@namzu/sdk 62.1.0 → 62.2.1

package/dist/store/memory/secrets.js

@@ -0,0 +1,84 @@
+/**
+ * Secret shapes: text that looks like a credential and must not be written to
+ * a memory. A memory is recalled into later prompts, sent to providers and
+ * kept on disk in the clear, so a key saved once is a key leaked many times.
+ *
+ * The match is on shape only. It names a reason code and never returns the
+ * matched text, so a caller can log the code without logging the secret.
+ */
+const PATTERNS = [
+    ['private_key', /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/],
+    [
+        'provider_token',
+        new RegExp([
+            '\\bsk-(?:ant-|proj-|live-|or-v1-)?[A-Za-z0-9_-]{20,}',
+            '\\bgh[pousr]_[A-Za-z0-9]{30,}',
+            '\\bgithub_pat_[A-Za-z0-9_]{30,}',
+            '\\bglpat-[A-Za-z0-9_-]{16,}',
+            '\\bxox[abposr]-[A-Za-z0-9-]{10,}',
+            '\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b',
+            '\\bAIza[A-Za-z0-9_-]{35}\\b',
+            '\\bnvapi-[A-Za-z0-9_-]{20,}',
+            '\\bnpm_[A-Za-z0-9]{30,}',
+            '\\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}',
+            '\\bSG\\.[A-Za-z0-9_-]{16,}\\.[A-Za-z0-9_-]{16,}',
+            '\\bhf_[A-Za-z0-9]{30,}',
+            '\\bBearer\\s+[A-Za-z0-9._~+/-]{24,}=*',
+        ].join('|')),
+    ],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/],
+    ['credentialed_url', /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:[^\s/@]+@[^\s/]+/i],
+];
+/** Shannon entropy of `text`, in bits per character. */
+function entropy(text) {
+    const counts = new Map();
+    for (const ch of text)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let bits = 0;
+    for (const n of counts.values()) {
+        const p = n / text.length;
+        bits -= p * Math.log2(p);
+    }
+    return bits;
+}
+/** How many times the token switches between a letter and a digit. */
+function letterDigitSwitches(token) {
+    let switches = 0;
+    let previous;
+    for (const ch of token) {
+        const kind = /\d/.test(ch) ? 'digit' : /[A-Za-z]/.test(ch) ? 'letter' : undefined;
+        if (kind === undefined)
+            continue;
+        if (previous !== undefined && previous !== kind)
+            switches += 1;
+        previous = kind;
+    }
+    return switches;
+}
+/**
+ * Random, not merely long: a long identifier with a trailing number
+ * (`DecisionsAbcDefGhi1234567890`) has mixed case and a digit but few
+ * letter-digit switches and a low spread, a key has both. A path-like token
+ * is a path.
+ */
+function looksRandom(token) {
+    return (!token.includes('/') &&
+        /[A-Z]/.test(token) &&
+        /[a-z]/.test(token) &&
+        letterDigitSwitches(token) >= 4 &&
+        entropy(token) >= 4.5);
+}
+/** The first secret shape `text` has, or `undefined`. */
+export function findSecretShape(text, options = {}) {
+    for (const [shape, pattern] of PATTERNS)
+        if (pattern.test(text))
+            return shape;
+    if (options.entropy === true) {
+        for (const token of text.match(/[A-Za-z0-9+/_=-]{32,}/g) ?? []) {
+            if (looksRandom(token))
+                return 'high_entropy';
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/store/memory/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/store/memory/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,QAAQ,GAAgD;IAC7D,CAAC,aAAa,EAAE,+CAA+C,CAAC;IAChE;QACC,gBAAgB;QAChB,IAAI,MAAM,CACT;YACC,sDAAsD;YACtD,+BAA+B;YAC/B,iCAAiC;YACjC,6BAA6B;YAC7B,kCAAkC;YAClC,iCAAiC;YACjC,6BAA6B;YAC7B,6BAA6B;YAC7B,yBAAyB;YACzB,yCAAyC;YACzC,iDAAiD;YACjD,wBAAwB;YACxB,uCAAuC;SACvC,CAAC,IAAI,CAAC,GAAG,CAAC,CACX;KACD;IACD,CAAC,KAAK,EAAE,iEAAiE,CAAC;IAC1E,CAAC,kBAAkB,EAAE,qDAAqD,CAAC;CAC3E,CAAA;AAED,wDAAwD;AACxD,SAAS,OAAO,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,EAAE,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,sEAAsE;AACtE,SAAS,mBAAmB,CAAC,KAAa;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,QAAwC,CAAA;IAC5C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACjF,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,IAAI,CAAC,CAAA;QAC9D,QAAQ,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,CACN,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACnB,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CACrB,CAAA;AACF,CAAC;AAWD,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAC9B,IAAY,EACZ,UAA6B,EAAE;IAE/B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ;QAAE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,IAAI,WAAW,CAAC,KAAK,CAAC;gBAAE,OAAO,cAAc,CAAA;QAC9C,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/tools/memory/save.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"save.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/save.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAsEtE"}
+{"version":3,"file":"save.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/save.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAK/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAyEtE"}

