/local IP address or metadata service.`);
+  }
+
+  return parsed;
+}
+
 // Fetch a web page and convert it to Markdown/text. Used by the 'url' ingestion type
 // so the RAG store gets the page CONTENT, not just the URL string.
 export async function fetchUrlContent(url) {
-  if (typeof url !== "string" || !/^https?:\/\//i.test(url.trim())) {
-    throw new Error(`Unsupported URL for ingestion: '${url}'. Only http/https URLs are supported.`);
-  }
+  const parsed = validateUrlForSsrf(url);
+  const targetUrl = parsed.toString();
   let res;
   try {
-    res = await fetch(url.trim(), {
+    res = await fetch(targetUrl, {
       headers: {
         "User-Agent": "memory-agent-rag/1.0",
         Accept: "text/html,application/xhtml+xml,application/json,text/plain,*/*",

package/mcp-server/ingest/pipeline.js

@@ -85,12 +85,9 @@ export async function ingestDocument({
   try {
     const existingDoc = await db.prepare("SELECT id FROM documents WHERE path = ?").get(docPath);
     if (existingDoc) {
-      const microChunks = await db.prepare("SELECT id FROM micro_chunks WHERE doc_id = ?").all(existingDoc.id);
-      for (const mc of microChunks) {
-        try {
-          await db.prepare("DELETE FROM micro_chunks_fts WHERE id = ?").run(mc.id);
-        } catch {}
-      }
+      try {
+        await db.prepare("DELETE FROM micro_chunks_fts WHERE id IN (SELECT id FROM micro_chunks WHERE doc_id = ?);").run(existingDoc.id);
+      } catch {}
       await db.prepare("DELETE FROM graph_edges WHERE source_id = ? OR target_id = ?").run(existingDoc.id, existingDoc.id);
       await db.prepare("DELETE FROM documents WHERE id = ?").run(existingDoc.id);
     }
@@ -184,8 +181,6 @@ export async function deleteDocument(docIdOrPath, customDb = null, customBlobDir
     return { deleted: false, reason: "Document not found" };
   }
 
-  const microChunks = await db.prepare("SELECT id FROM micro_chunks WHERE doc_id = ?").all(doc.id);
-
   // Collect every id owned by this document so we can purge dangling graph edges
   // (graph_edges has no FK constraints, so section/chunk/doc references would otherwise leak).
   const ownedIds = [doc.id];
@@ -196,11 +191,9 @@ export async function deleteDocument(docIdOrPath, customDb = null, customBlobDir
 
   await db.exec("BEGIN IMMEDIATE;");
   try {
-    for (const mc of microChunks) {
-      try {
-        await db.prepare("DELETE FROM micro_chunks_fts WHERE id = ?").run(mc.id);
-      } catch {}
-    }
+    try {
+      await db.prepare("DELETE FROM micro_chunks_fts WHERE id IN (SELECT id FROM micro_chunks WHERE doc_id = ?);").run(doc.id);
+    } catch {}
 
     // Auto-clean Agent knowledge graph links pointing at this document.
     await db.prepare("DELETE FROM knowledge_links WHERE doc_id = ?").run(doc.id);

package/mcp-server/memory.js

@@ -2,6 +2,7 @@ import { readFile, writeFile, mkdir, unlink, readdir } from "fs/promises";
 import { existsSync, mkdirSync } from "fs";
 import { join, basename, resolve } from "path";
 import { homedir } from "os";
+import { resolveProjectIdentity } from "./identity.js";
 
 function resolveMemoryDir() {
   if (process.env.MEMORY_DIR) return process.env.MEMORY_DIR;
@@ -46,7 +47,6 @@ export function ensureDirSync() {
   if (!existsSync(exportsDir)) mkdirSync(exportsDir, { recursive: true });
 }
 
-// Canonical absolute path key: forward slashes, lowercase drive letter on win32.
 export function canonicalPath(dir) {
   let p = resolve(dir || process.cwd());
   if (process.platform === "win32") {
@@ -55,24 +55,25 @@ export function canonicalPath(dir) {
   return p;
 }
 
-// Project store key = full directory path. This removes basename collisions and
-// binds each store to the real project location.
-export function projectKey(worktree, directory) {
-  return canonicalPath(worktree || directory);
+export async function projectKey(worktree, directory) {
+  const dir = worktree || directory || process.cwd();
+  const identity = await resolveProjectIdentity(dir);
+  return identity ? identity.key : null;
 }
 
