@theglitchking/semantic-memory 1.5.1 → 1.5.3

package/dist/core/index.d.ts

@@ -1,5 +1,6 @@
 import Graph from 'graphology';
 import { EventEmitter } from 'node:events';
+export { REDACTED, RedactMode, RedactResult, redact, redactDeep } from './redact.js';
 
 interface IndexedDocument {
     path: string;
@@ -182,13 +183,18 @@ declare class TextSearch {
     search(options: SearchTextOptions): SearchResult[];
 }
 
+/** `redacted`: secrets masked in the content written (never the values). */
+interface NoteWriteResult {
+    path: string;
+    redacted: number;
+}
 declare class NoteCrud {
     private notesPath;
     constructor(notesPath: string);
-    create(relativePath: string, content: string, frontmatter?: Record<string, unknown>): Promise<string>;
+    create(relativePath: string, content: string, frontmatter?: Record<string, unknown>): Promise<NoteWriteResult>;
     read(relativePath: string): Promise<string>;
     readMultiple(paths: string[]): Promise<Map<string, string>>;
-    update(relativePath: string, content: string, options: UpdateNoteOptions): Promise<void>;
+    update(relativePath: string, content: string, options: UpdateNoteOptions): Promise<NoteWriteResult>;
     delete(relativePath: string): Promise<void>;
     move(fromPath: string, toPath: string): Promise<void>;
     private updateWikilinksAfterMove;
@@ -199,7 +205,9 @@ declare class FrontmatterManager {
     private notesPath;
     constructor(notesPath: string);
     get(relativePath: string): Promise<Record<string, unknown>>;
-    update(relativePath: string, fields: Record<string, unknown>): Promise<void>;
+    update(relativePath: string, fields: Record<string, unknown>): Promise<{
+        redacted: number;
+    }>;
 }
 declare class TagManager {
     private notesPath;
@@ -252,7 +260,7 @@ interface VaultSchema {
 type Severity$1 = "warn" | "error";
 interface LintFinding {
     path: string;
-    rule: "missing_provenance" | "stale" | "schema_violations" | "broken_links" | "code_symbols" | "decay_candidates" | "alias_conflicts" | "decoys";
+    rule: "missing_provenance" | "stale" | "schema_violations" | "broken_links" | "code_symbols" | "decay_candidates" | "alias_conflicts" | "decoys" | "secrets";
     severity: Severity$1;
     message: string;
 }
@@ -337,6 +345,8 @@ interface ApplyPatchOptions {
 interface AppliedOp {
     op: "create" | "update" | "delete" | "move";
     path: string;
+    /** secrets masked in this op's content; omitted when none */
+    redacted?: number;
 }
 interface ApplyPatchResult {
     ok: boolean;
@@ -530,6 +540,8 @@ interface LintReport {
         decay_candidates: LintFinding[];
         alias_conflicts: LintFinding[];
         decoys: LintFinding[];
+        /** only present when the opt-in secrets check ran */
+        secrets?: LintFinding[];
     };
     counts: {
         errors: number;
@@ -572,6 +584,14 @@ declare function lintVault(notesPath: string, opts?: {
      * signal (decision Q5). Opt-in; a no-op with no selection log.
      */
     checkDecoys?: boolean;
+    /**
+     * When true, run the secrets check (v1.5.3): flag notes that contain a secret
+     * (API key, token, password, private key — the redactor's precise set). Reports
+     * path, line and kind, never the value; nothing is rewritten. Opt-in, so the
+     * default report stays byte-stable. A real secret must be rotated: it is in
+     * git history if the note was ever committed.
+     */
+    checkSecrets?: boolean;
 }): Promise<LintReport>;
 declare function formatLintReport(report: LintReport, opts?: {
     rule?: keyof LintReport["byRule"];