package/dist/tools/memory/save.js

@@ -3,6 +3,7 @@ import { MemoryContentRejectedError, MemoryNameConflictError } from '../../store
 import { AGENT_MEMORY_SOURCE } from '../../store/memory/origin.js';
 import { defineTool } from '../defineTool.js';
 import { memoryFieldsSchema } from './fields.js';
+import { refuseSecret } from './secret-guard.js';
 export function buildSaveMemoryTool(store) {
     return defineTool({
         name: 'save_memory',
@@ -10,6 +11,7 @@ export function buildSaveMemoryTool(store) {
             'Save one memory for later sessions in this project: a single fact that the code, the history and the docs do not already hold.',
             'Choose a type: user (who the person is and how they like to work), feedback (a rule they gave about how to work), project (a fact or decision about the work), reference (where to look for something).',
             'For feedback and project memories, write the rule or fact first, then a line starting "Why:" and a line starting "How to apply:".',
+            'Never save a secret: an API key, token, password, private key or a URL with credentials in it is refused.',
             'Link a related memory by writing [[its-name]] in the content.',
             'The name must be new: a name another memory holds is refused, and the reply points to update_memory.',
             "Returns the saved memory's id and name.",
@@ -27,6 +29,9 @@ export function buildSaveMemoryTool(store) {
         destructive: false,
         concurrencySafe: true,
         async execute({ title, summary, content, tags, name, description, type }, context) {
+            const refused = refuseSecret([title, summary, content, description, ...(tags ?? [])]);
+            if (refused)
+                return refused;
             try {
                 const { entry } = await store.create({
                     title,

package/dist/tools/memory/save.js.map

@@ -1 +1 @@
-{"version":3,"file":"save.js","sourceRoot":"","sources":["../../../src/tools/memory/save.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACrD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE;YACZ,gIAAgI;YAChI,yMAAyM;YACzM,mIAAmI;YACnI,+DAA+D;YAC/D,sGAAsG;YACtG,yCAAyC;SACzC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC5D,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACxE,GAAG,kBAAkB;SACrB,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO;YAChF,IAAI,CAAC;gBACJ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBACpC,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,QAAQ,EAAE;wBACT,MAAM,EAAE,mBAAmB;wBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACtB;iBACD,CAAC,CAAA;gBAEF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,iBAAiB,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxF,IAAI,EAAE;wBACL,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD;iBACD,CAAA;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBACjD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,yBAAyB;wBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;qBAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mBAAmB,KAAK,CAAC,UAAU,qBAAqB,KAAK,CAAC,UAAU,8FAA8F;oBAC9K,KAAK,EAAE,4BAA4B;oBACnC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;iBAC9D,CAAA;YACF,CAAC;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"save.js","sourceRoot":"","sources":["../../../src/tools/memory/save.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACrD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE;YACZ,gIAAgI;YAChI,yMAAyM;YACzM,mIAAmI;YACnI,2GAA2G;YAC3G,+DAA+D;YAC/D,sGAAsG;YACtG,yCAAyC;SACzC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC5D,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACxE,GAAG,kBAAkB;SACrB,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO;YAChF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACrF,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,IAAI,CAAC;gBACJ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBACpC,KAAK;oBACL,OAAO;oBACP,OAAO;oBACP,IAAI;oBACJ,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,QAAQ,EAAE;wBACT,MAAM,EAAE,mBAAmB;wBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;qBACtB;iBACD,CAAC,CAAA;gBAEF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,iBAAiB,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxF,IAAI,EAAE;wBACL,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACzD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzD;iBACD,CAAA;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBACjD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,yBAAyB;wBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;qBAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mBAAmB,KAAK,CAAC,UAAU,qBAAqB,KAAK,CAAC,UAAU,8FAA8F;oBAC9K,KAAK,EAAE,4BAA4B;oBACnC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;iBAC9D,CAAA;YACF,CAAC;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/tools/memory/secret-guard.d.ts