-// Display label for a project (basename of the resolved directory).
-export function projectName(worktree, directory) {
+export async function projectName(worktree, directory) {
   const dir = worktree || directory || process.cwd();
-  return dir ? basename(resolve(dir)) : "default";
+  const identity = await resolveProjectIdentity(dir);
+  return identity ? identity.name : (dir ? basename(resolve(dir)) : "default");
 }
 
-export function scopeKey(scope, worktree, directory) {
-  return scope === "global" ? GLOBAL_KEY : projectKey(worktree, directory);
+export async function scopeKey(scope, worktree, directory) {
+  return scope === "global" ? GLOBAL_KEY : await projectKey(worktree, directory);
 }
 
-function slugify(key) {
-  return key.replace(/[^a-zA-Z0-9_-]/g, "_");
+export function slugify(key) {
+  if (!key) return "null";
+  return String(key).replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 
 function memoryPath(key) {
@@ -87,44 +88,17 @@ export function storeFilePath(key) {
   return memoryPath(key);
 }
 
-function parseMeta(content) {
-  const m = content.match(/<!-- path: (.+?) -->/);
-  return { path: m ? m[1].trim() : null };
+export function parseMeta(content) {
+  const m = content.match(/<!-- key: (.+?) -->/) || content.match(/<!-- path: (.+?) -->/);
+  return { key: m ? m[1].trim() : null };
 }
 
 function isSimpleKey(key) {
   return /^[a-zA-Z0-9_-]+$/.test(key);
 }
 
-// Lazy migration: when reading a project path store that doesn't exist yet but a
-// legacy <basename>.md store (without path binding) does, claim it under the path.
-async function maybeMigrateLegacy(key) {
-  if (key === GLOBAL_KEY || isSimpleKey(key)) return null;
-  const legacyBasename = basename(key);
-  if (!legacyBasename) return null;
-  const legacyFp = join(MEMORY_DIR, `${legacyBasename}.md`);
-  if (slugify(key) === legacyBasename || !existsSync(legacyFp)) return null;
-  const content = await readFile(legacyFp, "utf-8");
-  if (parseMeta(content).path) return null; // already bound to another project
-  // Collision guard: a different path with the same basename is already bound,
-  // so this legacy store is ambiguous and must not be silently claimed.
-  const files = await readdir(MEMORY_DIR).catch(() => []);
-  for (const f of files) {
-    if (!f.endsWith(".md") || f === `${legacyBasename}.md` || f === `${GLOBAL_KEY}.md`) continue;
-    try {
-      const other = parseMeta(await readFile(join(MEMORY_DIR, f), "utf-8")).path;
-      if (other && basename(other) === legacyBasename) return null;
-    } catch (e) {}
-  }
-  const facts = content.split("\n").filter((l) => l.startsWith("- ["));
-  await writeMemory(key, facts);
-  try {
-    await unlink(legacyFp);
-  } catch (e) {}
-  return facts;
-}
-
 export async function readMemory(key) {
+  if (!key) return [];
   const { getConfig } = await import("./config/config_manager.js");
   const config = getConfig();
   if (config.mode === "only-cloud") {
@@ -143,7 +117,6 @@ export async function readMemory(key) {
 
   const fp = memoryPath(key);
   if (config.mode === "hybrid-sync") {
-    // Pull cloud state down first so cloud-only records appear locally.
     try {
       const { ensureReverseSync } = await import("./db/sync_queue.js");
       await ensureReverseSync();
@@ -155,40 +128,35 @@ export async function readMemory(key) {
     const content = await readFile(fp, "utf-8");
     return content.split("\n").filter((l) => l.startsWith("- ["));
   }
-  const migrated = await maybeMigrateLegacy(key);
-  return migrated || [];
+  return [];
 }
 
 export async function readMemoryRaw(key) {
   return (await readMemory(key)).map((e) => e.slice(2));
 }
 
-// Build the markdown store content for a key from a list of fact lines.
 export function buildMemoryContent(key, entries) {
   const lines = [];
   if (key === GLOBAL_KEY) {
     lines.push("# Global Memory", "");
   } else {
     lines.push(`# Memory: ${basename(key) || key}`, "");
-    if (!isSimpleKey(key)) {
-      lines.push(`<!-- path: ${key} -->`, "");
-    }
+    lines.push(`<!-- key: ${key} -->`, "");
   }
   return lines.join("\n") + "\n" + (entries.length ? entries.join("\n") + "\n" : "");
 }
 
