@nanhara/hara 0.130.1 → 0.131.0

package/dist/index.js

@@ -29,7 +29,8 @@ import { routingProvider } from "./agent/route.js";
 import { shouldAutoCompact, shouldAutoCompactTokens, AUTO_COMPACT_TOKEN_CAP, COMPACT_SYSTEM, buildFileRestore, compactedConversationHistory, compactedHistoryTokenEstimate, compactionSourceHistory, normalizeCompactionSummary, recentHistoryForCompaction, workingSetFromSummary, } from "./agent/compact.js";
 import { recentTouched, clearTouched } from "./agent/touched.js";
 import { INTERJECT_PREFIX, disposeReminderScope } from "./agent/reminders.js";
-import { checkForUpdate } from "./update-check.js";
+import { checkForUpdate, fetchLatestVersion, isNewer } from "./update-check.js";
+import { inspectInstallation, installationLabel, manualUpdateInstruction, upgradeNpmInstallation, } from "./update-install.js";
 import { formatContextReport } from "./agent/context-report.js";
 import { userTurnPreviews, rewindTo } from "./agent/rewind.js";
 import { checkpoint, listCheckpoints, restoreCheckpoint } from "./checkpoints.js";
@@ -71,7 +72,7 @@ function renderBgJobs() {
 }
 import { qwenDeviceLogin, loadQwenToken } from "./providers/qwen-oauth.js";
 import { loadAgentContext, hasAgentsMd, INIT_PROMPT, findProjectRoot } from "./context/agents-md.js";
-import { homeWorkspaceActionError, isUnsafeProjectWorkspace, resolveWorkspaceSwitch, suggestedProjectWorkspace, } from "./context/workspace-scope.js";
+import { homeWorkspaceActionError, discoverProjectWorkspaces, isUnsafeProjectWorkspace, resolveWorkspaceSwitch, suggestedProjectWorkspace, } from "./context/workspace-scope.js";
 import { getEmbedder } from "./search/embed.js";
 import { collectRepoChunksAsync, collectDirChunksAsync, buildIndex, indexPath, indexExists } from "./search/semindex.js";
 import { searchHybrid } from "./search/hybrid.js";
@@ -79,6 +80,7 @@ import { expandMentionsAsync, fileCandidates, isSlashCommand, inlineLeadingPath
 import { newSessionId, shortId, resolveSessionId, validSessionId, sessionFileExists, saveSession, loadSession, acquireSessionLock, releaseSessionLock, listSessions, latestForCwd, titleFrom, sessionSourceFromEnv, automatedTitle, slugify, } from "./session/store.js";
 import { consumePendingTaskSteering, continueTaskExecution, createTaskExecution, finishTaskExecution, formatTaskExecution, hasPendingTaskSteering, newSteerInteraction, newTurnInteraction, recordTaskSteering, recoverTaskExecution, routeTaskInteraction, requestsTaskContinuation, taskExecutionContext, } from "./session/task.js";
 import { displaySessionCwd, resolveSessionResumeTarget } from "./session/resume.js";
+import { persistWorkspaceSessionFork, recentWorkspaceTransferCandidate, } from "./session/transfer.js";
 import { setSessionForceModel, isSessionForceModel, effectiveRoleModel } from "./session/session-model.js";
 import { createPhysicalOperationDrain } from "./session/operation-drain.js";
 import { loadGlobalRoles, loadRoles, roleToolFilter, scaffoldRoles, subagentToolFilter } from "./org/roles.js";
@@ -102,6 +104,7 @@ import "./tools/patch.js"; // register apply_patch
 import "./tools/web.js"; // register web_fetch
 import "./tools/agent.js"; // register agent (subagent spawn)
 import "./tools/memory.js"; // register memory_search/get/write/forget/skill_create
+import "./tools/session-search.js"; // register bounded cross-session transcript recall
 import "./tools/skill.js"; // register the skill loader tool
 import "./tools/codebase.js"; // register codebase_search (repo as a knowledge base)
 import "./tools/todo.js"; // register todo_write (inline task checklist)
@@ -1185,6 +1188,62 @@ function roleMeta(role) {
         ...(role.compatibilityWarnings ?? []),
     ].filter(Boolean).join(" · ");
 }
+const packageRoot = resolve(here, "..");
+function activeInstallation() {
+    return inspectInstallation(packageRoot, { buildVersion: process.env.HARA_BUILD_VERSION });
+}
+function shadowInstallLines(installation) {
+    if (!installation.shadowCommands.length)
+        return [];