@@ -0,0 +1,8 @@
+import type { ToolResult } from '../../types/tool/index.js';
+/**
+ * A refusal when any field a model is saving holds a secret, else `undefined`.
+ * The reply names the shape, never the text, so the refusal does not repeat
+ * the secret into the transcript.
+ */
+export declare function refuseSecret(fields: readonly (string | undefined)[]): ToolResult | undefined;
+//# sourceMappingURL=secret-guard.d.ts.map

package/dist/tools/memory/secret-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-guard.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/secret-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE3D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,UAAU,GAAG,SAAS,CAc5F"}

package/dist/tools/memory/secret-guard.js

@@ -0,0 +1,23 @@
+import { findSecretShape } from '../../store/memory/secrets.js';
+/**
+ * A refusal when any field a model is saving holds a secret, else `undefined`.
+ * The reply names the shape, never the text, so the refusal does not repeat
+ * the secret into the transcript.
+ */
+export function refuseSecret(fields) {
+    for (const field of fields) {
+        if (field === undefined)
+            continue;
+        const shape = findSecretShape(field);
+        if (shape === undefined)
+            continue;
+        return {
+            success: false,
+            output: 'The memory looks like it contains a secret (an API key, token, password, private key or a URL with credentials). Memories are recalled into later prompts and kept on disk in the clear, so it was not saved. Save where the secret lives (the variable or file name) instead of its value.',
+            error: 'Memory content rejected',
+            data: { reason: 'secret', shape },
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=secret-guard.js.map

package/dist/tools/memory/secret-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-guard.js","sourceRoot":"","sources":["../../../src/tools/memory/secret-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAG/D;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAuC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EACL,6RAA6R;YAC9R,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;SACjC,CAAA;IACF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/tools/memory/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/update.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAK/D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAuGxE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/update.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAM/D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CA+GxE"}

package/dist/tools/memory/update.js

@@ -5,6 +5,7 @@ import { hasConditionalMemoryWrites } from '../../types/memory/index.js';
 import { defineTool } from '../defineTool.js';
 import { memoryFieldsSchema } from './fields.js';
 import { resolveMemoryReference } from './resolve.js';
+import { refuseSecret } from './secret-guard.js';
 export function buildUpdateMemoryTool(store) {
     return defineTool({
         name: 'update_memory',
@@ -48,6 +49,15 @@ export function buildUpdateMemoryTool(store) {
                     error: 'Conditional memory update unavailable',
                 };
             }
+            const refused = refuseSecret([
+                updates.title,
+                updates.summary,
+                updates.content,
+                updates.description,
+                ...(updates.tags ?? []),
+            ]);
+            if (refused)
+                return refused;
             const reference = await resolveMemoryReference(store, id);
             if (!reference.found) {
                 return {

package/dist/tools/memory/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/tools/memory/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAE5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAExE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACvD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,eAAe;QACrB,WAAW,EACV,geAAge;QACje,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,CAAC,qEAAqE,CAAC;YACjF,QAAQ,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,2EAA2E,CAAC;YACvF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpF,MAAM,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CAAC,2DAA2D,CAAC;YACvE,GAAG,kBAAkB;SACrB,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,2CAA2C;oBACnD,KAAK,EAAE,2BAA2B;iBAClC,CAAA;YACF,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,8DAA8D;oBACtE,KAAK,EAAE,uCAAuC;iBAC9C,CAAA;YACF,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,sBAAsB,EAAE,iFAAiF;oBACjH,KAAK,EAAE,kBAAkB;iBACzB,CAAA;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAA;YAC7B,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,KAAiD,CAAA;YACrD,IAAI,CAAC;gBACJ,IAAI,QAAQ,KAAK,SAAS;oBAAE,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;qBACpE,IAAI,0BAA0B,CAAC,KAAK,CAAC;oBACzC,KAAK,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;;oBAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBAClD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,2BAA2B;wBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACrC,CAAA;gBACF,CAAC;gBACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBACjD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,yBAAyB;wBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;qBAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,UAAU,4DAA4D;oBAC9I,KAAK,EAAE,4BAA4B;oBACnC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;iBAC9D,CAAA;YACF,CAAC;YACD,IAAI,CAAC,KAAK;gBACT,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,EAAE,oBAAoB;oBACxC,KAAK,EAAE,kBAAkB;iBACzB,CAAA;YACF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,mBAAmB,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,IAAI;gBAChH,IAAI,EAAE;oBACL,EAAE,EAAE,QAAQ;oBACZ,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;aACD,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/tools/memory/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAE5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAExE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACvD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,eAAe;QACrB,WAAW,EACV,geAAge;QACje,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,CAAC,qEAAqE,CAAC;YACjF,QAAQ,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,2EAA2E,CAAC;YACvF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YACzF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YACpF,MAAM,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CAAC,2DAA2D,CAAC;YACvE,GAAG,kBAAkB;SACrB,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,2CAA2C;oBACnD,KAAK,EAAE,2BAA2B;iBAClC,CAAA;YACF,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,8DAA8D;oBACtE,KAAK,EAAE,uCAAuC;iBAC9C,CAAA;YACF,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC;gBAC5B,OAAO,CAAC,KAAK;gBACb,OAAO,CAAC,OAAO;gBACf,OAAO,CAAC,OAAO;gBACf,OAAO,CAAC,WAAW;gBACnB,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;aACvB,CAAC,CAAA;YACF,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACzD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,sBAAsB,EAAE,iFAAiF;oBACjH,KAAK,EAAE,kBAAkB;iBACzB,CAAA;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAA;YAC7B,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,KAAiD,CAAA;YACrD,IAAI,CAAC;gBACJ,IAAI,QAAQ,KAAK,SAAS;oBAAE,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;qBACpE,IAAI,0BAA0B,CAAC,KAAK,CAAC;oBACzC,KAAK,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;;oBAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBAClD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,2BAA2B;wBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;qBACrC,CAAA;gBACF,CAAC;gBACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBACjD,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,yBAAyB;wBAChC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;qBAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC5D,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,oCAAoC,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,UAAU,4DAA4D;oBAC9I,KAAK,EAAE,4BAA4B;oBACnC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE;iBAC9D,CAAA;YACF,CAAC;YACD,IAAI,CAAC,KAAK;gBACT,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,EAAE,oBAAoB;oBACxC,KAAK,EAAE,kBAAkB;iBACzB,CAAA;YACF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,mBAAmB,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,IAAI;gBAChH,IAAI,EAAE;oBACL,EAAE,EAAE,QAAQ;oBACZ,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;aACD,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/turn/index.d.ts