-// Extract fact lines (`- [date] ...`) from a store content string.
 export function extractFacts(content) {
   return (content || "").split("\n").filter((l) => l.startsWith("- ["));
 }
 
-// Write a store file directly to disk WITHOUT enqueueing a cloud sync task.
-// Used by the sync worker to apply pulled cloud state without re-queueing.
 export async function writeMemoryFile(key, content) {
+  if (!key) return;
   await writeFile(memoryPath(key), content);
 }
 
 export async function writeMemory(key, entries) {
+  if (!key) return;
   const content = buildMemoryContent(key, entries);
 
   const { getConfig } = await import("./config/config_manager.js");
@@ -236,11 +204,11 @@ export async function listProjectStores() {
         const meta = parseMeta(content);
         stores.push({
           key,
-          path: meta.path || (key.includes("/") || key.includes(":") ? key : null),
-          basename: basename(meta.path || key) || key,
+          path: meta.key || key,
+          basename: basename(meta.key || key) || key,
           file: `${slugify(key)}.md`,
           count: facts.length,
-          legacy: !meta.path,
+          legacy: !meta.key || (!meta.key.startsWith("git:") && !meta.key.startsWith("git_")),
         });
       }
       stores.sort((a, b) => a.basename.localeCompare(b.basename));
@@ -264,27 +232,29 @@ export async function listProjectStores() {
     }
     const facts = content.split("\n").filter((l) => l.startsWith("- ["));
     const meta = parseMeta(content);
-    const key = meta.path || f.slice(0, -3);
+    const key = meta.key || f.slice(0, -3);
     stores.push({
       key,
-      path: meta.path,
-      basename: basename(meta.path || key) || key,
+      path: meta.key,
+      basename: basename(meta.key || key) || key,
       file: f,
       count: facts.length,
-      legacy: !meta.path,
+      legacy: !meta.key || (!meta.key.startsWith("git:") && !meta.key.startsWith("git_")),
     });
   }
   stores.sort((a, b) => a.basename.localeCompare(b.basename));
   return stores;
 }
 
-// Bind an unbound legacy store (e.g. "comfy-meta-viewer") to a directory path.
 export async function migrateLegacyStore(legacyKey, targetDir) {
   const legacyFp = join(MEMORY_DIR, `${legacyKey.replace(/[^a-zA-Z0-9_-]/g, "_")}.md`);
   if (!existsSync(legacyFp)) return { ok: false, reason: "not_found", key: legacyKey };
   const content = await readFile(legacyFp, "utf-8");
-  if (parseMeta(content).path) return { ok: false, reason: "already_bound", key: legacyKey };
-  const targetKey = projectKey(targetDir, null);
+  if (parseMeta(content).key) return { ok: false, reason: "already_bound", key: legacyKey };
+
+  const targetKey = await projectKey(targetDir, null);
+  if (!targetKey) return { ok: false, reason: "not_a_git_repo", key: legacyKey };
+
   const facts = content.split("\n").filter((l) => l.startsWith("- ["));
   await writeMemory(targetKey, facts);
   try {
@@ -293,6 +263,23 @@ export async function migrateLegacyStore(legacyKey, targetDir) {
   return { ok: true, key: targetKey, file: memoryPath(targetKey), facts: facts.length };
 }
 
+// Mass-stamp titles onto legacy facts in a store. Returns how many lines were
+// changed. Skips stores that already have titles on every fact (fast no-op).
+export async function migrateStoreTitles(key) {
+  if (!key) return { ok: false, reason: "no_key", changed: 0 };
+  const { withTitle } = await import("./fact_format.js");
+  const facts = await readMemory(key);
+  let changed = 0;
+  const migrated = facts.map((line) => {
+    const next = withTitle(line);
+    if (next !== line) changed++;
+    return next;
+  });
+  if (!changed) return { ok: true, changed: 0 };
+  await writeMemory(key, migrated);
+  return { ok: true, changed };
+}
+
 export function today() {
   const d = new Date();
   const date = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;

package/mcp-server/prompt_manager.js

@@ -9,7 +9,7 @@ const END_MARKER = "<!-- END MEMORY AGENT PROMPT -->";
 
