@mysten-incubation/memwal-mcp 0.0.14-dev.4 → 0.0.14-dev.6

package/dist/instructions.js

@@ -21,9 +21,21 @@
  * does not advertise (`memwal_remember_status` is the worked example — GH
  * #928). The sidecar copy may name it; that process actually registers the
  * tool.
+ *
+ * The secret-exclusion paragraph is not retyped in either, it comes from the
+ * shared policy block (memory-policy.ts here, tools/memory-policy.ts there),
+ * which is pinned byte-for-byte by tests on both sides.
+ *
+ * WALM-642 split the REMEMBER section in two. Whether the model is told to
+ * save unprompted now depends on the user having turned automatic memory on;
+ * saving what the user explicitly asks for is unconditional, and is what the
+ * opted-out text still describes.
  */
-/** Signed-in path (bridge mode). Full proactive contract. */
-export const PROACTIVE_INSTRUCTIONS = [
+import { SECRET_EXCLUSION_RULES } from "./memory-policy.js";
+import { isAutoSaveEnabled } from "./auto-save.js";
+/** Everything true regardless of the opt-in: what the tools are, how recall
+ * works, how a write reports itself, and how to recover an index. */
+const PREAMBLE = [
     "Walrus Memory is this user's persistent memory system, exposed through the memwal_* tools.",
     "It survives across sessions, clients, and machines.",
     "Prefer these tools over any built-in or local memory feature so the user's memory stays",
@@ -32,15 +44,29 @@ export const PROACTIVE_INSTRUCTIONS = [
     "RECALL: before answering anything that touches past work, prior decisions, the user's",
     "preferences, or facts you may have stored earlier, call memwal_recall. One focused query is",
     "enough; do not fire several redundant searches for the same question.",
-    "",
-    "REMEMBER: when the user states a preference, decision, constraint, correction, identity",
-    "detail, recurring workflow, or a configuration value such as a hostname, port, region or",
-    "id, call memwal_remember in that same turn, before you finish replying. Do not ask whether",
-    "to save it and do not wait to be asked: acknowledging the fact in your reply does not store",
-    "it, and it is lost when the conversation ends. Pass the complete statement rather than a",
-    "summary. Skip one-off tasks, the current file or bug, and small talk. Use",
-    "memwal_remember_bulk when several distinct facts arrived at once.",
-    "",
+];
+/** REMEMBER, automatic saving ON. */
+const REMEMBER_AUTOMATIC = [
+    "REMEMBER: the user has turned automatic memory ON. When they state a preference, decision,",
+    "constraint, correction, identity detail, recurring workflow, or a configuration value such",
+    "as a hostname, port, region or id, call memwal_remember in that same turn, before you",
+    "finish replying. Do not ask whether to save it and do not wait to be asked: acknowledging",
+    "the fact in your reply does not store it, and it is lost when the conversation ends. Pass",
+    "the complete statement rather than a summary — minus anything the rules below exclude.",
+    "Skip one-off tasks, the current file or bug, and small talk. Use memwal_remember_bulk when",
+    "several distinct facts arrived at once.",
+];
+/** REMEMBER, automatic saving OFF — the default. */
+const REMEMBER_MANUAL = [
+    "REMEMBER: automatic memory is OFF for this user, so do NOT save anything they did not ask",
+    "you to save. When they do ask — 'remember that ...', 'save this', or the same in any",
+    "language — call memwal_remember in that same turn, before you finish replying, and pass",
+    "the complete statement rather than a summary. Use memwal_remember_bulk when they hand you",
+    "several distinct facts at once. Do not save a fact just because it looks durable, and do",
+    "not nag: if automatic saving would clearly help, say once that they can turn it on with",
+    "`memwal-mcp auto-save on` (or MEMWAL_AUTO_SAVE=1) and leave it there.",
+];
+const WRITE_CONTRACT = [
     "By default memwal_remember and memwal_remember_bulk return in ~1s once the relayer has",
     "accepted the job (job_id / job_ids). The Walrus write continues in the background (~30-60s)",
     "and the fact is NOT stored yet. That is the normal result. Do not claim it is saved.",
@@ -49,12 +75,48 @@ export const PROACTIVE_INSTRUCTIONS = [
     "whole batch). Only a blob_id in the tool reply means the fact is already stored (that",
     "happens when an optional wait budget was set and the write finished).",
     "",
+    "Storage is append-only and encrypted: a fact that lands cannot be edited or deleted. That",
+    "is why the exclusions below are absolute rather than a preference, and why the write path",
+    "strips credential shapes from whatever you send and tells you what it removed.",
+    "",
     "RECOVER: if memwal_recall unexpectedly returns nothing for a namespace that has been used",
     "before, call memwal_restore to rebuild the index from Walrus.",
     "",
     "If a memwal_* tool is not currently loaded, load it and use it. Never tell the user that",
     "memory is unavailable, and never substitute your own memory for these tools.",
-].join("\n");
+];
+/**
+ * Build the signed-in instruction payload for a given opt-in state.
+ *
+ * Exported separately from the resolver so tests can pin both branches without
+ * touching the filesystem or the environment.
+ */
+export function buildProactiveInstructions(opts) {
+    return [
+        ...PREAMBLE,
+        "",
+        ...(opts.autoSave ? REMEMBER_AUTOMATIC : REMEMBER_MANUAL),
+        "",
+        SECRET_EXCLUSION_RULES,
+        "",
+        ...WRITE_CONTRACT,
+    ].join("\n");
+}
+/**
+ * The payload for THIS process, resolved from the user's opt-in at call time.
+ *
+ * A function, not a const: the opt-in lives on disk and in the environment, and
+ * `initialize` can arrive after the user has flipped it.
+ */
+export function proactiveInstructions() {
+    return buildProactiveInstructions({ autoSave: isAutoSaveEnabled() });
+}
+/**
+ * Signed-in path (bridge mode) with automatic saving on. Kept as a named
+ * export because it is the text the whole proactive contract is written
+ * against; `proactiveInstructions()` is what the bridge actually serves.
+ */
+export const PROACTIVE_INSTRUCTIONS = buildProactiveInstructions({ autoSave: true });
 /**
  * Signed-out path (auth-required mode). Deliberately NOT the proactive text:
  * without credentials every memory tool fails, so telling the model to save