@@ -9,7 +9,7 @@ export type { FingerprintExec, WorkspaceFingerprintOptions } from './workspace-f
 export { checkLimitsDetailed, buildLimitConfig } from './LimitChecker.js';
 export type { LimitCheckerState, LimitCheckResult } from './LimitChecker.js';
 export { SESSION_MEMORY_TAG, createMemoryPromoter } from './memory-promoter.js';
-export type { MemoryPromoterOptions } from './memory-promoter.js';
+export type { MemoryPromoterOptions, SessionMemoryCategory } from './memory-promoter.js';
 export { createMemoryRecallStep } from './memory-recall.js';
 export type { MemoryRecallOptions } from './memory-recall.js';
 export { createJsonClaimVerifier } from './json-claim-verifier.js';

package/dist/turn/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/turn/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACtE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7F,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,UAAU,EACV,iBAAiB,GACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EACN,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACpB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAE9F,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAE5E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EACX,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/turn/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACtE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7F,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,UAAU,EACV,iBAAiB,GACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EACN,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACpB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAE9F,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAE5E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC/E,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAClE,YAAY,EACX,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAA"}

package/dist/turn/memory-promoter.d.ts

@@ -5,6 +5,15 @@
  */
 import type { MemoryStore } from '../types/memory/index.js';
 import type { PromoteMemory } from '../types/session/memory-promotion.js';
+/**
+ * The categories that make a turn worth remembering.
+ *
+ * Ordered as they are rendered. `userRequirements` first because it is the
+ * most durable of the five — a constraint the user stated outlives the turn
+ * that heard it, whereas a discovery about a codebase expires when the
+ * codebase moves.
+ */
+declare const KNOWLEDGE: readonly [readonly ["userRequirements", "What the user requires"], readonly ["decisions", "Decisions"], readonly ["discoveries", "Discoveries"], readonly ["failures", "What did not work"], readonly ["environment", "Environment"]];
 /**
  * Tag every record this promoter writes, so a host can find or prune them.
  * Also its `metadata.source`, which keeps the record out of a Markdown
@@ -30,7 +39,17 @@ export interface MemoryPromoterOptions {
      * that costs context every time it is retrieved.
      */
     readonly maxPerCategory?: number;
+    /**
+     * Decide whether one extracted claim may become part of a record. Called
+     * with the candidate's category (`userRequirements`, `decisions`,
+     * `discoveries`, `failures` or `environment`) and the claim text. A claim
+     * it rejects is left out; a record with no claim left is not written.
+     * Defaults to keeping every claim.
+     */
+    readonly acceptClaim?: (category: SessionMemoryCategory, text: string) => boolean;
 }
+/** The claim categories of a {@link SessionMemoryCandidate}. */
+export type SessionMemoryCategory = (typeof KNOWLEDGE)[number][0];
 /**
  * Build a promoter that writes one record per turn that learned something.
  *
@@ -40,4 +59,5 @@ export interface MemoryPromoterOptions {
  * reports it.
  */
 export declare function createMemoryPromoter(options: MemoryPromoterOptions): PromoteMemory;
+export {};
 //# sourceMappingURL=memory-promoter.d.ts.map

