@remnic/core 9.66.10 → 9.66.12

package/src/recall-deep-rewrite.ts

@@ -0,0 +1,50 @@
+/**
+ * Validate a deep-recall REFINE rewrite (issue #2332).
+ *
+ * Pure. The budget check runs before the rewrite is inspected, so an
+ * exhausted budget cannot be bypassed by a valid-looking query. An empty
+ * or no-progress rewrite is rejected and treated as STOP.
+ */
+export const MAX_REFINES_PER_INVOCATION = 2;
+
+export type RefineRewriteResult =
+  | { ok: true; refinedQuery: string }
+  | {
+      ok: false;
+      stop: true;
+      reason: "empty_rewrite" | "identical_rewrite" | "refine_budget_spent";
+    };
+
+export function validateRefineRewrite(input: {
+  currentQuery: string;
+  refinedQuery: unknown;
+  refinesUsed: number;
+}): RefineRewriteResult {
+  if (!Number.isInteger(input.refinesUsed) || input.refinesUsed < 0) {
+    throw new RangeError(
+      `refinesUsed must be a non-negative integer; got ${JSON.stringify(input.refinesUsed)}`,
+    );
+  }
+  if (input.refinesUsed >= MAX_REFINES_PER_INVOCATION) {
+    return { ok: false, stop: true, reason: "refine_budget_spent" };
+  }
+  if (
+    typeof input.refinedQuery !== "string" ||
+    input.refinedQuery.trim() === ""
+  ) {
+    return { ok: false, stop: true, reason: "empty_rewrite" };
+  }
+  const trimmed = input.refinedQuery.trim();
+  // Comparison key: case-folded with internal whitespace runs collapsed, so
+  // pure case/spacing drift is not progress. The returned rewrite keeps
+  // internal whitespace as the model wrote it.
+  const currentKey = input.currentQuery
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, " ");
+  const refinedKey = trimmed.toLowerCase().replace(/\s+/g, " ");
+  if (refinedKey === currentKey) {
+    return { ok: false, stop: true, reason: "identical_rewrite" };
+  }
+  return { ok: true, refinedQuery: trimmed };
+}

package/src/transfer/export-okf.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtemp, readFile, rm, writeFile, symlink } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile, symlink } from "node:fs/promises";
 import { existsSync, lstatSync, readdirSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -162,3 +162,79 @@ function collectFiles(root: string): string[] {
   walk(root);
   return out.sort();
 }
+
+test("--namespace cannot escape the namespace root", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-ns-"));
+  const outDir = path.join(await mkdtemp(path.join(os.tmpdir(), "remnic-okf-nsout-")), "bundle");
+  try {
+    await seedStore(memoryDir);
+    // A raw path.join on the operator value used to resolve outside
+    // <memoryDir>/namespaces and export an arbitrary tree.
+    for (const namespace of ["../../..", "../sibling", path.resolve(memoryDir)]) {
+      await assert.rejects(
+        () => exportOkfBundle({ memoryDir, namespace, outDir }),
+        /invalid --namespace/,
+        `namespace ${namespace} must be rejected`,
+      );
+    }
+    assert.equal(existsSync(outDir), false, "a rejected namespace must not create the bundle");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("a plain --namespace still exports from the namespace subtree", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-nsok-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(path.join(root, "namespaces", "team-a"));
+    const result = await exportOkfBundle({ memoryDir: root, namespace: "team-a", outDir });
+    assert.ok(result.exported > 0, "namespaced export must find its own memories");
+    assert.ok(existsSync(path.join(outDir, "index.md")));
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a leftover backup directory does not block a forced export", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-bk-"));
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-bkout-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(memoryDir);
+    await exportOkfBundle({ memoryDir, outDir });
+    // Simulate a crash between the two publish renames, or any directory a
+    // user happens to own at the old fixed backup path.
+    const stale = `${outDir}.okf-prev`;
+    await mkdir(stale, { recursive: true });
+    await writeFile(path.join(stale, "keep.md"), "stale\n", "utf8");
+
+    const again = await exportOkfBundle({ memoryDir, outDir, force: true });
+    assert.ok(again.exported > 0);
+    assert.ok(existsSync(path.join(outDir, "index.md")), "forced export must republish");
+    assert.equal(existsSync(path.join(stale, "keep.md")), true, "an unrelated directory is left alone");
+    const leftovers = readdirSync(root).filter((name) => name.startsWith("bundle.okf-prev-"));
+    assert.deepEqual(leftovers, [], "each attempt removes its own backup");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("--out that is a file is rejected before anything is written", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-file-"));
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-fileout-"));
+  const outDir = path.join(root, "bundle");
+  try {
+    await seedStore(memoryDir);
+    await writeFile(outDir, "not a directory\n", "utf8");
+    await assert.rejects(
+      () => exportOkfBundle({ memoryDir, outDir, force: true }),
+      /--out exists and is not a directory/,
+    );
+    assert.equal(await readFile(outDir, "utf8"), "not a directory\n", "the file is left untouched");
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/transfer/export-okf.ts

