@remnic/core 9.54.4 → 9.54.5

package/src/offline-sync.ts

@@ -1,5 +1,4 @@
 import { createHash, randomUUID } from "node:crypto";
-import { createReadStream } from "node:fs";
 import {
   lstat,
   mkdir,
@@ -17,7 +16,6 @@ import path from "node:path";
 import {
   DEFAULT_TRANSFER_EXCLUDE_DIRS,
 } from "./transfer/exclusions.js";
-import { isEncryptedFile, MAGIC_HEADER_SIZE } from "./secure-store/secure-fs.js";
 import {
   prepareSafeArchiveRoot,
   resolveSafeArchiveTarget,
@@ -27,6 +25,16 @@ import {
 } from "./transfer/fs-utils.js";
 import { parseFlexibleIsoTimestamp } from "./utils/iso-timestamp.js";
 import { DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS } from "./offline-sync-exclude-globs.js";
+import {
+  isEncryptedOfflineSyncFile,
+  readPlainOfflineSyncFileChunk,
+  sha256OfflineSyncFile,
+  shouldExcludeOfflineSyncFile,
+  type OfflineSyncExcludeFile,
+  type OfflineSyncFileTarget,
+} from "./offline-sync-file-io.js";
+
+export type { OfflineSyncExcludeFile, OfflineSyncFileTarget } from "./offline-sync-file-io.js";
 
 export const OFFLINE_SYNC_SNAPSHOT_FORMAT = "remnic.offline-sync.snapshot.v1";
 export const OFFLINE_SYNC_CHANGESET_FORMAT = "remnic.offline-sync.changeset.v1";
@@ -141,12 +149,6 @@ export interface OfflineSyncChangesetSummary {
   total: number;
 }
 
-export interface OfflineSyncFileTarget {
-  root: string;
-  path: string;
-  filePath: string;
-}
-
 export interface OfflineSyncFileDeleteTarget extends OfflineSyncFileTarget {
   mtimeMs?: number;
 }
@@ -826,7 +828,7 @@ async function readOfflineSyncFileRecord(
     digest = sha256Buffer(content);
     content = null;
   } else {
-    digest = await sha256File(options.filePath, options.signal);
+    digest = await sha256OfflineSyncFile(options.filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   const st = await stat(options.filePath);
@@ -839,57 +841,13 @@ async function readOfflineSyncFileRecord(
   };
 }
 
