@openviking/dsh-memory-plugin 0.5.24 → 0.5.26

package/config.mjs

@@ -1,7 +1,7 @@
 import { buildPluginConfig } from "./shared/plugin-config.mjs";
 import { loadCredentialFiles } from "./shared/credentials.mjs";
 
-export const PLUGIN_VERSION = "0.5.24";
+export const PLUGIN_VERSION = "0.5.26";
 
 /**
  * Namespace for the bridged OpenViking MCP tools. DSH publishes every MCP tool

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openviking/dsh-memory-plugin",
-  "version": "0.5.24",
+  "version": "0.5.26",
   "description": "OpenViking memory and context bundle for DeepSeek Harness",
   "icon": "./icon.svg",
   "type": "module",

package/runtime.mjs

@@ -179,22 +179,27 @@ export class OpenVikingRuntime {
   }
 
   maybeCommit(session, event) {
-    if (event.type !== "turn/end") return;
+    // DSH appends compaction/start before it summarizes and rewrites history,
+    // so commit there regardless of the threshold, like PreCompact elsewhere.
+    const boundary = event.type === "compaction/start";
+    if (event.type !== "turn/end" && !boundary) return;
     const state = this.stateFor(session);
     if (!isCaptureEnabled(state.config)) return;
     this.enqueueWrite(state, async () => {
       if (state.hasPendingWrites) return;
       if (!state.ready && !(await this.ensureState(state)).ready) return;
-      const metadata = await this.client.getSession(
-        state.ovSessionId,
-        state.config.peerId,
-      );
-      if (Number(metadata?.pending_tokens || 0) < state.config.commitTokenThreshold) return;
+      if (!boundary) {
+        const metadata = await this.client.getSession(
+          state.ovSessionId,
+          state.config.peerId,
+        );
+        if (Number(metadata?.pending_tokens || 0) < state.config.commitTokenThreshold) return;
+      }
       const response = await this.client.commitSession(
         state.ovSessionId,
         state.config.peerId,
       );
-      this.log("commit", {
+      this.log(boundary ? "compaction_commit" : "commit", {
         sessionId: state.ovSessionId,
         ok: response.ok,
         trace_id: response.result?.trace_id || response.traceId,

package/shared/capture-utils.mjs

@@ -362,14 +362,41 @@ export function extractPartsFromPayload(payload, options = {}) {
   return parts;
 }
 
+function substituteValue(value, rules, role) {
+  if (typeof value === "string") {
+    let current = value;
+    for (const rule of rules) {
+      if (rule.op !== "s" || (rule.scope && rule.scope !== role)) continue;
+      current = current.replace(rule.re, rule.replacement);
+    }
+    return current;
+  }
+  if (Array.isArray(value)) return value.map((item) => substituteValue(item, rules, role));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, substituteValue(item, rules, role)]),
+    );
+  }
+  return value;
+}
+
+function substituteToolPart(part, rules, role) {
+  if (part.type !== "tool") return part;
+  const out = { ...part };
+  if (part.tool_input !== undefined) out.tool_input = substituteValue(part.tool_input, rules, role);
+  if (part.tool_output !== undefined) out.tool_output = substituteValue(part.tool_output, rules, role);
+  return out;
+}
+
 /**
  * Prune blank text parts and run `cfg.captureFilters` over the ones that remain.
  *
  * One drop verdict is taken per turn, on the aggregate of its text parts; the
  * individual parts are then rewritten with the substitutions only, so a rule can
- * never both keep and drop the same turn. Tool call/result parts are carried
- * through untouched — filters match conversation text, not tool payloads — but a
- * turn dropped on its text takes its tool parts with it.
+ * never both keep and drop the same turn. Tool call/result parts get the
+ * substitutions too, on their input values and output, so a redaction rule also
+ * covers a secret that reached a command or its output; only text parts decide
+ * the drop verdict, and a turn dropped on its text takes its tool parts with it.
  */
 export function filterCaptureParts(parts, role, cfg = {}) {
   const kept = [];
@@ -389,7 +416,9 @@ export function filterCaptureParts(parts, role, cfg = {}) {
   if (!compiled.rules.length || kept.length === 0) return blank;
 
