@remnic/core 9.33.0 → 9.35.0

package/dist/tool-scoped-memory.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Tool-scoped memory guard (issue #2183).
+ *
+ * A tool-related fact extracted from a specific agent integration carries an
+ * UNQUALIFIED tool name — "use the search tool" — with no agent identity
+ * attached (the conversation handed to the extraction LLM is rendered as
+ * `[role] content` only). Promoting such a fact to the shared namespace lets a
+ * DIFFERENT integration that exposes a same-named but incompatible tool (Pi
+ * `search` = repo code search vs OpenClaw `search` = web search) consume it.
+ *
+ * `referencesAgentSpecificTool` flags fact text that references a specific
+ * tool/command invocation rather than portable knowledge. The promotion guard
+ * in `orchestration/extraction-persist.ts` uses it — when the producing
+ * integration is known (`sourceConnector`) — to keep such a fact in that
+ * integration's own namespace.
+ *
+ * Tuning bias: a FALSE POSITIVE is cheap — the fact stays in the narrower
+ * namespace, the documented safe default. A FALSE NEGATIVE is the actual
+ * cross-integration collision bug, so detection leans permissive — but it must
+ * not fire on ordinary prose.
+ */
+declare function referencesAgentSpecificTool(content: string): boolean;
+interface ToolScopeWithholdInputs {
+    content: string;
+    sourceConnector?: string;
+    procedureSteps?: ReadonlyArray<{
+        intent?: string;
+        expectedOutcome?: string;
+        toolCall?: {
+            kind?: string;
+        };
+    }>;
+}
+declare function withholdToolScopedFromSharedNamespace({ content, sourceConnector, procedureSteps, }: ToolScopeWithholdInputs): boolean;
+interface GlobalFactPromotionInputs {
+    scope: string | null | undefined;
+    content: string;
+    sourceConnector?: string;
+    procedureSteps?: ReadonlyArray<{
+        toolCall?: {
+            kind?: string;
+        };
+    }>;
+}
+declare function shouldPromoteGlobalFactToShared(inputs: GlobalFactPromotionInputs): boolean;
+
+export { type GlobalFactPromotionInputs, type ToolScopeWithholdInputs, referencesAgentSpecificTool, shouldPromoteGlobalFactToShared, withholdToolScopedFromSharedNamespace };

package/dist/tool-scoped-memory.js

@@ -0,0 +1,12 @@
+import {
+  referencesAgentSpecificTool,
+  shouldPromoteGlobalFactToShared,
+  withholdToolScopedFromSharedNamespace
+} from "./chunk-KWMXR7XS.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  referencesAgentSpecificTool,
+  shouldPromoteGlobalFactToShared,
+  withholdToolScopedFromSharedNamespace
+};
+//# sourceMappingURL=tool-scoped-memory.js.map

package/dist/tool-scoped-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/transfer/backup.js

@@ -1,8 +1,8 @@
 import {
   backupMemoryDir
-} from "../chunk-BXLOS5AJ.js";
+} from "../chunk-2NLLXCJG.js";
 import "../chunk-765K3SAT.js";
-import "../chunk-DQEMWVMT.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-J4EB7DNW.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";

package/dist/transfer/capsule-export.js

@@ -1,9 +1,9 @@
 import {
   exportCapsule,
   isValidCapsuleSince
-} from "../chunk-VDX2J7OX.js";
+} from "../chunk-KQAFEZQX.js";
 import "../chunk-WEHSQBFR.js";
-import "../chunk-DQEMWVMT.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-J4EB7DNW.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";

package/dist/transfer/capsule-import.js

@@ -1,13 +1,13 @@
 import {
   importCapsule
-} from "../chunk-6NPZ3FP2.js";
+} from "../chunk-65ZPVYTA.js";
 import "../chunk-6TAUHL33.js";
 import "../chunk-IJ7HK452.js";
 import "../chunk-PDJTHRAW.js";
 import "../chunk-XMMESCPD.js";
 import "../chunk-42JKGUFJ.js";
 import "../chunk-WEHSQBFR.js";
-import "../chunk-DQEMWVMT.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";
 import "../chunk-FP2373TW.js";