 export const PROMPT_BLOCK = `${START_MARKER}
 [SYSTEM INSTRUCTION: PERSONAL CONTEXT & MEMORY AGENT]
-1. MANDATORY FIRST STEP (SESSION INITIALIZATION): At the very start of every session or conversation, your VERY FIRST ACTION MUST BE to execute \`recall\` from \`memory-agent\` to load all saved facts, user preferences, personal context, and project guidelines BEFORE performing any other tasks or reading code.
+1. MANDATORY FIRST STEP (SESSION INITIALIZATION): At the very start of every session or conversation, your VERY FIRST ACTION MUST BE to execute \`recall\` from \`memory-agent\` with \`scope: "all"\` (or without restrictive query filters) to load ALL saved global facts, user preferences, personal context, and project guidelines BEFORE performing any other tasks or reading code. Do NOT filter or restrict the initial \`recall\` call with specific query keywords or scoped parameters, so that no global facts are missed.
 2. PROACTIVE SAVING DIRECTIVE: You MUST automatically and proactively call \`remember\` from \`memory-agent\` whenever the user shares durable facts, personal preferences, coding guidelines, technology choices, or project architecture decisions. Do NOT wait for explicit user commands like "remember this".
 3. SIGNAL FILTER: Save only high-signal facts (name, language, roles, constraints, tech stack preferences, architecture decisions, conventions). Translate facts into clear, concise English when saving. Do NOT save transient details or one-off conversation turns.
 ${END_MARKER}`;

package/mcp-server/retrieval/retriever.js

@@ -263,57 +263,74 @@ export async function hybridQuery({
 
   // Parent-Child Rollup: Deduplicate hits sharing the same medium_id or section_id to prevent noise
   const parentDeduplicatedHits = [];
-  const seenParents = new Set();
-  const parentLookupStmt = db.prepare(`
-    SELECT medium_id, section_id FROM micro_chunks WHERE id = ?;
-  `);
-
-  for (const hit of fusedHits) {
-    const row = await parentLookupStmt.get(hit.id);
-    const parentKey = row ? (row.medium_id || row.section_id) : hit.id;
-    if (!seenParents.has(parentKey)) {
-      seenParents.add(parentKey);
-      parentDeduplicatedHits.push(hit);
+  if (fusedHits.length > 0) {
+    const hitIds = fusedHits.map((h) => h.id);
+    const placeholders = hitIds.map(() => "?").join(",");
+    const rows = await db.prepare(`
+      SELECT id, medium_id, section_id FROM micro_chunks WHERE id IN (${placeholders});
+    `).all(...hitIds);
+    const parentMap = new Map(rows.map((r) => [r.id, r]));
+
+    const seenParents = new Set();
+    for (const hit of fusedHits) {
+      const row = parentMap.get(hit.id);
+      const parentKey = row ? (row.medium_id || row.section_id) : hit.id;
+      if (!seenParents.has(parentKey)) {
+        seenParents.add(parentKey);
+        parentDeduplicatedHits.push(hit);
+      }
     }
   }
 
   const topHits = parentDeduplicatedHits.slice(0, limit);
   const results = [];
 
-  const secStmt = db.prepare(`
-    SELECT s.id as section_id, s.heading, s.breadcrumbs, s.content as section_content,
-           med.content as medium_content, d.title as doc_title, d.path as doc_path
-    FROM micro_chunks m
-    JOIN sections s ON m.section_id = s.id
-    JOIN documents d ON m.doc_id = d.id
-    LEFT JOIN medium_chunks med ON m.medium_id = med.id
-    WHERE m.id = ?;
-  `);
-
-  for (const hit of topHits) {
-    const detail = await secStmt.get(hit.id);
-    if (!detail) continue;
-
-    let symbols = [];
+  if (topHits.length > 0) {
+    const topIds = topHits.map((h) => h.id);
+    const placeholders = topIds.map(() => "?").join(",");
+    const details = await db.prepare(`
+      SELECT m.id as micro_id, s.id as section_id, s.heading, s.breadcrumbs, s.content as section_content,
+             med.content as medium_content, d.title as doc_title, d.path as doc_path
+      FROM micro_chunks m
+      JOIN sections s ON m.section_id = s.id
+      JOIN documents d ON m.doc_id = d.id
+      LEFT JOIN medium_chunks med ON m.medium_id = med.id
+      WHERE m.id IN (${placeholders});
+    `).all(...topIds);
+
+    const detailMap = new Map(details.map((d) => [d.micro_id, d]));
+
+    let symbolsBySection = new Map();
     if (includeGraphContext) {
-      symbols = await getRelatedSymbols(db, detail.section_id);
+      const sectionIds = [...new Set(details.map((d) => d.section_id).filter(Boolean))];
+      if (sectionIds.length > 0) {
+        const { getRelatedSymbolsBatch } = await import("../graph/graph_extractor.js");
+        symbolsBySection = await getRelatedSymbolsBatch(db, sectionIds);
+      }
     }
 