+    return [
+        c.yellow(`⚠ ${installation.shadowCommands.length} other Hara command(s) are visible in PATH; switching Node or PATH can activate an older copy:`),
+        ...installation.shadowCommands.map((path) => `  ${c.dim(path)}`),
+    ];
+}
+async function runUpdateCommand(checkOnly) {
+    const installation = activeInstallation();
+    out(`${c.bold("hara update")}\n`);
+    out(`  current ${c.bold(pkg.version)} · ${c.bold(installationLabel(installation))} · ${c.dim(installation.launchPath)}\n`);
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+        process.stderr.write("hara: could not reach the npm registry; no installation was changed.\n");
+        process.exitCode = 1;
+        return;
+    }
+    out(`  latest  ${c.bold(latest)}\n`);
+    for (const line of shadowInstallLines(installation))
+        out(line + "\n");
+    if (!isNewer(latest, pkg.version)) {
+        out(c.green(`✓ the active ${installationLabel(installation)} is up to date\n`));
+        if (installation.shadowCommands.length) {
+            out(c.yellow("  The PATH copies above are separate installations; this check did not execute or modify them.\n"));
+        }
+        return;
+    }
+    if (checkOnly) {
+        out(`  next    ${installation.kind === "npm" ? "run `hara update` without --check" : manualUpdateInstruction(installation)}\n`);
+        return;
+    }
+    if (installation.kind !== "npm") {
+        out(c.yellow("This installation cannot be replaced through npm.\n"));
+        out(`  ${manualUpdateInstruction(installation)}\n`);
+        process.exitCode = 2;
+        return;
+    }
+    try {
+        const result = upgradeNpmInstallation(installation, latest);
+        out(c.green(`✓ upgraded and verified ${result.packageRoot} at ${result.version}\n`));
+        out("  Restart Hara, then confirm with: hara --version\n");
+        if (installation.shadowCommands.length) {
+            out(c.yellow("  Only the active npm prefix was upgraded; the PATH copies listed above remain independent.\n"));
+        }
+    }
+    catch (error) {
+        process.stderr.write(`hara: update failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.stderr.write("No other Hara installation was modified. Run `hara doctor` to inspect active and shadow commands.\n");
+        process.exitCode = 1;
+    }
+}
 function runDoctor(cfg) {
     const ok = (b) => (b ? c.green("✓") : c.red("✗"));
     const dot = c.dim("·");
@@ -1197,9 +1256,12 @@ function runDoctor(cfg) {
     const roles = loadRoles(cfg.cwd);
     const vcap = classifyVision(cfg.provider, cfg.model, cfg.modelVision);
     const vdesc = vcap === "vision" ? c.dim("sees images (inline)") : vcap === "text" ? c.dim("text-only") : c.yellow("capability unknown — asks on first image");
+    const installation = activeInstallation();
     const lines = [
         c.bold("hara doctor"),
         `${ok(nodeSupported)} node ${process.versions.node} ${c.dim(`(need ≥${MIN_NODE_VERSION})`)}`,
+        `${dot} install ${c.bold(installationLabel(installation))} · ${c.dim(installation.launchPath)}`,
+        ...shadowInstallLines(installation),
         `${dot} provider ${c.bold(cfg.provider)} · model ${c.bold(cfg.model)}${cfg.baseURL ? c.dim(" · " + cfg.baseURL) : ""}`,
         `${ok(authed)} auth ${providerIsLocal(cfg.provider) ? c.dim("not required (local endpoint)") : authed ? c.dim("configured") : c.yellow("missing — " + authHint(cfg))}`,
         `${ok(existsSync(configPath()))} config ${c.dim(configPath())}`,
@@ -1236,6 +1298,16 @@ function helpText(commands) {
     const lines = commands.map((cmd) => `  /${cmd.name.padEnd(13)} ${c.dim(cmd.desc)}`);
     return c.bold("Commands:\n") + lines.join("\n") + "\n" + c.dim("  @path          attach a file's contents (Tab to complete)\n");
 }
+// Commander applies --cwd in a preAction hook. Retain the shell's launch directory so an interactive
+// cross-workspace launch can offer to carry a very recent conversation instead of silently starting blank.