-async function sha256File(filePath: string, signal?: AbortSignal): Promise<OfflineSyncFileDigest> {
-  const hash = createHash("sha256");
-  let bytes = 0;
-  for await (const chunk of createReadStream(filePath)) {
-    throwIfOfflineSyncAborted(signal);
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    hash.update(buffer);
-    bytes += buffer.length;
-  }
-  throwIfOfflineSyncAborted(signal);
-  return {
-    sha256: hash.digest("hex"),
-    bytes,
-  };
-}
-
-async function fileIsSecureStoreEncrypted(filePath: string): Promise<boolean> {
-  const handle = await open(filePath, "r");
-  try {
-    const header = Buffer.alloc(MAGIC_HEADER_SIZE);
-    const { bytesRead } = await handle.read(header, 0, header.length, 0);
-    return bytesRead >= MAGIC_HEADER_SIZE && isEncryptedFile(header);
-  } finally {
-    await handle.close();
-  }
-}
-
-async function readPlainFileContentChunk(options: {
-  filePath: string;
-  offset: number;
-  length: number;
-  bytes: number;
-}): Promise<Buffer> {
-  const chunkBytes = Math.min(options.length, options.bytes - options.offset);
-  const chunk = Buffer.alloc(chunkBytes);
-  if (chunkBytes === 0) return chunk;
-  const handle = await open(options.filePath, "r");
-  try {
-    const { bytesRead } = await handle.read(chunk, 0, chunk.length, options.offset);
-    return bytesRead === chunk.length ? chunk : chunk.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-
 export async function* iterateOfflineSyncSnapshotFileRecords(options: {
   root: string;
   includeContent?: boolean;
   includeTranscripts?: boolean;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -924,6 +882,11 @@ export async function* iterateOfflineSyncSnapshotFileRecords(options: {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs,
+      })) continue;
       yield await readOfflineSyncFileRecord({
         root,
         relPath: relPosix,
@@ -948,6 +911,7 @@ export async function buildOfflineSyncSnapshot(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -995,6 +959,7 @@ export async function buildOfflineSyncSnapshotFromBase(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1039,6 +1004,11 @@ export async function buildOfflineSyncSnapshotFromBase(options: {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs,
+      })) continue;
       const st = await stat(abs);
       const baseEntry = base.get(relPosix);
       if (
@@ -1094,6 +1064,7 @@ export async function buildOfflineSyncSnapshotForPaths(options: {
   now?: Date;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
   readFileDigest?: (target: OfflineSyncFileTarget) => Promise<OfflineSyncFileDigest>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1130,6 +1101,13 @@ export async function buildOfflineSyncSnapshotForPaths(options: {
       throw error;
     });
     if (!st || st.isSymbolicLink() || !st.isFile()) continue;
+    if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+      root: root.abs,
+      path: relPath,
+      filePath,
+    })) {
+      throw new Error(`offline sync snapshot path is excluded: ${relPath}`);
+    }
     files.push(await readOfflineSyncFileRecord({
       root,
       relPath,
@@ -1169,6 +1147,7 @@ export async function readOfflineSyncFileContentChunk(options: {
   length?: number;
   includeTranscripts?: boolean;
   readFile?: (target: OfflineSyncFileTarget) => Promise<Buffer>;
+  excludeFile?: OfflineSyncExcludeFile;
   userExcludeRegexps?: readonly RegExp[];
   /**
    * When false, enumeration uses only the legacy structural excludes —
@@ -1209,12 +1188,19 @@ export async function readOfflineSyncFileContentChunk(options: {
   if (!st || st.isSymbolicLink() || !st.isFile()) {
     throw new Error(`offline sync file content path not found: ${relPath}`);
   }
-  const encrypted = await fileIsSecureStoreEncrypted(filePath);
+  if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+    root: root.abs,
+    path: relPath,
+    filePath,
+  })) {
+    throw new Error(`offline sync file content path is excluded: ${relPath}`);
+  }
+  const encrypted = await isEncryptedOfflineSyncFile(filePath);
   if (!encrypted) {
     if (offset > st.size) {
       throw new Error(`offset must be <= file size for ${relPath}`);
     }
-    const chunk = await readPlainFileContentChunk({
+    const chunk = await readPlainOfflineSyncFileChunk({
       filePath,
       offset,
       length: requestedLength,
@@ -2017,7 +2003,7 @@ async function readLocalFileState(options: {
     const content = await options.readFile({ root: options.rootAbs, path: options.relPath, filePath });
     digest = sha256Buffer(content);
   } else {
-    digest = await sha256File(filePath, options.signal);
+    digest = await sha256OfflineSyncFile(filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   return {

package/src/orchestration/consolidation-run.ts

@@ -67,6 +67,7 @@ import type {
   PluginConfig,
   RecallSectionConfig,
 } from "../types.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 /** Dependencies injected by the orchestrator. Stable references or live
  *  accessors — lazy getters for mutable fields tests reassign
@@ -449,7 +450,7 @@ export class ConsolidationRunCoordinator {
     }
     await this.pruneHarmonicStores(storage);
 
-    let allMemories = await storage.readAllMemories();
+    let allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
     if (allMemories.length < 5) {
       return { memoriesProcessed: allMemories.length, merged, invalidated };
     }
@@ -801,7 +802,7 @@ export class ConsolidationRunCoordinator {
       // mutations for the catalog touch below (codex NThSW).
       const tierMigration = await this.deps.tierMigrationCoordinator.runCycle(storage, "maintenance");
       if (tierMigration.migrated > 0) memoryItemMutated = true;
-      allMemories = await storage.readAllMemories();
+      allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
 
