@remnic/core 9.3.665 → 9.3.667

package/dist/{chunk-JIX3ZL2J.js → chunk-UVUTV7CM.js}

@@ -9,17 +9,17 @@ import {
 import {
   importCapsule
 } from "./chunk-ARV3AUOM.js";
+import {
+  applyTagFilter,
+  normalizeTags,
+  parseTagMatch
+} from "./chunk-BT7NVCML.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
 } from "./chunk-TIJYQXDI.js";
-import {
-  applyTagFilter,
-  normalizeTags,
-  parseTagMatch
-} from "./chunk-BT7NVCML.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -27,7 +27,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-EXXBA5OM.js";
+} from "./chunk-OI4BXFSB.js";
 import {
   clusterByKey,
   combineNamespaces,
@@ -55,19 +55,19 @@ import {
 } from "./chunk-2MXEVL75.js";
 import {
   namespaceCollectionName
-} from "./chunk-DQY7NJ5L.js";
+} from "./chunk-XS2CWEHZ.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
+import {
+  recordMemoryOutcome
+} from "./chunk-EIR5VLIH.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-BMFZLLNI.js";
 import {
   objectiveStateStoreOverrideForNamespace
 } from "./chunk-6HMYUWXR.js";
-import {
-  recordMemoryOutcome
-} from "./chunk-EIR5VLIH.js";
 import {
   buildGraphSnapshot
 } from "./chunk-NE566K4E.js";
@@ -94,10 +94,10 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-KHGE6PMF.js";
+} from "./chunk-WXXLSZHA.js";
 import {
   parseEntityFile
-} from "./chunk-VH6EIKVS.js";
+} from "./chunk-WKMCC4NQ.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
@@ -122,7 +122,7 @@ import {
 import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
-} from "./chunk-SSOMTUCA.js";
+} from "./chunk-WXGTC424.js";
 import {
   canReadNamespace,
   canWriteNamespace,
@@ -135,7 +135,7 @@ import {
 } from "./chunk-2ODBA7MQ.js";
 import {
   AccessAuditAdapter
-} from "./chunk-TVVEYCNW.js";
+} from "./chunk-7K5Q6COX.js";
 import {
   AccessIdempotencyStore,
   hashAccessIdempotencyPayload
@@ -5579,4 +5579,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-JIX3ZL2J.js.map
+//# sourceMappingURL=chunk-UVUTV7CM.js.map

package/dist/{chunk-VH6EIKVS.js → chunk-WKMCC4NQ.js}

@@ -5,6 +5,9 @@ import {
 import {
   isErrnoCode
 } from "./chunk-5UZXUTVO.js";
+import {
+  assertPathInsideRoot
+} from "./chunk-5GPPACXK.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitation,
@@ -50,13 +53,13 @@ import {
 import {
   sanitizeMemoryContent
 } from "./chunk-FVQJYWH7.js";
+import {
+  createVersion
+} from "./chunk-VF4XKTX3.js";
 import {
   isConsolidationOperator,
   isValidDerivedFromEntry
 } from "./chunk-G7D6GZ5J.js";
-import {
-  createVersion
-} from "./chunk-VF4XKTX3.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
@@ -84,7 +87,7 @@ import {
 } from "./chunk-VS2IYZRU.js";
 
 // src/storage.ts
-import { access, readdir, readFile, stat, writeFile, mkdir, unlink, appendFile, open } from "fs/promises";
+import { access, lstat, readdir, readFile, realpath, stat, writeFile, mkdir, unlink, appendFile, open } from "fs/promises";
 import { appendFileSync, createReadStream, mkdirSync, readFileSync, statSync } from "fs";
 import { createHash } from "crypto";
 import path from "path";
@@ -3122,22 +3125,38 @@ ${sanitized.text}
   }
   async collectActiveMemoryPaths() {
     const filePaths = [];
+    let memoryRootReal;
+    try {
+      memoryRootReal = await realpath(this.baseDir);
+    } catch {
+      return filePaths;
+    }
     const collectPaths = async (dir) => {
+      let entries;
       try {
-        const entries = await readdir(dir, { withFileTypes: true });
-        const subdirs = [];
-        for (const entry of entries) {
-          const fullPath = path.join(dir, entry.name);
-          if (entry.isDirectory()) {
-            subdirs.push(fullPath);
-          } else if (entry.name.endsWith(".md")) {
+        const dirStat = await lstat(dir);
+        if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return;
+        assertPathInsideRoot(memoryRootReal, await realpath(dir), dir);
+        entries = await readdir(dir, { withFileTypes: true });
+      } catch {
+        return;
+      }
+      const subdirs = [];
+      for (const entry of entries) {
+        if (entry.isSymbolicLink()) continue;
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          subdirs.push(fullPath);
+        } else if (entry.name.endsWith(".md")) {
+          try {
+            assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);
             filePaths.push(fullPath);
+          } catch {
           }
         }
-        for (const subdir of subdirs) {
-          await collectPaths(subdir);
-        }
-      } catch {
+      }
+      for (const subdir of subdirs) {
+        await collectPaths(subdir);
       }
     };
     for (const dir of RECALL_FALLBACK_DIRS) {
@@ -5561,4 +5580,4 @@ export {
   serializeEntityFile,
   StorageManager
 };
-//# sourceMappingURL=chunk-VH6EIKVS.js.map
+//# sourceMappingURL=chunk-WKMCC4NQ.js.map