+const invocationCwd = (() => {
+    try {
+        return realpathSync.native(process.cwd());
+    }
+    catch {
+        return resolve(process.cwd());
+    }
+})();
 const program = new Command();
 program
     .name("hara")
@@ -1596,8 +1668,14 @@ program
 });
 program
     .command("doctor")
-    .description("check your hara setup (provider / auth / model / node / assets / roles)")
+    .description("check your hara setup (install / provider / auth / model / node / assets / roles)")
     .action(() => out(runDoctor(loadConfig()) + "\n"));
+program
+    .command("update")
+    .alias("upgrade")
+    .description("update the active Hara installation and verify the resulting version")
+    .option("--check", "check the latest version and installation source without changing anything")
+    .action(async (opts) => runUpdateCommand(opts.check === true));
 program
     .command("setup")
     .description("interactive first-run setup — pick a provider, API key, and model")
@@ -2997,6 +3075,7 @@ config
     .action(() => out(configPath() + "\n"));
 // default action (interactive REPL / one-shot)
 program.action(async (opts) => {
+    let startupWorkspaceTransferId;
     // Identity-profile selection (--profile flag) is now handled by the program-level preAction
     // hook above — see setFlagOverride() + resolveActive() in profile.ts. activeId() / loadActiveProfile()
     // pick it up automatically. `HARA_PROFILE` env still works as a transient override (one slot lower
@@ -3015,10 +3094,15 @@ program.action(async (opts) => {
             const recent = listSessions()
                 .filter((session) => session.source === undefined || session.source === "interactive")
                 .map((session) => session.cwd);
-            candidate = suggestedProjectWorkspace([
-                ...recent,
-                ...loadProjects().map((project) => project.path),
-            ]);
+            candidate = suggestedProjectWorkspace(recent);
+            if (!candidate) {
+                // Sessions launched from Home contain no usable project signal. Prefer bounded, marker-backed
+                // discovery under conventional project containers; old registrations remain a final fallback.
+                candidate = suggestedProjectWorkspace([
+                    ...discoverProjectWorkspaces(),
+                    ...loadProjects().map((project) => project.path),
+                ]);
+            }
         }
         catch {
             // A damaged optional history/registry must not weaken the Home boundary or block startup.
@@ -3061,6 +3145,59 @@ program.action(async (opts) => {
             }
         }
     }
+    // `hara --cwd …` is often the user's response to the protected-Home guidance. In an interactive
+    // terminal, offer to fork a very recent source-directory thread into the selected workspace. The old
+    // session stays intact, and headless/scripted launches keep their established non-interactive behavior.
+    if (!opts.print
+        && opts.cwd
+        && !opts.resume
+        && !opts.continue
+        && stdin.isTTY
+        && stdout.isTTY) {
+        let candidate = null;
+        try {
+            candidate = recentWorkspaceTransferCandidate(invocationCwd, process.cwd());
+        }
+        catch {
+            // Optional continuity discovery must never make an explicit --cwd unusable.