       // Fact archival pass (v6.0) — move old, low-importance, rarely-accessed facts to archive/
       if (resolveRecallEnhancementCapabilities(config).factArchival) {
@@ -823,7 +824,7 @@ export class ConsolidationRunCoordinator {
     } catch (err) {
       log.warn(`deep-sleep maintenance pass failed (ignored): ${err}`);
       try {
-        allMemories = await storage.readAllMemories();
+        allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
       } catch (readErr) {
         log.warn(`deep-sleep maintenance recovery read failed: ${readErr}`);
         throw err;
@@ -862,7 +863,7 @@ export class ConsolidationRunCoordinator {
           const semResult = await this.deps.semanticConsolidationCoordinator.runSemanticConsolidation();
           let remItemsProcessed = allMemories.length;
           try {
-            allMemories = await storage.readAllMemories();
+            allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
             remItemsProcessed = allMemories.length;
           } catch (err) {
             log.warn(

package/src/orchestration/contradiction-linking-coordinator.ts

@@ -43,6 +43,7 @@ import type {
   DependencyPropagationDeliveryPort,
   DependencyPropagationPreparationToken,
 } from "./dependency-propagation-delivery.js";
+import { isSupportPassportPrivateMemory } from "../support-passport/card-projection.js";
 
 /** Result type of {@link ContradictionLinkingCoordinator.checkForContradiction}. */
 export interface ContradictionResult {
@@ -170,6 +171,7 @@ export class ContradictionLinkingCoordinator {
         const resultStorage = await this.storageForNamespace(resultNamespace);
         const existingMemory = await resultStorage.getMemoryById(memoryId);
         if (!existingMemory) continue;
+        if (isSupportPassportPrivateMemory(existingMemory)) continue;
         if (inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
         const verification = await this.getExtraction().verifyContradiction(
           { content, category },
@@ -231,6 +233,9 @@ export class ContradictionLinkingCoordinator {
       ]);
       anchorSnapshot = mergeMemorySnapshots(hot, cold, resultStorage.dir);
     }
+    anchorSnapshot = anchorSnapshot?.filter(
+      (memory) => !isSupportPassportPrivateMemory(memory),
+    );
     const anchorMemoryById = anchorSnapshot
       ? new Map(anchorSnapshot.map((memory) => [memory.frontmatter.id, memory]))
       : undefined;
@@ -264,6 +269,7 @@ export class ContradictionLinkingCoordinator {
               anchorMemoryById?.get(memoryId) ?? (await resultStorage.getMemoryById(memoryId));
             if (
               !existingMemory ||
+              isSupportPassportPrivateMemory(existingMemory) ||
               inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active"
             ) continue;
             hits.push({
@@ -290,6 +296,7 @@ export class ContradictionLinkingCoordinator {
         anchorMemoryById?.get(candidate.id) ?? (await resultStorage.getMemoryById(candidate.id));
       if (
         !existingMemory ||
+        isSupportPassportPrivateMemory(existingMemory) ||
         inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active"
       ) continue;
       const verification = await this.getExtraction().verifyContradiction(