package/dist/core/index.js

@@ -2,7 +2,7 @@ import {
   filterToDrift,
   formatDriftBanner,
   runHealthcheck
-} from "../chunk-2EELGTLX.js";
+} from "../chunk-D5QLNNA4.js";
 import {
   FrontmatterManager,
   INDEX_FILE,
@@ -18,38 +18,43 @@ import {
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract
-} from "../chunk-CSXZ7QUU.js";
+} from "../chunk-ROKSUJFM.js";
 import {
   formatLintReport,
   lintVault
-} from "../chunk-FM26NFTR.js";
-import "../chunk-NTYYS53O.js";
-import "../chunk-A3KYHKB5.js";
-import "../chunk-WSU4QIPB.js";
+} from "../chunk-OFXQXVG5.js";
+import "../chunk-5ZKNO6ZD.js";
+import "../chunk-NBY4TRP7.js";
+import "../chunk-FTRXH2WC.js";
+import "../chunk-XAXK7NM4.js";
 import {
   SessionManager,
   deriveProjectRoot,
   deriveSessionDir
-} from "../chunk-S4KW7VH4.js";
+} from "../chunk-LGQPP5FQ.js";
 import {
   Embedder,
   GraphBuilder,
   TextSearch,
   VectorIndex
-} from "../chunk-25EIQWXL.js";
+} from "../chunk-44BQDRXD.js";
 import {
   Indexer
-} from "../chunk-V45NJIHI.js";
+} from "../chunk-IGHCVAAL.js";
 import {
   logEvent,
   logQuery
-} from "../chunk-JPQHNG3R.js";
+} from "../chunk-SX427M2R.js";
+import {
+  REDACTED,
+  redact,
+  redactDeep
+} from "../chunk-OEF5U5GV.js";
 import {
   installDefaultSchema,
   loadSchema,
   validateNote
-} from "../chunk-OWZWMB4P.js";
-import "../chunk-5ZKNO6ZD.js";
+} from "../chunk-FURCIJBO.js";
 import "../chunk-PZ5AY32C.js";
 export {
   Embedder,
@@ -59,6 +64,7 @@ export {
   INDEX_OVERFLOW_THRESHOLD,
   Indexer,
   NoteCrud,
+  REDACTED,
   SessionManager,
   TagManager,
   TextSearch,
@@ -79,6 +85,8 @@ export {
   loadSchema,
   logEvent,
   logQuery,
+  redact,
+  redactDeep,
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract,

package/dist/core/redact.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Secret redaction for everything semantic-memory writes to disk. Ported from jev-loop's
+ * redact.py: (1) exact values of secret-named env vars on this machine, (2) patterns.
+ *
+ * Two pattern sets:
+ * - "precise" (notes, frontmatter, dossiers, profile, lexicon): only shapes that are almost
+ *   never ordinary content, because a false positive in a note is data loss.
+ * - "broad" (search log, log.md events, session state, capture-pending): precise plus long
+ *   base64 / letter-and-digit tokens; over-redaction is fine in logs.
+ *
+ * Cannot catch a secret written in plain prose ("the password is hunter2"). Never logs values.
+ */
+declare const REDACTED = "[REDACTED]";
+type RedactMode = "precise" | "broad";
+interface RedactResult {
+    text: string;
+    count: number;
+}
+/** Test seam: re-read env and settings on the next call. */
+declare function resetRedactCache(): void;
+declare function redact(text: string, mode?: RedactMode): RedactResult;
+interface SecretLocation {
+    line: number;
+    kind: string;
+}
+/** Where precise-set secrets sit in a text (for lint_vault): 1-based line and kind, never the value. */
+declare function findSecrets(text: string): SecretLocation[];
+/** Redact every string inside a JSON-like value (for log payloads and state files). */
+declare function redactDeep<T>(value: T, mode?: RedactMode): {
+    value: T;
+    count: number;
+};
+/** Suffix for a tool result: says how many secrets were masked, never which. "" when none. */
+declare function redactedNote(count: number): string;
+
+export { REDACTED, type RedactMode, type RedactResult, type SecretLocation, findSecrets, redact, redactDeep, redactedNote, resetRedactCache };