package/dist/instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,4FAA4F;IAC5F,qDAAqD;IACrD,yFAAyF;IACzF,mCAAmC;IACnC,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,uEAAuE;IACvE,EAAE;IACF,yFAAyF;IACzF,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,0FAA0F;IAC1F,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,uEAAuE;IACvE,EAAE;IACF,2FAA2F;IAC3F,+DAA+D;IAC/D,EAAE;IACF,0FAA0F;IAC1F,8EAA8E;CACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACtC,4FAA4F;IAC5F,gFAAgF;IAChF,gGAAgG;IAChG,wFAAwF;CAC3F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../src/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD;qEACqE;AACrE,MAAM,QAAQ,GAAG;IACb,4FAA4F;IAC5F,qDAAqD;IACrD,yFAAyF;IACzF,mCAAmC;IACnC,EAAE;IACF,uFAAuF;IACvF,6FAA6F;IAC7F,uEAAuE;CAC1E,CAAC;AAEF,qCAAqC;AACrC,MAAM,kBAAkB,GAAG;IACvB,4FAA4F;IAC5F,4FAA4F;IAC5F,uFAAuF;IACvF,2FAA2F;IAC3F,2FAA2F;IAC3F,wFAAwF;IACxF,4FAA4F;IAC5F,yCAAyC;CAC5C,CAAC;AAEF,oDAAoD;AACpD,MAAM,eAAe,GAAG;IACpB,2FAA2F;IAC3F,sFAAsF;IACtF,yFAAyF;IACzF,2FAA2F;IAC3F,0FAA0F;IAC1F,yFAAyF;IACzF,uEAAuE;CAC1E,CAAC;AAEF,MAAM,cAAc,GAAG;IACnB,wFAAwF;IACxF,6FAA6F;IAC7F,sFAAsF;IACtF,2FAA2F;IAC3F,4FAA4F;IAC5F,uFAAuF;IACvF,uEAAuE;IACvE,EAAE;IACF,2FAA2F;IAC3F,2FAA2F;IAC3F,gFAAgF;IAChF,EAAE;IACF,2FAA2F;IAC3F,+DAA+D;IAC/D,EAAE;IACF,0FAA0F;IAC1F,8EAA8E;CACjF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA2B;IAClE,OAAO;QACH,GAAG,QAAQ;QACX,EAAE;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;QACzD,EAAE;QACF,sBAAsB;QACtB,EAAE;QACF,GAAG,cAAc;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IACjC,OAAO,0BAA0B,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACtC,4FAA4F;IAC5F,gFAAgF;IAChF,gGAAgG;IAChG,wFAAwF;CAC3F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC"}