package/dist/turn/memory-promoter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-promoter.d.ts","sourceRoot":"","sources":["../../src/turn/memory-promoter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAA0B,MAAM,sCAAsC,CAAA;AAkBjG;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,mBAAwB,CAAA;AAEvD,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAChC;AAgDD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa,CA8ClF"}
+{"version":3,"file":"memory-promoter.d.ts","sourceRoot":"","sources":["../../src/turn/memory-promoter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAA0B,MAAM,sCAAsC,CAAA;AAEjG;;;;;;;GAOG;AACH,QAAA,MAAM,SAAS,uOAMkE,CAAA;AAEjF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,mBAAwB,CAAA;AAEvD,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACjF;AAED,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAqDjE;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa,CA+ClF"}

package/dist/turn/memory-promoter.js

@@ -28,11 +28,13 @@ const KNOWLEDGE = [
  */
 export const SESSION_MEMORY_TAG = SESSION_MEMORY_SOURCE;
 /** Everything the candidate knows, as `[heading, items]`, empties dropped. */
-function knowledge(candidate, cap) {
+function knowledge(candidate, cap, accept) {
     const out = [];
     for (const [key, heading] of KNOWLEDGE) {
         const items = [
-            ...new Set(candidate[key].map((item) => item.trim()).filter(Boolean)),
+            ...new Set(candidate[key]
+                .map((item) => item.trim())
+                .filter((item) => item !== '' && accept(key, item))),
         ];
         if (items.length > 0)
             out.push([heading, items.slice(0, cap)]);
@@ -73,9 +75,10 @@ export function createMemoryPromoter(options) {
     const cap = options.maxPerCategory ?? 20;
     if (!Number.isSafeInteger(cap) || cap < 1)
         throw new Error('maxPerCategory must be a positive integer');
+    const accept = options.acceptClaim ?? (() => true);
     const tags = [SESSION_MEMORY_TAG, ...(options.tags ?? [])];
     return async (candidate) => {
-        const sections = knowledge(candidate, cap);
+        const sections = knowledge(candidate, cap, accept);
         // Nothing learned, nothing written. Not an empty record: a store full
         // of rows describing runs that discovered nothing is a store whose
         // search results are mostly noise, and the model reads that store.

package/dist/turn/memory-promoter.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory-promoter.js","sourceRoot":"","sources":["../../src/turn/memory-promoter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAIjE;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG;IACjB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAC9C,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACjC,CAAC,aAAa,EAAE,aAAa,CAAC;CACkD,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAsBvD,8EAA8E;AAC9E,SAAS,SAAS,CACjB,SAAiC,EACjC,GAAW;IAEX,MAAM,GAAG,GAA6C,EAAE,CAAA;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG;YACb,GAAG,IAAI,GAAG,CAAE,SAAS,CAAC,GAAG,CAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;SAC5F,CAAA;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,QAA2D;IAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrF,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,GAAG,CAAA;AAC5F,CAAC;AAED,SAAS,MAAM,CACd,SAAiC,EACjC,QAA2D;IAE3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,gBAAgB;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACR,iCAAiC,OAAO;aACtC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;aAClF,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAA;IACF,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,SAAS,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IAE1D,OAAO,KAAK,EAAE,SAAiC,EAAiB,EAAE;QACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QAC1C,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,GAAG,oBAAoB,GAAG,MAAM,EAAE,CAAA;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,IACC,MAAM,oBAAoB,CACzB,OAAO,CAAC,KAAK,EACb,IAAI,EACJ,MAAM,EACN,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,CACrD;YAED,OAAM;QAEP,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,QAAQ,SAAS,CAAC,MAAM,EAAE;YAC1D,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;YACpC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,UAAU;YAClB,sEAAsE;YACtE,+DAA+D;YAC/D,2DAA2D;YAC3D,QAAQ,EAAE;gBACT,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,MAAM,EAAE,kBAAkB;gBAC1B,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,YAAY;aAC1B;SACD,CAAC,CAAA;IACH,CAAC,CAAA;AACF,CAAC"}
+{"version":3,"file":"memory-promoter.js","sourceRoot":"","sources":["../../src/turn/memory-promoter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GACf,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAIjE;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG;IACjB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IAC9C,CAAC,WAAW,EAAE,WAAW,CAAC;IAC1B,CAAC,aAAa,EAAE,aAAa,CAAC;IAC9B,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACjC,CAAC,aAAa,EAAE,aAAa,CAAC;CACkD,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAiCvD,8EAA8E;AAC9E,SAAS,SAAS,CACjB,SAAiC,EACjC,GAAW,EACX,MAAkE;IAElE,MAAM,GAAG,GAA6C,EAAE,CAAA;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG;YACb,GAAG,IAAI,GAAG,CACR,SAAS,CAAC,GAAG,CAAuB;iBACnC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CACpD;SACD,CAAA;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,QAA2D;IAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrF,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,GAAG,CAAA;AAC5F,CAAC;AAED,SAAS,MAAM,CACd,SAAiC,EACjC,QAA2D;IAE3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CACxB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,gBAAgB;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CACR,iCAAiC,OAAO;aACtC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;aAClF,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAA;IACF,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,SAAS,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;IAE1D,OAAO,KAAK,EAAE,SAAiC,EAAiB,EAAE;QACjE,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QAClD,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,GAAG,oBAAoB,GAAG,MAAM,EAAE,CAAA;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,IACC,MAAM,oBAAoB,CACzB,OAAO,CAAC,KAAK,EACb,IAAI,EACJ,MAAM,EACN,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,kBAAkB,CACrD;YAED,OAAM;QAEP,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,QAAQ,SAAS,CAAC,MAAM,EAAE;YAC1D,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC;YACpC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,UAAU;YAClB,sEAAsE;YACtE,+DAA+D;YAC/D,2DAA2D;YAC3D,QAAQ,EAAE;gBACT,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,MAAM,EAAE,kBAAkB;gBAC1B,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,YAAY;aAC1B;SACD,CAAC,CAAA;IACH,CAAC,CAAA;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "62.1.0",
+  "version": "62.2.1",
   "description": "Open-source AI kernel for TypeScript: runs an agent the way an operating system runs a process, with an identity and a budget, scheduled tool calls and checkpointed turns.",
   "license": "FSL-1.1-MIT",
   "engines": {