package/src/orchestration/contradiction-localization.integration.test.ts

@@ -1951,3 +1951,118 @@ test("QMD candidates under archive paths are not eligible without raw status", a
     omitStatus: true,
   });
 });
+
+test("live contradiction linking excludes support passport QMD candidates", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-contradiction-passport-qmd-"));
+  try {
+    const config = baseConfig(memoryDir) as PluginConfig;
+    const candidate = {
+      path: path.join(memoryDir, "facts", "passport.md"),
+      content: "I need written instructions.",
+      frontmatter: {
+        id: "passport-card",
+        category: "preference",
+        created: "2026-08-01T00:00:00.000Z",
+        updated: "2026-08-01T00:00:00.000Z",
+        source: "support-passport",
+        confidence: 1,
+        confidenceTier: "explicit",
+        tags: ["support-passport-card"],
+        status: "active",
+      },
+    } as unknown as MemoryFile;
+    const storage = {
+      dir: memoryDir,
+      readAllMemories: async () => [],
+      readAllColdMemories: async () => [],
+      getMemoryById: async () => candidate,
+    } as never as StorageManager;
+    let verificationCalls = 0;
+    const coordinator = new ContradictionLinkingCoordinator({
+      getConfig: () => config,
+      isSearchAvailable: () => true,
+      searchAcrossNamespaces: async () => [{
+        docid: candidate.path,
+        path: candidate.path,
+        snippet: candidate.content,
+        score: 0.99,
+      }],
+      extractMemoryIdsFromResults: () => [candidate.frontmatter.id],
+      namespaceFromPath: () => "default",
+      storageForNamespace: async () => storage,
+      getExtraction: () => ({
+        verifyContradiction: async () => {
+          verificationCalls++;
+          return null;
+        },
+      }) as unknown as ExtractionEngine,
+    });
+
+    const contradiction = await coordinator.checkForContradiction(
+      "New preference",
+      "preference",
+      "default",
+    );
+
+    assert.equal(contradiction, null);
+    assert.equal(verificationCalls, 0);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("live contradiction linking excludes support passport anchor candidates", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-contradiction-passport-anchor-"));
+  try {
+    const config = baseConfig(memoryDir) as PluginConfig;
+    const candidate = {
+      path: path.join(memoryDir, "facts", "passport.md"),
+      content: "I need written instructions.",
+      frontmatter: {
+        id: "passport-card",
+        category: "preference",
+        created: "2026-08-01T00:00:00.000Z",
+        updated: "2026-08-01T00:00:00.000Z",
+        source: "support-passport",
+        confidence: 1,
+        confidenceTier: "explicit",
+        tags: ["support-passport-card"],
+        status: "active",
+        entityRef: "person:owner",
+      },
+    } as unknown as MemoryFile;
+    const storage = {
+      dir: memoryDir,
+      readAllMemories: async () => [candidate],
+      readAllColdMemories: async () => [],
+      getMemoryById: async () => candidate,
+    } as never as StorageManager;
+    let verificationCalls = 0;
+    const coordinator = new ContradictionLinkingCoordinator({
+      getConfig: () => config,
+      isSearchAvailable: () => false,
+      searchAcrossNamespaces: async () => [],
+      extractMemoryIdsFromResults: () => [],
+      namespaceFromPath: () => "default",
+      storageForNamespace: async () => storage,
+      getExtraction: () => ({
+        verifyContradiction: async () => {
+          verificationCalls++;
+          return null;
+        },
+      }) as unknown as ExtractionEngine,
+    });
+
+    const contradiction = await coordinator.checkForContradiction(
+      "New preference",
+      "preference",
+      "default",
+      { entityRef: "person:owner", storageSnapshot: [candidate] },
+    );
+
+    assert.equal(contradiction, null);
+    assert.equal(verificationCalls, 0);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});

package/src/orchestration/lifecycle-policy-coordinator.ts

@@ -48,6 +48,7 @@ import type {
   MemoryActionEvent,
   MemorySummary,
 } from "../types.js";
+import { excludeSupportPassportPrivateMemories } from "../support-passport/card-projection.js";
 
 /** Dependencies injected by the orchestrator. All stable references or
  *  live accessors. */
@@ -202,7 +203,7 @@ export class LifecyclePolicyCoordinator {
     };
     const actionPriors = await this.buildLifecycleActionPriors(storage);
 
-    for (const memory of allMemories) {
+    for (const memory of excludeSupportPassportPrivateMemories(allMemories)) {
       if (
         memory.frontmatter.status === "superseded" ||
         memory.frontmatter.status === "forgotten"