@xdarkicex/openclaw-memory-libravdb 1.6.9 → 1.6.11

package/dist/dream-promotion.d.ts

@@ -42,4 +42,5 @@ export declare function promoteDreamDiaryFile(client: LibravDBClient, opts: {
     sourceMtimeMs?: number;
 }): Promise<DreamPromotionResult>;
 export declare function parseDreamPromotionCandidates(text: string): DreamPromotionCandidate[];
+export declare function normalizeDiaryPath(value?: string): string;
 export {};

package/dist/dream-promotion.js

@@ -357,18 +357,23 @@ function parseInteger(value) {
 function normalizeSectionName(value) {
     return value.trim().toLowerCase().replace(/\s+/g, " ");
 }
-function normalizeDiaryPath(value) {
+export function normalizeDiaryPath(value) {
     const trimmed = value?.trim();
     if (!trimmed) {
         return "";
     }
+    // Expand ~ to home directory before resolving. path.resolve does not
+    // expand tilde, so "~/dreams.md" would resolve to "<cwd>/~/dreams.md".
+    const expanded = trimmed.startsWith("~")
+        ? path.join(os.homedir(), trimmed.slice(1))
+        : trimmed;
     // Reject traversal components — even though path.resolve collapses them,
     // their presence signals an attempt to escape intended boundaries.
-    const segments = trimmed.split(/[/\\]+/);
+    const segments = expanded.split(/[/\\]+/);
     if (segments.some((s) => s === "..")) {
         throw new Error(`dream diary path must not contain ".." traversal: ${trimmed}`);
     }
-    const resolved = path.resolve(trimmed);
+    const resolved = path.resolve(expanded);
     // Restrict to known-safe locations to prevent arbitrary file reads.
     // Allowed roots: home directory and the configured OpenClaw state dir.
     const allowedRoots = [

package/dist/index.js

@@ -24949,6 +24949,7 @@ function registerMemoryCliMetadata(api) {
 var SESSION_KEY_NAMESPACE_PREFIX = "session-key:";
 var AGENT_ID_NAMESPACE_PREFIX = "agent-id:";
 var USER_COLLECTION_PREFIX = "user:";
+var RESERVED_NAMESPACE_PREFIXES = [SESSION_KEY_NAMESPACE_PREFIX, AGENT_ID_NAMESPACE_PREFIX, USER_COLLECTION_PREFIX];
 var COLLECTION_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_.:@#-]{0,127}$/;
 function validateNamespace(name) {
   if (!COLLECTION_NAME_RE.test(name)) {
@@ -24960,7 +24961,16 @@ function validateNamespace(name) {
 }
 function resolveDurableNamespace(params) {
   const explicitUserId = firstNonEmpty(params.userId);
-  if (explicitUserId) return validateNamespace(explicitUserId);
+  if (explicitUserId) {
+    for (const prefix of RESERVED_NAMESPACE_PREFIXES) {
+      if (explicitUserId.startsWith(prefix)) {
+        throw new Error(
+          `Invalid userId "${explicitUserId}": must not start with reserved prefix "${prefix}"`
+        );
+      }
+    }
+    return validateNamespace(explicitUserId);
+  }
   const sessionKey = firstNonEmpty(params.sessionKey);
   if (sessionKey) return validateNamespace(`${SESSION_KEY_NAMESPACE_PREFIX}${sessionKey}`);
   const agentId = firstNonEmpty(params.agentId);
@@ -25674,13 +25684,14 @@ function normalizeDiaryPath(value) {
   if (!trimmed) {
     return "";
   }
-  const segments = trimmed.split(/[/\\]+/);
+  const expanded = trimmed.startsWith("~") ? path.join(os.homedir(), trimmed.slice(1)) : trimmed;
+  const segments = expanded.split(/[/\\]+/);
   if (segments.some((s) => s === "..")) {
     throw new Error(
       `dream diary path must not contain ".." traversal: ${trimmed}`
     );
   }
-  const resolved = path.resolve(trimmed);
+  const resolved = path.resolve(expanded);
   const allowedRoots = [
     os.homedir(),
     process.env.OPENCLAW_STATE_DIR
@@ -36786,14 +36797,15 @@ function extractHost(target) {
   const sep = withoutDns.lastIndexOf(":");
   return sep > 0 ? withoutDns.slice(0, sep) : withoutDns;
 }
-function loadSecretFromEnv() {
+function loadSecretFromEnv(logger) {
   const secret = process.env.LIBRAVDB_AUTH_SECRET?.trim();
   if (secret) return secret;
   const secretPath = process.env.LIBRAVDB_AUTH_SECRET_FILE;
   if (secretPath) {
     try {
       return fs3.readFileSync(secretPath, "utf8").trim() || void 0;
-    } catch {
+    } catch (error2) {
+      logger?.warn?.(`LibraVDB: failed to read auth secret file "${secretPath}": ${formatError(error2)}`);
       return void 0;
     }
   }