package/src/compaction/consolidation.ts

@@ -37,6 +37,25 @@ export interface ConsolidationMeta {
 
 const MAX_TASK_IN_TITLE = 72
 
+/**
+ * A host's screen over what a consolidation may quote. Without one a
+ * consolidation carries the task, decisions, discoveries and failures
+ * verbatim, which is right for a store the operator reads and wrong for one
+ * that is recalled into later prompts unreviewed.
+ */
+export interface ConsolidationScreen {
+	/**
+	 * The task as it may appear in the title and body, or `undefined` to say
+	 * it is not stated. Absent keeps the task as written.
+	 */
+	readonly task?: (task: string) => string | undefined
+	/** Whether one item may be written down. Absent keeps every item. */
+	readonly keep?: (
+		category: 'decisions' | 'discoveries' | 'failures' | 'files',
+		text: string,
+	) => boolean
+}
+
 function head(text: string, max: number): string {
 	const line = text.split('\n')[0]?.trim() ?? ''
 	return line.length <= max ? line : `${line.slice(0, max - 1)}…`
@@ -72,16 +91,22 @@ export async function isConsolidated(
 export function consolidationEntry(
 	state: WorkingState,
 	meta: ConsolidationMeta,
+	screen?: ConsolidationScreen,
 ): CreateMemoryParams | null {
-	const decisions = state.decisions.filter((d) => d.trim().length > 0)
-	const discoveries = state.discoveries.filter((d) => d.trim().length > 0)
-	const failures = state.failures.filter((f) => f.trim().length > 0)
+	const kept =
+		(category: 'decisions' | 'discoveries' | 'failures' | 'files') =>
+		(item: string): boolean =>
+			item.trim().length > 0 && (screen?.keep?.(category, item) ?? true)
+	const decisions = state.decisions.filter(kept('decisions'))
+	const discoveries = state.discoveries.filter(kept('discoveries'))
+	const failures = state.failures.filter(kept('failures'))
 	if (decisions.length + discoveries.length + failures.length === 0) return null
 
-	const task = state.task.trim()
+	const task = (screen?.task ? (screen.task(state.task.trim()) ?? '') : state.task).trim()
 	const files = [...state.files.values()]
 		.filter((slot) => slot.actions.some((a) => a.type !== 'read'))
 		.map((slot) => slot.path)
+		.filter(kept('files'))
 	const section = (name: string, items: readonly string[]): string[] =>
 		items.length === 0 ? [] : [`## ${name}`, '', ...items.map((item) => `- ${item}`), '']
 	const content = [

package/src/compaction/context-window.ts

@@ -155,6 +155,7 @@ const WINDOWS: ReadonlyArray<readonly [prefix: string, tokens: number]> = [
 	['claude-mythos', 1_000_000],
 	['claude-opus-5', 1_000_000],
 	['claude-sonnet-5', 1_000_000],
+	['claude-haiku-5', 1_000_000],
 	['claude-opus-4-8', 1_000_000],
 	['claude-opus-4-7', 1_000_000],
 	['claude-opus-4-6', 1_000_000],

package/src/compaction/index.ts

@@ -109,4 +109,5 @@ export { DEFAULT_SOFT_TARGET, planSalienceWorkingSet } from './plan.js'
 