package/dist/core/redact.js

@@ -0,0 +1,18 @@
+import {
+  REDACTED,
+  findSecrets,
+  redact,
+  redactDeep,
+  redactedNote,
+  resetRedactCache
+} from "../chunk-OEF5U5GV.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  REDACTED,
+  findSecrets,
+  redact,
+  redactDeep,
+  redactedNote,
+  resetRedactCache
+};
+//# sourceMappingURL=redact.js.map

package/dist/{dossier-2UG724LB.js → dossier-RWTIMGZN.js}

@@ -15,8 +15,9 @@ import {
   resolveDossierPath,
   setCurrentState,
   slugifyEntity
-} from "./chunk-WSU4QIPB.js";
-import "./chunk-S4KW7VH4.js";
+} from "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DOSSIER_DIR,
@@ -36,4 +37,4 @@ export {
   setCurrentState,
   slugifyEntity
 };
-//# sourceMappingURL=dossier-2UG724LB.js.map
+//# sourceMappingURL=dossier-RWTIMGZN.js.map

package/dist/healthcheck-A32IWPNV.js

@@ -0,0 +1,20 @@
+import {
+  filterToDrift,
+  formatDriftBanner,
+  runHealthcheck
+} from "./chunk-D5QLNNA4.js";
+import "./chunk-OFXQXVG5.js";
+import "./chunk-5ZKNO6ZD.js";
+import "./chunk-NBY4TRP7.js";
+import "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-FURCIJBO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  filterToDrift,
+  formatDriftBanner,
+  runHealthcheck
+};
+//# sourceMappingURL=healthcheck-A32IWPNV.js.map

package/dist/indexer-RAKJ7JR3.js

@@ -0,0 +1,8 @@
+import {
+  Indexer
+} from "./chunk-IGHCVAAL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  Indexer
+};
+//# sourceMappingURL=indexer-RAKJ7JR3.js.map

package/dist/{lexicon-5PXQEMUF.js → lexicon-IVNJTMWE.js}

@@ -8,9 +8,10 @@ import {
   normalizePhrase,
   removeAlias,
   slugify
-} from "./chunk-A3KYHKB5.js";
-import "./chunk-WSU4QIPB.js";
-import "./chunk-S4KW7VH4.js";
+} from "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   addAlias,
@@ -23,4 +24,4 @@ export {
   removeAlias,
   slugify
 };
-//# sourceMappingURL=lexicon-5PXQEMUF.js.map
+//# sourceMappingURL=lexicon-IVNJTMWE.js.map

package/dist/lint-HURYGO3V.js

@@ -0,0 +1,17 @@
+import {
+  formatLintReport,
+  lintVault
+} from "./chunk-OFXQXVG5.js";
+import "./chunk-5ZKNO6ZD.js";
+import "./chunk-NBY4TRP7.js";
+import "./chunk-FTRXH2WC.js";
+import "./chunk-XAXK7NM4.js";
+import "./chunk-LGQPP5FQ.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-FURCIJBO.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  formatLintReport,
+  lintVault
+};
+//# sourceMappingURL=lint-HURYGO3V.js.map

package/dist/log-YIXF6CYM.js

@@ -0,0 +1,11 @@
+import {
+  logEvent,
+  logQuery
+} from "./chunk-SX427M2R.js";
+import "./chunk-OEF5U5GV.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  logEvent,
+  logQuery
+};
+//# sourceMappingURL=log-YIXF6CYM.js.map