package/dist/transfer/import-sqlite.js

@@ -1,8 +1,8 @@
 import {
   importSqlite
-} from "../chunk-PYHOAXTI.js";
-import "../chunk-Z734BLO3.js";
+} from "../chunk-LRGSLV7M.js";
 import "../chunk-G4IAEX6D.js";
+import "../chunk-Z734BLO3.js";
 import "../chunk-RL6NEVXT.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.33.0",
+  "version": "9.35.0",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -156,6 +156,16 @@
       "remnic-source": "./src/adapters/claude-code.ts",
       "import": "./dist/adapters/claude-code.js"
     },
+    "./reconcile/plan": {
+      "types": "./dist/reconcile/plan.d.ts",
+      "remnic-source": "./src/reconcile/plan.ts",
+      "import": "./dist/reconcile/plan.js"
+    },
+    "./reconcile/plan.js": {
+      "types": "./dist/reconcile/plan.d.ts",
+      "remnic-source": "./src/reconcile/plan.ts",
+      "import": "./dist/reconcile/plan.js"
+    },
     "./adapters/codex": {
       "types": "./dist/adapters/codex.d.ts",
       "remnic-source": "./src/adapters/codex.ts",
@@ -3076,7 +3086,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.33.0"
+    "@remnic/coding-graph": "^9.35.0"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/extraction-redaction-rules.test.ts

@@ -20,6 +20,7 @@ import {
   type CompiledRedactionRule,
 } from "./extraction-redaction-rules.js";
 import { validateRedactionPattern } from "./correction/correction-contract.js";
+import { shouldPromoteGlobalFactToShared } from "./tool-scoped-memory.js";
 
 const withTempDir = <T>(fn: (dir: string) => Promise<T>): Promise<T> =>
   managedWithTempDir(fn, "remnic-redact-");
@@ -378,3 +379,55 @@ test("#1713 (codex): non-global fact is NOT scope-routed to shared", async () =>
     });
   });
 });
+test("#2183: pre-judge consults the SESSION namespace rules for a tool-scoped global fact (not shared)", async () => {
+  // The pre-judge namespace prediction and the write-loop scope-routing block
+  // share shouldPromoteGlobalFactToShared, so a tool-scoped global fact from a
+  // known integration is predicted to stay in the session namespace: its
+  // redaction is evaluated against the SESSION rules, not the shared ones. A
+  // portable global fact is still predicted shared and consults shared rules.
+  // This is the read/write namespace-invariant coupling the guard preserves.
+  await withTempDir(async (sourceDir) => {
+    await withTempDir(async (sharedDir) => {
+      await writeRule(sourceDir, "session-only-secret");
+      await writeRule(sharedDir, "shared-only-secret");
+
+      const sourceNamespace: string = "default";
+      const sharedNamespace: string = "shared";
+      const sourceConnector = "pi";
+
+      // Mirror the pre-judge pass: predicted target namespace = shared ONLY
+      // when shouldPromoteGlobalFactToShared says so; load that namespace's
+      // rules and combine with the base (source) rules.
+      async function consultedRulesFor(fact: { scope: string; content: string }): Promise<CompiledRedactionRule[]> {
+        const baseRules = await loadRedactionRules(sourceDir);
+        const promote = shouldPromoteGlobalFactToShared({
+          scope: fact.scope,
+          content: fact.content,
+          sourceConnector,
+        });
+        const factNs = promote ? sharedNamespace : undefined;
+        const targetRules =
+          factNs && factNs !== sourceNamespace ? await loadRedactionRules(sharedDir) : [];
+        return [...baseRules, ...targetRules];
+      }
+
+      // (a) tool-scoped global fact + sourceConnector -> predicted SESSION.
+      const toolRules = await consultedRulesFor({ scope: "global", content: "Prefer the search tool when locating code." });
+      assert.ok(
+        contentMatchesRedactionRules("session-only-secret here", toolRules),
+        "session rules are consulted for a tool-scoped global fact",
+      );
+      assert.ok(
+        !contentMatchesRedactionRules("shared-only-secret here", toolRules),
+        "shared rules are NOT consulted for a tool-scoped global fact (the #2183 fix)",
+      );
+
+      // (b) portable global fact + sourceConnector -> predicted SHARED.
+      const portableRules = await consultedRulesFor({ scope: "global", content: "User prefers dark mode in all editors" });
+      assert.ok(
+        contentMatchesRedactionRules("shared-only-secret here", portableRules),
+        "shared rules ARE consulted for a portable global fact (no regression)",
+      );
+    });
+  });
+});

package/src/index.ts

@@ -1439,7 +1439,6 @@ export {
   type ForkLineage,
 } from "./transfer/capsule-fork.js";
 