 // Episodic → semantic: what a turn learned, as the entry a later turn searches.
 export { CONSOLIDATION_TAG, consolidationEntry, isConsolidated } from './consolidation.js'
+export type { ConsolidationScreen } from './consolidation.js'
 export type { ConsolidationMeta } from './consolidation.js'

package/src/pricing/catalogue.generated.ts

@@ -5,7 +5,7 @@
 // CI re-runs the generator and fails on any difference, so a hand edit here is
 // reverted by the next run at best and reported as drift at worst.
 //
-// 4 vendors, 35 priced models.
+// 4 vendors, 40 priced models.
 
 import type { ModelPricing } from '../utils/cost.js'
 
@@ -43,6 +43,14 @@ export const VENDOR_RATES: readonly VendorRates[] = [
 					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.25, writeCostPer1M: 12.5 },
 				},
 			],
+			[
+				'claude-fable-5-2',
+				{
+					inputCostPer1M: 8,
+					outputCostPer1M: 40,
+					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.2, writeCostPer1M: 10 },
+				},
+			],
 			[
 				'claude-haiku-4-5',
 				{
@@ -67,6 +75,22 @@ export const VENDOR_RATES: readonly VendorRates[] = [
 					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.25, writeCostPer1M: 12.5 },
 				},
 			],
+			[
+				'claude-mythos-5-2',
+				{
+					inputCostPer1M: 8,
+					outputCostPer1M: 40,
+					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.2, writeCostPer1M: 10 },
+				},
+			],
+			[
+				'claude-opus-4',
+				{
+					inputCostPer1M: 15,
+					outputCostPer1M: 75,
+					cache: { promptIncludesCacheReads: false, readCostPer1M: 1.5, writeCostPer1M: 18.75 },
+				},
+			],
 			[
 				'claude-opus-4-1',
 				{
@@ -115,6 +139,14 @@ export const VENDOR_RATES: readonly VendorRates[] = [
 					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.2, writeCostPer1M: 5 },
 				},
 			],
+			[
+				'claude-sonnet-4',
+				{
+					inputCostPer1M: 3,
+					outputCostPer1M: 15,
+					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.3, writeCostPer1M: 3.75 },
+				},
+			],
 			[
 				'claude-sonnet-4-5',
 				{
@@ -139,6 +171,14 @@ export const VENDOR_RATES: readonly VendorRates[] = [
 					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.2, writeCostPer1M: 2.5 },
 				},
 			],
+			[
+				'claude-sonnet-5-5',
+				{
+					inputCostPer1M: 2,
+					outputCostPer1M: 10,
+					cache: { promptIncludesCacheReads: false, readCostPer1M: 0.1, writeCostPer1M: 2.5 },
+				},
+			],
 		]),
 	},
 	{