-    results.push({
-      chunk_id: hit.id,
-      doc_title: detail.doc_title,
-      doc_path: detail.doc_path,
-      heading: detail.heading,
-      breadcrumbs: detail.breadcrumbs,
-      snippet: hit.content,
-      paragraph_context: detail.medium_content || hit.content,
-      full_section_content: detail.section_content,
-      score: parseFloat((hit.score || 0).toFixed(4)),
-      rsf_score: hit.rsf_score ? parseFloat(hit.rsf_score.toFixed(4)) : null,
-      rrf_score: hit.rrf_score ? parseFloat(hit.rrf_score.toFixed(4)) : null,
-      cosine_sim: hit.cosine_sim ? parseFloat(hit.cosine_sim.toFixed(4)) : null,
-      defined_symbols: symbols,
-    });
+    for (const hit of topHits) {
+      const detail = detailMap.get(hit.id);
+      if (!detail) continue;
+
+      const symbols = symbolsBySection.get(detail.section_id) || [];
+
+      results.push({
+        chunk_id: hit.id,
+        doc_title: detail.doc_title,
+        doc_path: detail.doc_path,
+        heading: detail.heading,
+        breadcrumbs: detail.breadcrumbs,
+        snippet: hit.content,
+        paragraph_context: detail.medium_content || hit.content,
+        full_section_content: detail.section_content,
+        score: parseFloat((hit.score || 0).toFixed(4)),
+        rsf_score: hit.rsf_score ? parseFloat(hit.rsf_score.toFixed(4)) : null,
+        rrf_score: hit.rrf_score ? parseFloat(hit.rrf_score.toFixed(4)) : null,
+        cosine_sim: hit.cosine_sim ? parseFloat(hit.cosine_sim.toFixed(4)) : null,
+        defined_symbols: symbols,
+      });
+    }
   }
 
   return results;

package/mcp-server/tools/helpers.js

@@ -0,0 +1,39 @@
+import * as z from "zod/v4";
+import { factMeta, factText } from "../fact_format.js";
+
+// Optional string/number that tolerates null (some tool-call layers fill omitted
+// optional args with null). Linking fields must NEVER be mandatory.
+export const optStr = () => z.string().optional().nullable();
+export const optNum = () => z.number().optional().nullable();
+export const defStr = (fallback) =>
+  z
+    .string()
+    .nullish()
+    .transform((v) => (v === null || v === undefined || v === "" ? fallback : v));
+export const defBool = (fallback) =>
+  z.boolean().nullish().transform((v) => (v === null || v === undefined ? fallback : v));
+export const defNum = (fallback) =>
+  z.number().nullish().transform((v) => (v === null || v === undefined ? fallback : v));
+
+// Project memory is git-based: outside a git repository there is no project key.
+export function requireProjectKey(key) {
+  if (!key) {
+    throw new Error(
+      "No project memory available: this directory is not inside a git repository. " +
+        "Project memory is tied to a git repo; use scope: 'global' or open a git repository."
+    );
+  }
+  return key;
+}
+
+// Resolve a fact reference (1-based number, metadata id, or text) to an index.
+export function resolveFactIndex(entries, ref) {
+  const trimmed = String(ref || "").trim();
+  if (!trimmed) return -1;
+  const num = parseInt(trimmed, 10);
+  if (/^\d+$/.test(trimmed) && num >= 1 && num <= entries.length) return num - 1;
+  const idIdx = entries.findIndex((e) => factMeta(e).id === trimmed);
+  if (idIdx !== -1) return idIdx;
+  const textIdx = entries.findIndex((e) => factText(e).toLowerCase().includes(trimmed.toLowerCase()));
+  return textIdx;
+}