+        }
+        if (candidate) {
+            const question = `Continue recent session ${shortId(candidate.meta.id)} from ${displaySessionCwd(candidate.meta.cwd)} `
+                + `with its current context in ${displaySessionCwd(process.cwd())}?`;
+            let transfer = false;
+            if (process.env.HARA_TUI !== "0") {
+                transfer = await askConfirm(question);
+            }
+            else {
+                const prompt = createInterface({ input: stdin, output: stdout });
+                try {
+                    const answer = (await prompt.question(c.yellow(question) + c.dim(" [Y/n] "))).trim().toLowerCase();
+                    transfer = answer === "" || answer === "y" || answer === "yes";
+                }
+                finally {
+                    prompt.close();
+                }
+            }
+            if (transfer) {
+                try {
+                    const fork = persistWorkspaceSessionFork(candidate, process.cwd());
+                    startupWorkspaceTransferId = fork.meta.id;
+                    out(c.green(`Continuing ${shortId(candidate.meta.id)} as ${shortId(fork.meta.id)} in ${displaySessionCwd(fork.meta.cwd)}; `
+                        + "the original session remains saved.\n"));
+                }
+                catch (error) {
+                    out(c.red(`Could not carry the recent session into ${displaySessionCwd(process.cwd())}: ${error instanceof Error ? error.message : String(error)}.\n`));
+                    out(c.dim(`The original session ${shortId(candidate.meta.id)} is unchanged; no blank replacement was started.\n`));
+                    process.exitCode = 2;
+                    return;
+                }
+            }
+            else {
+                out(c.dim(`Starting a fresh session in ${displaySessionCwd(process.cwd())}; `
+                    + `the previous session ${shortId(candidate.meta.id)} remains saved.\n`));
+            }
+        }
+    }
     // Resolve addressable headless roles BEFORE loading config/provider/MCP. A qualified project role is
     // an execution-home selection, so every downstream route (credentials, model, AGENTS.md, tools) must be
     // constructed from that home rather than from the shell directory that happened to launch hara.
@@ -3470,6 +3607,7 @@ program.action(async (opts) => {
                 ctx: {
                     cwd,
                     sandbox,
+                    ...(meta ? { sessionId: meta.id } : {}),
                     spawn: (t, role, signal) => runSubagent(cfg, headlessProvider, cwd, sandbox, projectContext, stats, t, role, signal, {
                         onProviderTurn: trackHeadlessOperation,
                         onToolRun: trackHeadlessOperation,
@@ -3646,7 +3784,10 @@ program.action(async (opts) => {
     const spawn = (t, role, signal) => runSubagent(cfg, provider, cwd, sandbox, projectContext, stats, t, role, signal);
     // session: --resume <id> / --continue (latest in this cwd) / new
     let resumeId = null;
-    if (opts.resume) {
+    if (startupWorkspaceTransferId) {
+        resumeId = startupWorkspaceTransferId;
+    }
+    else if (opts.resume) {
         const rid = resolveSessionId(opts.resume); // accept a full UUID or a unique prefix (short id)
         resumeId = rid;
         if (!resumeId)
@@ -3748,6 +3889,20 @@ program.action(async (opts) => {
         : undefined;
     let requestedWorkspaceSwitch = null;
     let requestedSessionSwitch = null;
+    const queueWorkspaceSwitch = (target) => {
+        if (history.length === 0) {
+            requestedWorkspaceSwitch = target;
+            return `(switching workspace → ${target})`;
+        }
+        const fork = persistWorkspaceSessionFork({ meta, history, ...(task ? { task } : {}) }, target);
+        requestedSessionSwitch = {
+            id: fork.meta.id,
+            cwd: fork.meta.cwd,
+            kind: "workspace-transfer",
+            historyCount: history.length,
+        };
+        return `(switching workspace with ${history.length} messages of current context → ${fork.meta.cwd}; original session stays saved)`;
+    };
     const relaunchRequestedTarget = async () => {
         if (!requestedWorkspaceSwitch && !requestedSessionSwitch)
             return;
@@ -3773,9 +3928,11 @@ program.action(async (opts) => {
             args.push("--sandbox", String(opts.sandbox));
         if (sessionSwitch)
             args.push("--resume", sessionSwitch.id);
-        out(c.dim(sessionSwitch
-            ? `Resuming session ${shortId(sessionSwitch.id)} → ${displaySessionCwd(target)}\n`