package/dist/mcp/server.js

@@ -3,7 +3,7 @@ import {
   initSpeakerProfile,
   readSpeakerProfile,
   updateProfileSection
-} from "../chunk-7M3JZOYH.js";
+} from "../chunk-WZEKIUYG.js";
 import {
   FrontmatterManager,
   NoteCrud,
@@ -17,23 +17,28 @@ import {
   regenDirectoryIndex,
   regenIndexesForPaths,
   regenerateAgentsContract
-} from "../chunk-CSXZ7QUU.js";
+} from "../chunk-ROKSUJFM.js";
 import {
   lintVault
-} from "../chunk-FM26NFTR.js";
+} from "../chunk-OFXQXVG5.js";
+import {
+  computeDecay,
+  loadDecayConfig,
+  normalizeVerifiedDate
+} from "../chunk-5ZKNO6ZD.js";
 import {
   appendEvent,
   readSelectionLog,
   recordSearchForCorrelation,
   wasRecentlySearched
-} from "../chunk-NTYYS53O.js";
+} from "../chunk-NBY4TRP7.js";
 import {
   addAlias,
   compileLexicon,
   expandQuery,
   loadLexiconCache,
   removeAlias
-} from "../chunk-A3KYHKB5.js";
+} from "../chunk-FTRXH2WC.js";
 import {
   appendIncident,
   compileDossiers,
@@ -42,33 +47,31 @@ import {
   listDossiers,
   resolveDossierPath,
   setCurrentState
-} from "../chunk-WSU4QIPB.js";
+} from "../chunk-XAXK7NM4.js";
 import {
   SessionManager,
   deriveProjectRoot,
   deriveSessionDir
-} from "../chunk-S4KW7VH4.js";
+} from "../chunk-LGQPP5FQ.js";
 import {
   Embedder,
   GraphBuilder,
   TextSearch,
   VectorIndex
-} from "../chunk-25EIQWXL.js";
+} from "../chunk-44BQDRXD.js";
 import {
   Indexer
-} from "../chunk-V45NJIHI.js";
+} from "../chunk-IGHCVAAL.js";
 import {
   logEvent,
   logQuery
-} from "../chunk-JPQHNG3R.js";
+} from "../chunk-SX427M2R.js";
 import {
-  installDefaultSchema
-} from "../chunk-OWZWMB4P.js";
+  redactedNote
+} from "../chunk-OEF5U5GV.js";
 import {
-  computeDecay,
-  loadDecayConfig,
-  normalizeVerifiedDate
-} from "../chunk-5ZKNO6ZD.js";
+  installDefaultSchema
+} from "../chunk-FURCIJBO.js";
 import {
   __export
 } from "../chunk-PZ5AY32C.js";
@@ -4692,8 +4695,8 @@ function registerWriteTools(server, ctx) {
       frontmatter: external_exports.record(external_exports.unknown()).optional()
     },
     async ({ path, content, frontmatter }) => {
-      await ctx.crud.create(path, content, frontmatter);
-      return ctx.textResponse(`Created: ${path}`);
+      const { redacted } = await ctx.crud.create(path, content, frontmatter);
+      return ctx.textResponse(`Created: ${path}${redactedNote(redacted)}`);
     }
   );
   server.tool(
@@ -4706,8 +4709,8 @@ function registerWriteTools(server, ctx) {
       heading: external_exports.string().optional()
     },
     async ({ path, content, mode, heading }) => {
-      await ctx.crud.update(path, content, { mode, heading });
-      return ctx.textResponse(`Updated: ${path} (${mode})`);
+      const { redacted } = await ctx.crud.update(path, content, { mode, heading });
+      return ctx.textResponse(`Updated: ${path} (${mode})${redactedNote(redacted)}`);
     }
   );
   server.tool(
@@ -5198,7 +5201,8 @@ var RULE_KEY_FOR_CHECK = {
   code_symbols: "code_symbols",
   decay_candidates: "decay_candidates",
   alias_conflicts: "alias_conflicts",
-  decoys: "decoys"
+  decoys: "decoys",
+  secrets: "secrets"
 };
 function registerLintTools(server, ctx) {
   server.tool(
@@ -5239,10 +5243,10 @@ function registerLintTools(server, ctx) {
   );
   server.tool(
     "lint_vault",
-    "Run lint rules across the vault. Default returns the full LintReport with all findings grouped by rule. Pass `checks` to filter to specific rules (schema, provenance, stale, broken_links, code_symbols, decay_candidates) \u2014 when filtered, byRule contains only the requested rules. Two checks are opt-in only (never in the default report): `code_symbols` flags inline-code file-path references that no longer exist under the project root (no-op outside a code repo); `decay_candidates` cross-references the selection log against current decay to surface frequently-retrieved-but-decayed notes (no-op with no selection log). `decoys` flags notes retrieved 3+ times but never cited - surfaced for review, never auto-down-ranked (v1.5 Q5).",
