@staix/vault-mem 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [0.1.3] - 2026-10-30
+
+- `vmem tidy --log` fixes legacy log lines that fail lint L09: a trailing seconds field is dropped, and any other malformed line is kept verbatim behind `# legacy: `.
+
 ## [0.1.2] - 2026-10-30
 
 - `vmem move` accepts an existing legacy-named note (lint L13) as its source and may rewrite inbound links in other legacy-named notes, so the finding can be fixed with a normal rename. Destinations still need a valid stem.

package/README.md

@@ -247,6 +247,6 @@ Runtime changes intentionally make `release:verify` report stale historical rele
 | `--topics` | append `## Topics` listing the frontmatter topics where no such heading exists; mismatched sections are reported |
 | `--connections` | fold `## Connections (...)` headings into `## Relevant Notes` |
 | `--secrets` | replace V06 secret matches with `[redacted]`: in the body the match itself, in frontmatter the whole field value (the key stays, so the YAML stays valid). A match outside a field value, such as a YAML comment, is reported for manual repair. The preview names note and line, never the value. PII in personal vaults is left alone |
-| `--log` | replace secret-looking substrings and email addresses in existing log lines with `[redacted]`, under the log lock (refused with V06 when `denyPaths` covers the log); legacy lines are otherwise kept byte for byte. Git history is not rewritten: rotate exposed credentials |
+| `--log` | replace secret-looking substrings and email addresses in existing log lines with `[redacted]`, under the log lock (refused with V06 when `denyPaths` covers the log). A line that fails the lint L09 structure check loses a trailing seconds field when that makes it valid, and is otherwise kept verbatim behind `# legacy: ` (readers skip `#` lines); no time, zone or TYPE is guessed. Other lines are kept byte for byte. Git history is not rewritten: rotate exposed credentials |
 
 `--map <file>` overrides defaults with strict JSON `{"enums": {"confidence|status|type": {"from": "to"}}, "keys": {"key": "drop" | "keep" | {"rename": "key"}}}` (at most 64 KiB and 1000 entries). For `tidy`, `--log` selects the log rule; tidy always writes its own `LINT` event.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/vault-mem",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Validated Obsidian-compatible knowledge vaults for agents and people",
   "license": "MIT",
   "type": "module",

package/src/tidy.ts

@@ -29,7 +29,7 @@ export interface TidyResult {
   notes: { path: string; changes: string[] }[];
   /** Values and keys left unchanged because no rule or map entry covers them. */
   reported: { path: string; message: string }[];
-  log?: { lines: number; redactions: number; changes: string[] };
+  log?: { lines: number; redactions: number; formats: number; changes: string[] };
   fingerprint?: string;
   written: string[];
   issues: WriteIssue[];
@@ -271,17 +271,32 @@ function readLogFile(root: string): string | null {
     return buffer.subarray(0, read).toString("utf8");
   } finally { closeSync(fd); }
 }
-function sanitizeLog(text: string): { text: string; lines: number; redactions: number; changes: string[] } {
-  let lines = 0, redactions = 0;
+/** The lint L09 structure check (kept identical to vault-lint.ts). */
+const LOG_STRUCTURE = /^(\d{4}-\d{2}-\d{2}) (\d{2}:\d{2})\s+(\S+)\s+(.*)$/;
+/** Fix a legacy line that fails L09: drop a seconds field when that makes it valid, otherwise comment it out verbatim. */
+function normalizeLogLine(line: string): string | undefined {
+  const body = line.endsWith("\r") ? line.slice(0, -1) : line;
+  if (!body.trim() || body.startsWith("#") || LOG_STRUCTURE.test(body)) return undefined;
+  const seconds = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}):\d{2}(\s.*)$/.exec(body);
+  if (seconds && LOG_STRUCTURE.test(seconds[1]! + seconds[2]!)) return seconds[1]! + seconds[2]! + line.slice(body.length);
+  return `# legacy: ${line}`;
+}
+function sanitizeLog(text: string): { text: string; lines: number; redactions: number; formats: number; changes: string[] } {
+  let lines = 0, redactions = 0, formats = 0;
   const changes: string[] = [];
   const out = text.split("\n").map((line, index) => {
     const secret = redact(line);
     let hits = secret.hits, next = secret.text;
     next = next.replace(new RegExp(EMAIL_PATTERN.source, "gi"), () => { hits++; return "[redacted]"; });
-    if (hits) { lines++; redactions += hits; changes.push(`log: line ${index + 1}, ${hits} redaction${hits === 1 ? "" : "s"}`); }
+    const normalized = normalizeLogLine(next);
+    if (normalized !== undefined) { next = normalized; formats++; }
+    if (hits || normalized !== undefined) {
+      lines++; redactions += hits;
+      changes.push(`log: line ${index + 1}, ${[hits ? `${hits} redaction${hits === 1 ? "" : "s"}` : "", normalized !== undefined ? "format" : ""].filter(Boolean).join(", ")}`);
+    }
     return next;
   }).join("\n");
-  return { text: out, lines, redactions, changes };
+  return { text: out, lines, redactions, formats, changes };
 }
 /** Replace the log under its own lock, atomically (the one sanctioned in-place rewrite of the append-only log). */
 function rewriteLog(root: string, expected: string, next: string): void {
@@ -339,14 +354,14 @@ export function tidyVault(home: string, request: TidyRequest, options: { env?: N
     }
   }
   result.notes = planned.map(change => ({ path: change.path, changes: change.changes }));
-  let logPlan: { before: string; text: string; lines: number; redactions: number; changes: string[] } | undefined;
+  let logPlan: { before: string; text: string; lines: number; redactions: number; formats: number; changes: string[] } | undefined;
   if (rules.includes("log") && isDenied(join(root, "log"), config.denyPaths)) return { ...result, issues: [issue("V06", "the vault log is denied by the path policy; drop --log")] };
   if (rules.includes("log")) {
     const before = readLogFile(root);
     if (before !== null) {
       const sanitized = sanitizeLog(before);
-      result.log = { lines: sanitized.lines, redactions: sanitized.redactions, changes: sanitized.changes };
-      if (sanitized.redactions) { logPlan = { before, ...sanitized }; result.counts.log = sanitized.redactions; }
+      result.log = { lines: sanitized.lines, redactions: sanitized.redactions, formats: sanitized.formats, changes: sanitized.changes };
+      if (sanitized.text !== before) { logPlan = { before, ...sanitized }; result.counts.log = sanitized.redactions + sanitized.formats; }
     }
   }
   // Validate every planned note with the writer (dry-run). A note the writer would refuse is reported and skipped