-            : `Switching workspace → ${target}\n`));
+        out(c.dim(sessionSwitch?.kind === "workspace-transfer"
+            ? `Continuing current context as session ${shortId(sessionSwitch.id)} → ${displaySessionCwd(target)}\n`
+            : sessionSwitch
+                ? `Resuming session ${shortId(sessionSwitch.id)} → ${displaySessionCwd(target)}\n`
+                : `Switching workspace → ${target}\n`));
         try {
             const result = await runSelfAttached(args, target);
             if (result.signal) {
@@ -3843,8 +4000,13 @@ program.action(async (opts) => {
                     return void out(c.red(`(${result.error})\n`));
                 if (result.cwd === realpathSync.native(cwd))
                     return void out(c.dim(`(already in ${result.cwd})\n`));
-                requestedWorkspaceSwitch = result.cwd;
-                return "exit";
+                try {
+                    out(c.dim(queueWorkspaceSwitch(result.cwd) + "\n"));
+                    return "exit";
+                }
+                catch (error) {
+                    return void out(c.red(`(could not switch workspace without losing context: ${error instanceof Error ? error.message : String(error)})\n`));
+                }
             },
         },
         {
@@ -3875,7 +4037,7 @@ program.action(async (opts) => {
                 }
                 if (target.id === sessionId)
                     return void out(c.dim("(this session is already open)\n"));
-                requestedSessionSwitch = { id: target.id, cwd: target.cwd };
+                requestedSessionSwitch = { id: target.id, cwd: target.cwd, kind: "resume" };
                 return "exit";
             },
         },
@@ -4477,9 +4639,13 @@ program.action(async (opts) => {
                             return void h.sink.notice(`(${result.error})`);
                         if (result.cwd === realpathSync.native(cwd))
                             return void h.sink.notice(`(already in ${result.cwd})`);
-                        requestedWorkspaceSwitch = result.cwd;
-                        h.sink.notice(`(switching workspace → ${result.cwd})`);
-                        return void h.exit();
+                        try {
+                            h.sink.notice(queueWorkspaceSwitch(result.cwd));
+                            return void h.exit();
+                        }
+                        catch (error) {
+                            return void h.sink.notice(`(could not switch workspace without losing context: ${error instanceof Error ? error.message : String(error)})`);
+                        }
                     }
                     if (nm === "resume") {
                         if (!arg) {
@@ -4496,7 +4662,7 @@ program.action(async (opts) => {
                         }
                         if (target.id === sessionId)
                             return void h.sink.notice("(this session is already open)");
-                        requestedSessionSwitch = { id: target.id, cwd: target.cwd };
+                        requestedSessionSwitch = { id: target.id, cwd: target.cwd, kind: "resume" };
                         h.sink.notice(`(resuming ${shortId(target.id)} → ${displaySessionCwd(target.cwd)})`);
                         return void h.exit();
                     }
@@ -4821,7 +4987,7 @@ program.action(async (opts) => {
                             const __skApproval = h.approval === "plan" ? "suggest" : h.approval;
                             let skillOutcome;
                             try {
-                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), pendingInput, stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                                skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, sessionId: meta.id, spawn, ui: { text: h.sink.assistantDelta, reasoning: h.sink.reasoningDelta, tool: h.sink.tool, diff: h.sink.diff, notice: h.sink.notice }, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot }, approval: __skApproval, confirm: h.confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), pendingInput, stats, signal: h.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                             }
                             catch (e) {
                                 h.sink.notice(`[error] ${e?.message ?? e}`);
@@ -4902,10 +5068,10 @@ program.action(async (opts) => {
                     };
                     let planOutcome = await runAgent(history, {
                         provider,