package/src/pricing/rates.source.json

@@ -56,11 +56,25 @@
 		{
 			"providerId": "anthropic",
 			"unmetered": false,
-			"verified": "2026-09-24",
+			"verified": "2026-11-10",
 			"promptIncludesCacheReads": false,
 			"reportsCacheWrites": true,
-			"note": "The last two rows exist because the driver's own offline catalogue offers those models and this table did not price them — a lookup-key gap that reads as `cost unknown` and is invisible to the generator's own check, which only proves the module matches this file. `providers/anthropic` asserts the two lists agree. Vendor list prices, every row checked against its pricing page on the `verified` date. Cache read is the vendor's published 0.1x of the input rate, except on the three models it prices differently: 0.05x on claude-opus-5-5 and 0.025x on claude-fable-5-1 and claude-mythos-5-1, entered at the published rate rather than derived. Cache write is its published 1.25x for the five-minute entry, which is the default TTL and the one the driver's `cacheControl: { type: 'auto' }` asks for. claude-sonnet-5 launched at an introductory $2/$10 with $3/$15 scheduled from 2026-09-01, and this table recorded the scheduled rate; the vendor has since made $2/$10 the standard price and cancelled the increase. The table has no time dimension, so a future promotional window is still recorded at the list rate and over-reported rather than mis-modelled.",
+			"note": "The last two rows exist because the driver's own offline catalogue offers those models and this table did not price them — a lookup-key gap that reads as `cost unknown` and is invisible to the generator's own check, which only proves the module matches this file. `providers/anthropic` asserts the two lists agree. Vendor list prices, every row checked against its pricing page on the `verified` date. Cache read is the vendor's published 0.1x of the input rate, except on the six models it prices differently: 0.05x on claude-opus-5-5 and claude-sonnet-5-5 and 0.025x on claude-fable-5-1, claude-mythos-5-1, claude-fable-5-2 and claude-mythos-5-2, entered at the published rate rather than derived. claude-haiku-5-5 has no row on purpose: the vendor prices it by prompt length ($0.10 in / $0.50 out up to 100,000 prompt tokens, $0.50 / $2.50 above, cache counted in the length), this table holds one rate per model, and either single rate would be wrong for the other half of requests, so its cost reports unknown. Cache write is its published 1.25x for the five-minute entry, which is the default TTL and the one the driver's `cacheControl: { type: 'auto' }` asks for. claude-sonnet-5 launched at an introductory $2/$10 with $3/$15 scheduled from 2026-09-01, and this table recorded the scheduled rate; the vendor has since made $2/$10 the standard price and cancelled the increase. The table has no time dimension, so a future promotional window is still recorded at the list rate and over-reported rather than mis-modelled.",
 			"models": [
+				{
+					"id": "claude-fable-5-2",
+					"inputPer1M": 8,
+					"outputPer1M": 40,
+					"cacheReadPer1M": 0.2,
+					"cacheWritePer1M": 10
+				},
+				{
+					"id": "claude-mythos-5-2",
+					"inputPer1M": 8,
+					"outputPer1M": 40,
+					"cacheReadPer1M": 0.2,
+					"cacheWritePer1M": 10
+				},
 				{
 					"id": "claude-fable-5-1",
 					"inputPer1M": 10,
@@ -82,6 +96,13 @@
 					"cacheReadPer1M": 0.2,
 					"cacheWritePer1M": 5
 				},
+				{
+					"id": "claude-sonnet-5-5",
+					"inputPer1M": 2,
+					"outputPer1M": 10,
+					"cacheReadPer1M": 0.1,
+					"cacheWritePer1M": 2.5
+				},
 				{
 					"id": "claude-fable-5",
 					"inputPer1M": 10,
@@ -145,6 +166,13 @@
 					"cacheReadPer1M": 0.1,
 					"cacheWritePer1M": 1.25
 				},
+				{
+					"id": "claude-sonnet-4",
+					"inputPer1M": 3,
+					"outputPer1M": 15,
+					"cacheReadPer1M": 0.3,
+					"cacheWritePer1M": 3.75
+				},
 				{
 					"id": "claude-sonnet-4-5",
 					"inputPer1M": 3,
@@ -152,6 +180,13 @@
 					"cacheReadPer1M": 0.3,
 					"cacheWritePer1M": 3.75
 				},
+				{
+					"id": "claude-opus-4",
+					"inputPer1M": 15,
+					"outputPer1M": 75,
+					"cacheReadPer1M": 1.5,
+					"cacheWritePer1M": 18.75
+				},
 				{
 					"id": "claude-opus-4-1",
 					"inputPer1M": 15,

package/src/public-runtime.ts

@@ -477,7 +477,7 @@ export type {
 // the model reads this store, so noise here is context spent on a turn that
 // did nothing.
 export { SESSION_MEMORY_TAG, createMemoryPromoter } from './turn/index.js'
-export type { MemoryPromoterOptions } from './turn/index.js'
+export type { MemoryPromoterOptions, SessionMemoryCategory } from './turn/index.js'
 export { createMemoryRecallStep } from './turn/memory-recall.js'
 export type { MemoryRecallOptions } from './turn/memory-recall.js'
 export {
@@ -592,6 +592,7 @@ export {
 	memoryIndexLine,
 	memoryLinkNames,
 	memoryOrigin,
+	findSecretShape,
 	renderMemoryIndex,
 	slugifyMemoryName,
 } from './store/index.js'
@@ -1336,6 +1337,7 @@ export {
 	consolidationEntry,
 	isConsolidated,
 } from './compaction/consolidation.js'
+export type { ConsolidationScreen } from './compaction/consolidation.js'
 // The sibling state-bearing system message. A host that carries a turn's
 // conversation into a fresh query must distinguish this ledger from the fresh
 // identity/environment prompt floor without copying its private header string.

package/src/public-types.ts

@@ -216,6 +216,8 @@ export type {
 	Identifiable,
 	MarkdownMemoryStoreConfig,
 	MemoryContentRejection,
+	SecretScanOptions,
+	SecretShape,
 	MemoryImportOutcome,
 	RenderedMemoryIndex,
 	MemoryOrigin,

package/src/runtime/query/finalize-turn.ts

@@ -177,11 +177,15 @@ export async function* finalizeTurn(
 	}
 
 	if (params.consolidateInto && workingStateManager) {
-		const entry = consolidationEntry(workingStateManager.getState(), {
-			sessionId: ctx.sessionId,
-			turnId: ctx.turnId,
-			at: Date.now(),
-		})
+		const entry = consolidationEntry(
+			workingStateManager.getState(),
+			{
+				sessionId: ctx.sessionId,
+				turnId: ctx.turnId,
+				at: Date.now(),
+			},
+			params.consolidationScreen,
+		)
 		if (entry) {
 			try {
 				// Same knowledge, same record: a later turn that learned what an