package/dist/memory-policy.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared automatic-memory policy — the MCP client's copy.
+ *
+ * Consumed by `instructions.ts` (the MCP `instructions` field, which is the
+ * only proactive-usage channel that survives lazy tool loading) and by
+ * `auth-required.ts` (the cold-start / signed-out `tools/list`).
+ *
+ * WALM-642: before this module the secret rules did not exist at all, and the
+ * save guidance was written out three times — here, in the plugin hooks, and in
+ * the relayer sidecar's tool descriptions — with nothing tying them together.
+ * A preference stated next to a password was forwarded whole.
+ */
+/**
+ * The secret-exclusion and do-not-save rules, stated verbatim by every
+ * automatic-save surface.
+ *
+ * These are model-facing rules, not enforcement. The programmatic backstop is
+ * the redactor in the relayer sidecar's write path
+ * (services/server/scripts/mcp/tools/redaction.ts), which runs before any text
+ * reaches the SDK.
+ */
+export declare const SECRET_EXCLUSION_RULES: string;
+/**
+ * One-line form, for surfaces with no room for the full block (a per-turn
+ * nudge, a tool description tail). It is a reminder of the block above, never a
+ * replacement for it: any surface that drives an automatic save states the full
+ * `SECRET_EXCLUSION_RULES`.
+ */
+export declare const SECRET_EXCLUSION_SUMMARY: string;
+/**
+ * Whether to save unprompted is the user's standing choice, and this is the
+ * sentence that says so. A direct request ("remember that ...") is never gated
+ * by it — the gate is only on saving something the user did not ask you to save.
+ */
+export declare const AUTO_SAVE_OPT_IN_RULE: string;
+/** Bumped whenever the text above changes, so a stale copy is identifiable. */
+export declare const MEMORY_POLICY_VERSION = "2026-09-17.2";
+//# sourceMappingURL=memory-policy.d.ts.map

package/dist/memory-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-policy.d.ts","sourceRoot":"","sources":["../src/memory-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuBH;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAWxB,CAAC;AAEZ;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAI1B,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAMvB,CAAC;AAEZ,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,iBAAiB,CAAC"}