-                        ctx: { cwd, sandbox, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
+                        ctx: { cwd, sandbox, sessionId: meta.id, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
                         approval: "suggest",
                         confirm: h.confirm,
-                        toolFilter: (n) => READONLY_TOOLS.has(n),
+                        toolFilter: (n) => READONLY_TOOLS.has(n) || n === "memory_search" || n === "memory_get" || n === "session_search",
                         hooks: false,
                         extraTools: [exitPlanTool],
                         systemOverride: PLAN_SYSTEM,
@@ -4959,7 +5125,7 @@ program.action(async (opts) => {
                         const xout = stats.output;
                         planOutcome = await runAgent(history, {
                             provider,
-                            ctx: { cwd, sandbox, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
+                            ctx: { cwd, sandbox, sessionId: meta.id, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
                             approval: choice,
                             memory: buildMemory(),
                             confirm: h.confirm,
@@ -5004,7 +5170,7 @@ program.action(async (opts) => {
                 const beforeOut = stats.output;
                 const turnOutcome = await runAgent(history, {
                     provider,
-                    ctx: { cwd, sandbox, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
+                    ctx: { cwd, sandbox, sessionId: meta.id, spawn, ui, ask: h.ask, describeImage: describeScreenshot, locate: locateScreenshot },
                     approval: appr,
                     memory: buildMemory(),
                     confirm: h.confirm,
@@ -5102,7 +5268,7 @@ program.action(async (opts) => {
                     currentTurn = skillTurn;
                     let skillOutcome;
                     try {
-                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+                        skillOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, sessionId: meta.id, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext: skillExecutionContext, taskIntake: taskIntakeForRun(), stats, signal: skillTurn.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
                     }
                     catch (e) {
                         out(c.red(`\n[error] ${e.message}\n`));
@@ -5170,7 +5336,7 @@ program.action(async (opts) => {
         const t0 = Date.now();
         let turnOutcome;
         try {
-            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext, taskIntake: taskIntakeForRun(), stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
+            turnOutcome = await runAgent(history, { provider, ctx: { cwd, sandbox, sessionId: meta.id, spawn, ask: askUser }, approval, confirm, autoApprove, projectContext, memory: buildMemory(), continuationSession, executionContext, taskIntake: taskIntakeForRun(), stats, signal: turnController.signal, fallback: fbOpt, guardian: guardianOpt, ...agentRunLimits(cfg) });
         }
         catch (e) {
             out(c.red(`\n[error] ${e.message}\n`));

package/dist/memory/guard.js

@@ -38,6 +38,27 @@ export function redactSecrets(text) {
     }
     return { text: out, redactions };
 }
+/** Safe load boundary for editable/synced legacy memory. Agent writes are checked on capture, but a user,
+ * older Hara version, or sync process can still change Markdown later. Redact secret-shaped values, remove
+ * injection/exfil lines, and fail closed if a cross-line pattern remains after filtering. */
+export function sanitizeMemoryForPrompt(text) {
+    const redacted = redactSecrets(text);
+    if (scanMemory(redacted.text).ok) {
+        return { text: redacted.text, redactions: redacted.redactions, blockedLines: 0, blocked: false };
+    }
+    let blockedLines = 0;
+    const safeLines = redacted.text.split("\n").filter((line) => {
+        if (scanMemory(line).ok)
+            return true;
+        blockedLines += 1;
+        return false;
+    });
+    const safe = safeLines.join("\n");
+    if (!scanMemory(safe).ok) {
+        return { text: "", redactions: redacted.redactions, blockedLines, blocked: true };
+    }
+    return { text: safe, redactions: redacted.redactions, blockedLines, blocked: blockedLines > 0 };
+}
 /** Deterministically generalize local identifiers so a captured snippet isn't tied to this machine:
  *  the project path → <project>, the home dir → ~, and email addresses → <email>. Light + reversible. */