   const textParts = kept.filter((part) => part.type === "text");
-  if (textParts.length === 0) return blank;
+  if (textParts.length === 0) {
+    return { parts: kept.map((part) => substituteToolPart(part, compiled.rules, role)), dropped: false };
+  }
 
   const verdict = applyInputFilters(textParts.map((part) => part.text).join("\n\n"), compiled.rules, {
     role,
@@ -399,7 +428,7 @@ export function filterCaptureParts(parts, role, cfg = {}) {
   const out = [];
   for (const part of kept) {
     if (part.type !== "text") {
-      out.push(part);
+      out.push(substituteToolPart(part, compiled.rules, role));
       continue;
     }
     const shaped = applyInputFilters(part.text, compiled.rules, { role, substituteOnly: true });
@@ -431,7 +460,7 @@ function faithfulCaptureDecision(text, cfg) {
 /**
  * Shape one host message before an adapter builds its session payload.
  * Sanitize injected context before evaluating keep/drop rules, so text that
- * will not be sent cannot satisfy a keep rule. Tool parts are never filtered.
+ * will not be sent cannot satisfy a keep rule. Tool parts never decide keep or drop.
  */
 export function shapeCapturePayload(payload, role, cfg = {}, { toolNameById = {}, faithful = false } = {}) {
   const options = { toolMaxChars: cfg.captureToolMaxChars, toolNameById };

package/shared/ov-http.mjs

@@ -17,6 +17,8 @@
 // that asks for less than a second gets a second.
 const MIN_TIMEOUT_MS = 1000;
 
+import { parseExtraHeaders } from "./mcp-proxy-config.mjs";
+
 /**
  * The headers every harness puts on every OpenViking request.
  *
@@ -59,6 +61,12 @@ export function createOvHttp(cfg = {}, {
 } = {}) {
   // dsh and pi name this field `endpoint`; every other harness names it `baseUrl`.
   const baseUrl = cfg.baseUrl || cfg.endpoint || "";
+  // A caller that owns its header map passes it in; every other harness gets the
+  // operator's escape hatch from the environment. A deployment behind an
+  // authenticating gateway (Cloudflare Access, oauth2-proxy, mTLS-terminating proxy)
+  // needs the same headers on the turn hooks as on the MCP path, and wiring each
+  // harness by hand is how the header blocks drifted in the first place.
+  const resolvedExtraHeaders = extraHeaders ?? parseExtraHeaders(process.env.OPENVIKING_EXTRA_HEADERS);
   return async function fetchJSON(path, init = {}, options = {}) {
     const timeoutMs = Math.max(MIN_TIMEOUT_MS, Number(options.timeoutMs) || Number(defaultTimeoutMs) || 0);
     const controller = new AbortController();
@@ -72,7 +80,7 @@ export function createOvHttp(cfg = {}, {
         ...buildOvHeaders(cfg, {
           actorPeerId: options.actorPeerId ?? resolveActorPeerId(),
           identityHeaders,
-          extraHeaders,
+          extraHeaders: resolvedExtraHeaders,
         }),
         ...(init.headers || {}),
       };
@@ -81,6 +89,19 @@ export function createOvHttp(cfg = {}, {
         if (!(error instanceof SyntaxError)) throw error;
         return null;
       });
+      const contentType = response.headers.get("content-type") || "";
+      if (body === null && response.ok && contentType && !/json/i.test(contentType)) {
+        // A 2xx that is not JSON is not OpenViking. An authenticating gateway's login
+        // page, a captive portal or a WAF page answers with 200 and HTML; calling that a
+        // success makes a harness believe it is connected while every capture and recall
+        // is quietly dropped.
+        return {
+          ok: false,
+          status: response.status,
+          result: null,
+          error: { message: `non-JSON response (${contentType})` },
+        };
+      }
       if (requireJsonBody && !body) {
         return {
           ok: false,