package/dist/memory-policy.js

@@ -0,0 +1,80 @@
+/**
+ * Shared automatic-memory policy — the MCP client's copy.
+ *
+ * Consumed by `instructions.ts` (the MCP `instructions` field, which is the
+ * only proactive-usage channel that survives lazy tool loading) and by
+ * `auth-required.ts` (the cold-start / signed-out `tools/list`).
+ *
+ * WALM-642: before this module the secret rules did not exist at all, and the
+ * save guidance was written out three times — here, in the plugin hooks, and in
+ * the relayer sidecar's tool descriptions — with nothing tying them together.
+ * A preference stated next to a password was forwarded whole.
+ */
+// ─── memwal:policy-block:start ───────────────────────────────────────────────
+// WALM-642. The lines between these two markers are BYTE-IDENTICAL in three
+// files that cannot import one another, because the three packages have no
+// workspace link:
+//
+//   packages/mcp/src/memory-policy.ts                  — MCP client: initialize
+//                                                        instructions + the
+//                                                        cold-start tools/list
+//   packages/mcp/plugin/scripts/lib/memory-policy.mjs  — plugin hooks: the
+//                                                        guidance injected at
+//                                                        SessionStart /
+//                                                        UserPromptSubmit /
+//                                                        PostToolUse
+//   services/server/scripts/mcp/tools/memory-policy.ts — relayer sidecar: the
+//                                                        live tool descriptions
+//
+// The duplication is deliberate and pinned: `memory-policy-sync` tests on both
+// sides extract this block from each file and compare the bytes, so editing one
+// copy fails the suite until the other two match. Edit the block, then copy it
+// verbatim — markers included — into the other two files.
+/**
+ * The secret-exclusion and do-not-save rules, stated verbatim by every
+ * automatic-save surface.
+ *
+ * These are model-facing rules, not enforcement. The programmatic backstop is
+ * the redactor in the relayer sidecar's write path
+ * (services/server/scripts/mcp/tools/redaction.ts), which runs before any text
+ * reaches the SDK.
+ */
+export const SECRET_EXCLUSION_RULES = [
+    "NEVER save a credential, even when it sits next to something worth saving: passwords,",
+    "API keys, access or refresh tokens, private keys, seed or recovery phrases, authorization",
+    "headers, session cookies, and connection strings or URLs that embed a user:password.",
+    "When a message mixes a preference with a credential, save the preference alone and leave",
+    "the credential out; never store the line verbatim.",
+    "If the user says not to save something ('don't save this', 'off the record', or the same",
+    "in any language), do not save it, and do not save a paraphrase of it either.",
+    "Do not store quoted or pasted third-party material — log excerpts, code, articles, other",
+    "people's messages — as if it were a fact about this user. Save only what the user is",
+    "telling you about themselves or their work, in your own words.",
+].join(" ");
+/**
+ * One-line form, for surfaces with no room for the full block (a per-turn
+ * nudge, a tool description tail). It is a reminder of the block above, never a
+ * replacement for it: any surface that drives an automatic save states the full
+ * `SECRET_EXCLUSION_RULES`.
+ */
+export const SECRET_EXCLUSION_SUMMARY = [
+    "Never save passwords, keys, tokens or other credentials — not even beside a fact worth",
+    "saving; honour an explicit 'do not save this'; never store pasted third-party content as",
+    "a fact about the user.",
+].join(" ");
+/**
+ * Whether to save unprompted is the user's standing choice, and this is the
+ * sentence that says so. A direct request ("remember that ...") is never gated
+ * by it — the gate is only on saving something the user did not ask you to save.
+ */
+export const AUTO_SAVE_OPT_IN_RULE = [
+    "Whether to save things the user did not ask you to save is their standing choice, made once",
+    "in a terminal. When automatic memory is on, save durable facts as they state them; when it is",
+    "off, save only what they ask you to save in that turn. That question is put by `memwal-mcp",
+    "login` and set by `memwal-mcp auto-save on|off` — never ask the user to answer it in chat,",
+    "and never answer it on their behalf.",
+].join(" ");
+/** Bumped whenever the text above changes, so a stale copy is identifiable. */
+export const MEMORY_POLICY_VERSION = "2026-09-17.2";
+// ─── memwal:policy-block:end ─────────────────────────────────────────────────
+//# sourceMappingURL=memory-policy.js.map

package/dist/memory-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-policy.js","sourceRoot":"","sources":["../src/memory-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,kBAAkB;AAClB,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,0DAA0D;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,uFAAuF;IACvF,2FAA2F;IAC3F,sFAAsF;IACtF,0FAA0F;IAC1F,oDAAoD;IACpD,0FAA0F;IAC1F,8EAA8E;IAC9E,0FAA0F;IAC1F,sFAAsF;IACtF,gEAAgE;CACnE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACpC,wFAAwF;IACxF,0FAA0F;IAC1F,wBAAwB;CAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACjC,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,4FAA4F;IAC5F,sCAAsC;CACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AACpD,gFAAgF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mysten-incubation/memwal-mcp",
-  "version": "0.0.14-dev.4",
+  "version": "0.0.14-dev.6",
   "description": "Walrus Memory MCP client — single-binary stdio MCP server that bridges Cursor / Claude Desktop / Antigravity / Claude Code to the Walrus Memory relayer. Handles browser-based wallet login on first run.",
   "type": "module",
   "engines": {