 export function scrubLocal(text, cwd) {

package/dist/memory/store.js

@@ -7,6 +7,7 @@ import { existsSync, readdirSync } from "node:fs";
 import { findProjectRoot } from "../context/agents-md.js";
 import { readModelContextFileSync, readVerifiedRegularFileSnapshot } from "../fs-read.js";
 import { atomicWriteText, bindAtomicWritePath } from "../fs-write.js";
+import { sanitizeMemoryForPrompt } from "./guard.js";
 // Per-source budgets for the frozen-snapshot digest (chars). Each source gets its own cap so a large
 // project MEMORY can't crowd out the (smaller but high-value) USER prefs — and each is cut at a line
 // boundary, never mid-entry. Anything beyond these is still reachable via memory_search. (hermes-style
@@ -78,6 +79,35 @@ export async function appendMemory(scope, target, content, cwd, signal) {
     });
     return f;
 }
+function comparableEntry(value) {
+    return value
+        .normalize("NFKC")
+        .toLocaleLowerCase()
+        .replace(/^\s*[-*]\s+/, "")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/** Append one durable fact/preference only when an equivalent line is not already present. The duplicate
+ * decision and write share the same verified snapshot/CAS boundary, so proactive curation cannot keep
+ * piling up an identical memory on every session exit. */
+export async function appendMemoryOnce(scope, target, content, cwd, signal) {
+    const f = targetFile(scope, target, cwd);
+    const { boundary, snapshot } = await inspectMemoryWrite(f, "append memory");
+    const wanted = comparableEntry(content);
+    const exists = snapshot?.text
+        .split("\n")
+        .some((line) => comparableEntry(line) === wanted);
+    if (wanted && exists)
+        return { path: f, appended: false };
+    const text = (snapshot ? `${snapshot.text}\n` : "") + content.trim() + "\n";
+    await atomicWriteText(boundary.target, text, {
+        expected: snapshot?.text ?? null,
+        expectedIdentity: snapshot ?? undefined,
+        boundary,
+        signal,
+    });
+    return { path: f, appended: true };
+}
 export async function replaceMemory(scope, target, content, cwd, signal) {
     const f = targetFile(scope, target, cwd);
     await commitMemoryText(f, content.trim() + "\n", "replace memory", signal);
@@ -109,6 +139,7 @@ export async function forgetMemory(scope, target, match, cwd, signal) {
 export function memoryDigest(cwd) {
     const sources = [
         ["project", "memory", "project MEMORY"],
+        ["project", "user", "project USER preferences"],
         ["global", "memory", "global MEMORY"],
         ["global", "user", "USER preferences"],
     ];
@@ -118,7 +149,7 @@ export function memoryDigest(cwd) {
         if (!existsSync(f))
             continue;
         try {
-            const t = readModelContextFileSync(f, MAX_MEMORY_SOURCE_BYTES).trim();
+            const t = sanitizeMemoryForPrompt(readModelContextFileSync(f, MAX_MEMORY_SOURCE_BYTES)).text.trim();
             if (t)
                 parts.push(`## ${label}\n${capAtLine(t, SOURCE_CAP[target])}`);
         }
@@ -143,7 +174,7 @@ export function readRecentLogs(scope, cwd, days) {
         if (m && new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3])).getTime() < cutoff)
             continue;
         try {
-            const t = readModelContextFileSync(join(dir, f), MAX_MEMORY_SOURCE_BYTES).trim();
+            const t = sanitizeMemoryForPrompt(readModelContextFileSync(join(dir, f), MAX_MEMORY_SOURCE_BYTES)).text.trim();
             if (t)
                 out.push(`### ${f}\n${t}`);
         }

package/dist/providers/openai.js

@@ -60,9 +60,15 @@ export function toOpenAI(system, history) {
                 type: "function",
                 function: { name: tu.name, arguments: JSON.stringify(tu.input ?? {}) },
             }));
+            // Some OpenAI-compatible providers (observed with DeepSeek) reject a historical assistant
+            // message whose content is null unless it also contains tool_calls. Empty model turns can exist in
+            // older persisted sessions, so omit that no-op history entry instead of serializing an invalid row.
+            // Keep content:null for real tool-call turns: that is the canonical Chat Completions shape.
+            if (!m.text.trim() && tool_calls.length === 0)
+                continue;
             msgs.push({
                 role: "assistant",
-                content: m.text || null,
+                content: m.text.trim() ? m.text : null,
                 ...(tool_calls.length ? { tool_calls } : {}),
             });
         }