-
 // ---------------------------------------------------------------------------
 // Coding-graph engine contract (#1551 PR1) — types owned by core,
 // implemented by @remnic/coding-graph (à-la-carte optional).
@@ -1460,3 +1459,4 @@ export type {
   ParseResult,
   SymbolIR,
 } from "./coding/coding-graph-types.js";
+export type { ResolvedScopeProfilePlan } from "./namespaces/scope-profiles.js";

package/src/orchestration/extraction-persist.ts

@@ -82,6 +82,7 @@ import {
   stripCitationForTemplate,
 } from "../source-attribution.js";
 import { classifyMemoryKind } from "../himem.js";
+import { shouldPromoteGlobalFactToShared, withholdToolScopedFromSharedNamespace } from "../tool-scoped-memory.js";
 import {
   buildBehaviorSignalsForMemory,
   dedupeBehaviorSignalsByMemoryAndHash,
@@ -394,6 +395,7 @@ export class ExtractionPersistCoordinator {
     // (pre-judge + write-loop) so no new scattered config.*Enabled read is
     // introduced (ratchet scatteredConfigFlagReads; see #1523).
     const namespacesEnabled = resolveNamespaceCapabilities(this.deps.config).namespaces;
+    const sourceConnector = sourceContext?.sourceConnector; // #2183 tool-scope guard input
     const promoteMemoryToProfileTargets = async (options: {
       sourceStorage: StorageManager;
       category: string;
@@ -607,11 +609,14 @@ export class ExtractionPersistCoordinator {
       observedAt?: string;
       eventTimeSource?: "extracted" | "assumed";
       source: string;
+      sourceConnector?: string;
+      procedureSteps?: ReadonlyArray<{ toolCall?: { kind?: string } }>;
       /** Claim-level provenance spans (issue #1575 PR 2). */
       sources?: ProvenanceSource[];
       provenance?: "verified" | "unverified" | "none";
     }): Promise<void> => {
       await promoteMemoryToProfileTargets(options);
+      if (lifecycleCaps.extractionScopeClassification && withholdToolScopedFromSharedNamespace(options)) return;
       if (
         !shouldPromoteToShared(
           this.deps.config,
@@ -629,7 +634,6 @@ export class ExtractionPersistCoordinator {
           this.deps.config.sharedNamespace,
         );
         // Dedup gate: canonicalize content before hashing.
-        //
         // Issue #369 (PR #401): When inline attribution is enabled,
         // `applyInlineCitation` appends a timestamp-bearing marker (e.g.
         // `[Source: ..., ts=2026-04-11T...]`).  Because the timestamp changes
@@ -639,7 +643,6 @@ export class ExtractionPersistCoordinator {
         // `fact.content`, which can already carry an inline citation (e.g. a
         // relayed or reprocessed fact).  Strip any pre-existing citation so the
         // dedup key matches the hash stored from the original un-cited write.
-        //
         // PR #402 round-6 (Fix #2 / chatgpt-codex P1 PRRT_kwDORJXyws56U74n):
         // Compute the enriched content before the hash-dedup check so the
         // lookup uses the same content that writeMemory will actually store.
@@ -652,7 +655,6 @@ export class ExtractionPersistCoordinator {
         // key order and casing are canonical — identical to the enrichment
         // applied by storage.writeMemory — preventing spurious hash misses
         // when attribute maps arrive with different insertion orders or casing.
-        //
         // Fix #4 (Low PRRT_kwDORJXyws56VHth): sanitize the base content before
         // building dedupContent.  writeMemory runs sanitizeMemoryContent on the
         // enriched body before hashing; if sanitization redacts the content to
@@ -660,7 +662,6 @@ export class ExtractionPersistCoordinator {
         // the raw form.  Computing dedupContent from sanitized.text here ensures
         // the hash lookup and the normalizedIncoming comparison both use the
         // same content that writeMemory will actually store.
-        //
         // Combined fix: strip any pre-existing citation FIRST to obtain
         // rawContent (the canonical body), then sanitize rawContent (not
         // options.content) when building dedupContent, so that citation
@@ -1350,20 +1351,18 @@ export class ExtractionPersistCoordinator {
           // + PBJEe/PBKAj).
           let factRedactionRules = preJudgeRedactionRules;
           let factNs = preRoutedNamespaceByFact[fi];
-          // #1713 (codex PRRT_kwDORJXyws6PBj5X): scope classification can route
-          // a scope=global fact to the shared namespace independent of routing
-          // rules. If so, the pre-judge filter must consult the shared
-          // namespace's rules too, or a never-store pattern under shared is
-          // missed at pre-judge and only caught at the write gate — letting the
-          // content reach the extraction judge/training path. Mirror the write
-          // loop's scope-routing conditions exactly.
+          // #1713: predict the same target namespace the write loop will route
+          // this global fact to (shared, via shouldPromoteGlobalFactToShared) so
+          // the pre-judge redaction filter consults that namespace's rules.
           if (
             !factNs &&
             lifecycleCaps.extractionScopeClassification &&
             namespacesEnabled &&
             f.scope === "global" &&
             profileAllowsSharedWrites &&
-            this.deps.storageDirNamespace(storage.dir) !== this.deps.config.sharedNamespace
+            this.deps.storageDirNamespace(storage.dir) !== this.deps.config.sharedNamespace &&
+            shouldPromoteGlobalFactToShared({ scope: f.scope, content: f.content,
+              sourceConnector, procedureSteps: f.procedureSteps })
           ) {
             factNs = this.deps.config.sharedNamespace;
           }
@@ -1611,14 +1610,9 @@ export class ExtractionPersistCoordinator {
         }
       }
 
