@vib795/agent-memory 0.5.0 → 0.5.2

package/HOWTO.md

@@ -304,7 +304,7 @@ Everything is in one folder:
   memory/notes/     your notes, as plain markdown files
 ```
 
-Three things worth knowing:
+Five things worth knowing:
 
 **Nothing leaves your machine.** No server, no account, no telemetry, no background
 process, nothing to get approved by IT. It is a small program that writes text files.
@@ -322,6 +322,13 @@ nothing to be locked into.
 **Nothing is ever deleted.** Notes that get replaced or go stale move to an `archive`
 folder rather than disappearing.
 
+**Sharing is a separate decision.** If you export your notes to hand to a colleague,
+personal details — phone numbers, card numbers, national IDs, email addresses — are
+stripped on the way out, and the file tells you what was removed. A note that is
+mostly contact details is left out of the file entirely rather than shipped with holes
+in it. Names and addresses written in ordinary prose are not something a pattern can
+find, so ask your assistant to read the file over before you send it.
+
 ---
 
 ## 11. When something is wrong

package/README.md

@@ -207,6 +207,33 @@ name on it. What this is not: it is not encryption, access control, or a DLP pro
 It is one command that refuses to hand over identifiers, and it says exactly what it
 checked.
 
+### Independently scanned
+
+Public supply-chain scanners index every package published to npm, so this one is
+reviewed by people who owe it nothing. That is worth more than a clean claim from its
+author.
+
+[LPM Firewall](https://firewall.lpm.dev/npm/@vib795/agent-memory) currently reports
+**Passed — safe to install**, with no policy match and no flagged code. Its reading of
+the artefact — signed, provenance attached, zero dependencies, no install hooks — is a
+third-party check on what this README says about itself. Four low-signal patterns
+remain, and they are descriptive rather than policy: environment variables, scripts
+present, filesystem, high-entropy strings. That is what a CLI which reads
+`AGENT_MEMORY_HOME` and writes files in your home directory looks like from outside.
+
+**It did not start there.** Version 0.3.1 was flagged **Critical — AI Agent Control
+Hijack**, because `postinstall` wrote skill files into `~/.claude`, `~/.codex` and your
+editor's prompt folder. The finding was correct. An install script that grants an AI
+agent new instructions without the user asking is indistinguishable from an attack
+that does exactly that, and good intent is not observable to a scanner. The hook was
+removed in 0.4.0 rather than argued with, which is why `agent-memory setup` is a
+command you type.
+
+The 0.3.1 report is still public and still says Critical. Old version pages do not
+come down, and they should not: a supply-chain record that could be edited after the
+fact would be worth nothing. What a project can offer is the next version and the
+reason for it.
+
 ## Engagements
 
 If you work for more than one client on one machine, knowledge from one of them is
@@ -472,7 +499,7 @@ is generated state, and the committed value is only a placeholder.
 
 Needs Node 22.5 or newer; `doctor` says so plainly if the version is too old.
 
-Run `npm test` for the suite (87 tests, no dependencies). CI runs it on Linux,
+Run `npm test` for the suite (88 tests, no dependencies). CI runs it on Linux,
 macOS and Windows across Node 22 and 24, and separately installs the packed tarball
 and exercises it end to end on all three.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vib795/agent-memory",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Durable cross-repo knowledge graph for GitHub Copilot and Claude Code. Markdown source of truth, disposable SQLite index, zero runtime dependencies.",
   "keywords": [
     "github-copilot",

package/src/pii.js

@@ -228,10 +228,15 @@ export function buildReceipt(results, { scanned }) {
   const counts = new Map();
   const withheld = [];
   for (const r of results) {
-    for (const f of r.findings) counts.set(f.kind, (counts.get(f.kind) || 0) + f.count);
     if (r.withheld) {
+      // Counted under `withheld`, not under `redacted`. Nothing in a withheld note
+      // was redacted, because the note is not in the file; folding its findings into
+      // the redaction totals would overstate what the reader is holding, and a
+      // governance artifact that overstates is worth less than none.
       withheld.push({ id: r.id, reason: r.reason, kinds: r.findings.map((f) => f.kind) });
+      continue;
     }
+    for (const f of r.findings) counts.set(f.kind, (counts.get(f.kind) || 0) + f.count);
   }
   const redactions = [...counts.entries()]
     .map(([kind, count]) => ({ kind, count }))