+    "Run lint rules across the vault. Default returns the full LintReport with all findings grouped by rule. Pass `checks` to filter to specific rules (schema, provenance, stale, broken_links, code_symbols, decay_candidates) \u2014 when filtered, byRule contains only the requested rules. Two checks are opt-in only (never in the default report): `code_symbols` flags inline-code file-path references that no longer exist under the project root (no-op outside a code repo); `decay_candidates` cross-references the selection log against current decay to surface frequently-retrieved-but-decayed notes (no-op with no selection log). `decoys` flags notes retrieved 3+ times but never cited - surfaced for review, never auto-down-ranked (v1.5 Q5). `secrets` flags notes containing an API key, token, password or private key (path, line, kind \u2014 never the value; nothing is rewritten): rotate the secret, then remove it.",
     {
       pathGlob: external_exports.string().optional(),
-      checks: external_exports.array(external_exports.enum(["schema", "provenance", "stale", "broken_links", "code_symbols", "decay_candidates", "alias_conflicts", "decoys"])).optional().describe("Filter to specific lint rules. Omit for full report (excludes the opt-in code_symbols / decay_candidates / alias_conflicts / decoys).")
+      checks: external_exports.array(external_exports.enum(["schema", "provenance", "stale", "broken_links", "code_symbols", "decay_candidates", "alias_conflicts", "decoys", "secrets"])).optional().describe("Filter to specific lint rules. Omit for full report (excludes the opt-in code_symbols / decay_candidates / alias_conflicts / decoys / secrets).")
     },
     async ({ pathGlob, checks }) => {
       const report = await lintVault(ctx.notesPath, {
@@ -5250,7 +5254,8 @@ function registerLintTools(server, ctx) {
         checkCodeSymbols: !!checks?.includes("code_symbols"),
         checkDecayCandidates: !!checks?.includes("decay_candidates"),
         checkAliasConflicts: !!checks?.includes("alias_conflicts"),
-        checkDecoys: !!checks?.includes("decoys")
+        checkDecoys: !!checks?.includes("decoys"),
+        checkSecrets: !!checks?.includes("secrets")
       });
       if (!checks || checks.length === 0) {
         return ctx.textResponse(JSON.stringify(report, null, 2));
@@ -5349,8 +5354,8 @@ function registerMetadataTools(server, ctx) {
     "Set or delete YAML frontmatter keys \u2014 pass null to delete a key",
     { path: external_exports.string(), fields: external_exports.record(external_exports.unknown()) },
     async ({ path, fields }) => {
-      await ctx.frontmatterManager.update(path, fields);
-      return ctx.textResponse(`Frontmatter updated: ${path}`);
+      const { redacted } = await ctx.frontmatterManager.update(path, fields);
+      return ctx.textResponse(`Frontmatter updated: ${path}${redactedNote(redacted)}`);
     }
   );
   server.tool(
@@ -5771,7 +5776,7 @@ async function createServer(notesPath, options = {}) {
     await ctx.fullIndex();
   } else {
     ctx.tryLoadCachedIndex().then((cached) => {
-      if (!cached) ctx.backgroundIndex();
+      if (!cached || ctx.getIndexState() === "stale") ctx.backgroundIndex();
     }).catch((err) => {
       process.stderr.write(`Startup error: ${err?.message ?? err}
 `);