-      // Scope-based namespace routing: when scope classification is enabled
-      // and the LLM tagged this fact as "global", route it to the shared
-      // namespace so cross-project knowledge is visible everywhere. Only
-      // applies when namespaces are enabled and the fact was not already
-      // routed to a specific namespace by a routing rule (routing rules
-      // that set an explicit namespace take precedence; category-only rules
-      // do not block scope routing). Rule 30: gated by
-      // extractionScopeClassificationEnabled.
+      // Scope-based namespace routing: a `global` fact (scope classification
+      // on, no explicit routing-rule namespace) is promoted to the shared
+      // namespace unless the tool-scope guard withholds it (#2183).
       if (
         lifecycleCaps.extractionScopeClassification &&
         namespacesEnabled &&
@@ -1627,18 +1621,21 @@ export class ExtractionPersistCoordinator {
       ) {
         const currentNs = this.deps.storageDirNamespace(targetStorage.dir);
         if (currentNs !== this.deps.config.sharedNamespace && profileAllowsSharedWrites) {
-          try {
-            targetStorage = await this.deps.getStorageRouter().storageFor(
-              this.deps.config.sharedNamespace,
-            );
-            targetNamespaceName = this.deps.config.sharedNamespace;
-            log.debug(
-              `scope-routing: fact "${fact.content.slice(0, 60)}…" routed to shared namespace (scope=global)`,
-            );
-          } catch (scopeRouteErr) {
-            log.warn(
-              `scope-routing: failed to resolve shared namespace storage; writing to session namespace (fail-open): ${scopeRouteErr}`,
-            );
+          if (shouldPromoteGlobalFactToShared({ scope: fact.scope, content: fact.content,
+            sourceConnector, procedureSteps: fact.procedureSteps })) {
+            try {
+              targetStorage = await this.deps.getStorageRouter().storageFor(
+                this.deps.config.sharedNamespace,
+              );
+              targetNamespaceName = this.deps.config.sharedNamespace;
+              log.debug(
+                `scope-routing: fact "${fact.content.slice(0, 60)}…" routed to shared namespace (scope=global)`,
+              );
+            } catch (scopeRouteErr) {
+              log.warn(
+                `scope-routing: failed to resolve shared namespace storage; writing to session namespace (fail-open): ${scopeRouteErr}`,
+              );
+            }
           }
         } else if (currentNs !== this.deps.config.sharedNamespace) {
           log.debug(
@@ -2404,6 +2401,7 @@ export class ExtractionPersistCoordinator {
               : {}),
             source: extractionWriteSource,
             ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
+            ...(fact.procedureSteps && fact.procedureSteps.length ? { procedureSteps: fact.procedureSteps } : {}),
             ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
             ...(fact.provenance ? { provenance: fact.provenance } : {}),
           });
@@ -2704,6 +2702,7 @@ export class ExtractionPersistCoordinator {
             : {}),
           source: extractionWriteSource,
           ...(extractionSourceConnector ? { sourceConnector: extractionSourceConnector } : {}),
+          ...(fact.procedureSteps && fact.procedureSteps.length ? { procedureSteps: fact.procedureSteps } : {}),
           ...(fact.sources && fact.sources.length > 0 ? { sources: fact.sources } : {}),
           ...(fact.provenance ? { provenance: fact.provenance } : {}),
         });