@@ -1,6 +1,5 @@
-import { rmSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
 import { mkdtemp } from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 
 import { parseOaiMemCitation } from "../citations.js";
@@ -8,6 +7,7 @@ import { inferMemoryStatus } from "../memory-lifecycle-ledger-utils.js";
 import { normalizeProjectionPreview } from "../memory-projection-format.js";
 import { lintOkfDir } from "../okf/lint.js";
 import { okfTypeForMemory, OKF_PROFILE_TYPE } from "../okf/type-mapping.js";
+import { resolveNamespaceChildRoot } from "../namespaces/path.js";
 import {
   OKF_EXPORT_VERSION,
   publishBundle,
@@ -38,6 +38,14 @@ const MEMORY_STATUSES: readonly MemoryStatus[] = [
 
 export interface ExportOkfOptions {
   memoryDir: string;
+  /**
+   * Optional namespace segment. Resolved here, once, through the shared
+   * containment guard: both CLI entry points used to join the raw operator
+   * value onto `memoryDir/namespaces`, so `--namespace ../../..` escaped the
+   * namespace root and exported an arbitrary tree (rule 9 — one resolver, not
+   * a per-caller guard).
+   */
+  namespace?: string;
   outDir: string;
   includeStatus?: readonly string[];
   includeCategories?: readonly string[];
@@ -71,15 +79,19 @@ export function parseIncludeStatus(raw: unknown): MemoryStatus[] {
 export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkfResult> {
   const outDir = path.resolve(opts.outDir);
   rejectSymlinkPath(outDir);
+  const namespace = (opts.namespace ?? "").trim();
+  const memoryDir = namespace
+    ? resolveNamespaceChildRoot(opts.memoryDir, namespace, "--namespace")
+    : opts.memoryDir;
   const includeStatus = new Set(parseIncludeStatus(opts.includeStatus));
   const includeCategories = opts.includeCategories?.length ? new Set(opts.includeCategories) : null;
   const excludeTags = new Set(opts.excludeTags ?? []);
-  const storage = new StorageManager(opts.memoryDir);
+  const storage = new StorageManager(memoryDir);
   const memories = await storage.readAllMemories();
   const included: MemoryFile[] = [];
   let excluded = 0;
   for (const memory of memories) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     if (!opts.includeWearables && rel.startsWith("wearables/")) {
       excluded += 1;
       continue;
@@ -99,17 +111,21 @@ export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkf
     }
     included.push(memory);
   }
-  included.sort((a, b) => toRel(a.path, opts.memoryDir).localeCompare(toRel(b.path, opts.memoryDir)));
+  included.sort((a, b) => toRel(a.path, memoryDir).localeCompare(toRel(b.path, memoryDir)));
 
-  const staging = await mkdtemp(path.join(os.tmpdir(), "remnic-okf-export-"));
+  // Stage inside the destination's parent, not the OS temp dir: publishBundle
+  // finishes with a rename, and a rename across filesystems fails with EXDEV
+  // whenever --out lives on a different mount than /tmp.
+  mkdirSync(path.dirname(outDir), { recursive: true });
+  const staging = await mkdtemp(path.join(path.dirname(outDir), ".remnic-okf-export-"));
   const byCategory: Record<string, number> = {};
   const idToRel = new Map<string, string>();
   for (const memory of included) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     idToRel.set(memory.frontmatter.id, rel);
   }
   for (const memory of included) {
-    const rel = toRel(memory.path, opts.memoryDir);
+    const rel = toRel(memory.path, memoryDir);
     const rendered = renderMemory(memory, rel, idToRel);
     writeBundleFile(staging, rel, rendered);
     const category = memory.frontmatter.category;
@@ -140,7 +156,7 @@ export async function exportOkfBundle(opts: ExportOkfOptions): Promise<ExportOkf
     writeBundleFile(staging, "log.md", renderLog(events, idToRel, opts.logMaxEntries ?? DEFAULT_OKF_LOG_MAX_ENTRIES));
   }
 
-  writeIndexes(staging, included, opts.memoryDir);
+  writeIndexes(staging, included, memoryDir);
   const lint = lintOkfDir(staging);
   const blocking = lint.findings.filter((f) => f.code !== "skipped_encrypted" && f.code !== "reserved_basename");
   if (blocking.length > 0) {