package/dist/libravdb-client.d.ts

@@ -1,5 +1,6 @@
 import type { Interceptor } from "@connectrpc/connect";
 import type { PartialMessage } from "@bufbuild/protobuf";
+import type { LoggerLike } from "./types.js";
 import type { AfterTurnKernelRequest, AfterTurnKernelResponse, AssembleContextInternalRequest, AssembleContextInternalResponse, BootstrapSessionKernelRequest, BootstrapSessionKernelResponse, CompactSessionRequest, CompactSessionResponse, DeleteAuthoredDocumentRequest, DeleteAuthoredDocumentResponse, DreamPromotionResponse, ExportMemoryRequest, ExportMemoryResponse, FlushNamespaceRequest, FlushNamespaceResponse, FlushRequest, FlushResponse, HealthRequest, HealthResponse, IngestMarkdownDocumentRequest, IngestMarkdownDocumentResponse, IngestMessageKernelRequest, IngestMessageKernelResponse, ListCollectionRequest, ListCollectionResponse, ListLifecycleJournalRequest, ListLifecycleJournalResponse, MarkMemorySupersededRequest, MarkMemorySupersededResponse, MemoryStatusRequest, MemoryStatusResponse, PromoteDreamEntriesRequest, RankCandidatesRequest, RankCandidatesResponse, RebuildIndexRequest, RebuildIndexResponse, ReindexAuthoredDocumentRequest, ReindexAuthoredDocumentResponse, SearchTextCollectionsRequest, SearchTextRequest, SearchTextResponse, SessionLifecycleHintRequest, SessionLifecycleHintResponse } from "@xdarkicex/libravdb-contracts";
 export interface LibravDBClientOptions {
     endpoint?: string;
@@ -56,5 +57,5 @@ export declare class LibravDBClient {
     rankCandidates(req: PartialMessage<RankCandidatesRequest>): Promise<RankCandidatesResponse>;
     close(): void;
 }
-export declare function loadSecretFromEnv(): string | undefined;
+export declare function loadSecretFromEnv(logger?: LoggerLike): string | undefined;
 export {};

package/dist/libravdb-client.js

@@ -3,6 +3,7 @@ import { createGrpcTransport } from "@connectrpc/connect-node";
 import { LibravDB } from "@xdarkicex/libravdb-contracts/client";
 import { createHmac } from "node:crypto";
 import fs from "node:fs";
+import { formatError } from "./format-error.js";
 import net from "node:net";
 import os from "node:os";
 import path from "node:path";
@@ -279,7 +280,7 @@ function extractHost(target) {
     const sep = withoutDns.lastIndexOf(":");
     return sep > 0 ? withoutDns.slice(0, sep) : withoutDns;
 }
-export function loadSecretFromEnv() {
+export function loadSecretFromEnv(logger) {
     const secret = process.env.LIBRAVDB_AUTH_SECRET?.trim();
     if (secret)
         return secret;
@@ -288,7 +289,8 @@ export function loadSecretFromEnv() {
         try {
             return fs.readFileSync(secretPath, "utf8").trim() || undefined;
         }
-        catch {
+        catch (error) {
+            logger?.warn?.(`LibraVDB: failed to read auth secret file "${secretPath}": ${formatError(error)}`);
             return undefined;
         }
     }

package/dist/memory-scopes.js

@@ -1,6 +1,9 @@
 const SESSION_KEY_NAMESPACE_PREFIX = "session-key:";
 const AGENT_ID_NAMESPACE_PREFIX = "agent-id:";
 const USER_COLLECTION_PREFIX = "user:";
+/** Reserved prefixes that must not appear in an explicit userId,
+ *  to prevent namespace collision with auto-derived namespaces. */
+const RESERVED_NAMESPACE_PREFIXES = [SESSION_KEY_NAMESPACE_PREFIX, AGENT_ID_NAMESPACE_PREFIX, USER_COLLECTION_PREFIX];
 /** Valid collection names: alphanumeric, underscores, hyphens, dots, colons, at-signs, hashes.
  *  Must start with a letter. Max 128 characters. */
 const COLLECTION_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_.:@#-]{0,127}$/;
@@ -14,8 +17,14 @@ export function validateNamespace(name) {
 }
 export function resolveDurableNamespace(params) {
     const explicitUserId = firstNonEmpty(params.userId);
-    if (explicitUserId)
+    if (explicitUserId) {
+        for (const prefix of RESERVED_NAMESPACE_PREFIXES) {
+            if (explicitUserId.startsWith(prefix)) {
+                throw new Error(`Invalid userId "${explicitUserId}": must not start with reserved prefix "${prefix}"`);
+            }
+        }
         return validateNamespace(explicitUserId);
+    }
     const sessionKey = firstNonEmpty(params.sessionKey);
     if (sessionKey)
         return validateNamespace(`${SESSION_KEY_NAMESPACE_PREFIX}${sessionKey}`);

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "libravdb-memory",
   "name": "LibraVDB Memory",
   "description": "Persistent vector memory with three-tier hybrid scoring",
-  "version": "1.6.9",
+  "version": "1.6.11",
   "kind": [
     "memory",
     "context-engine"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xdarkicex/openclaw-memory-libravdb",
-  "version": "1.6.9",
+  "version": "1.6.11",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",