@yamo/memory-mesh 3.2.5 → 3.2.6

package/lib/memory/memory-mesh.d.ts

@@ -225,6 +225,12 @@ export declare class MemoryMesh {
         reliability: any;
         use_count: any;
     }>;
+    /**
+     * Get a single synthesized skill by ID
+     * @param {string} id - Skill ID
+     * @returns {Promise<Object|null>} Skill data or null if not found
+     */
+    getSkill(id: any): Promise<any>;
     /**
      * Prune skills
      */

package/lib/memory/memory-mesh.js

@@ -616,12 +616,30 @@ export class MemoryMesh {
         await this.init();
         const topic = options.topic || "general_improvement";
         const enrichedPrompt = options.enrichedPrompt || topic; // PHASE 4: Use enriched prompt
+        const mode = options.mode || "create";
+        const targetSkillId = options.targetSkillId;
         // const lookback = options.lookback || 20;
-        logger.info({ topic, enrichedPrompt }, "Synthesizing logic");
+        logger.info({ topic, mode, targetSkillId }, "Synthesizing logic");
         // OPTIMIZATION: If we have an execution engine (kernel), use SkillCreator!
         if (this._kernel_execute) {
             logger.info("Dispatching to SkillCreator agent...");
             try {
+                // Fetch target skill content if refactoring
+                let targetContent = "";
+                let targetPath = "";
+                if (mode === "refactor" && targetSkillId) {
+                    const skill = await this.getSkill(targetSkillId);
+                    if (skill) {
+                        targetPath = skill.metadata?.source_file || "";
+                        if (targetPath && fs.existsSync(targetPath)) {
+                            targetContent = fs.readFileSync(targetPath, "utf8");
+                        }
+                        else {
+                            // Fallback to DB content if file missing
+                            targetContent = skill.yamo_text || "";
+                        }
+                    }
+                }
                 // Use stored skill directories
                 const skillDirs = this.skillDirectories;
                 // Track existing .yamo files before SkillCreator runs
@@ -652,7 +670,11 @@ export class MemoryMesh {
                     }
                 }
                 // PHASE 4: Use enriched prompt for SkillCreator
-                await this._kernel_execute(`SkillCreator: design a new skill to handle ${enrichedPrompt}`, {
+                let prompt = `SkillCreator: design a new skill to handle ${enrichedPrompt}`;
+                if (mode === "refactor" && targetContent) {
+                    prompt = `SkillCreator: REFACTOR and FIX the following skill. It failed with the following context: ${enrichedPrompt}.\n\nEXISTING SKILL CONTENT:\n${targetContent}`;
+                }
+                await this._kernel_execute(prompt, {
                     v1_1_enabled: true,
                 });
                 // Find newly created .yamo file
@@ -813,6 +835,37 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             throw new Error(`Failed to update skill reliability: ${error.message}`);
         }
     }
+    /**
+     * Get a single synthesized skill by ID
+     * @param {string} id - Skill ID
+     * @returns {Promise<Object|null>} Skill data or null if not found
+     */
+    async getSkill(id) {
+        await this.init();
+        if (!this.skillTable) {
+            return null;
+        }
+        try {
+            const results = await this.skillTable
+                .query()
+                .filter(`id == '${id}'`)
+                .toArray();
+            if (results.length === 0) {
+                return null;
+            }
+            const record = results[0];
+            return {
+                ...record,
+                metadata: typeof record.metadata === "string"
+                    ? JSON.parse(record.metadata)
+                    : record.metadata,
+            };
+        }
+        catch (error) {
+            logger.warn({ err: error, id }, "Failed to get skill");
+            return null;
+        }
+    }
     /**
      * Prune skills
      */
@@ -1366,7 +1419,7 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             `agent: MemoryMesh_${this.agentId};`,
             `intent: distill_wisdom_from_execution;`,
             `context:`,
-            `  original_context;${situation.replace(/;/g, ",")};`,
+            `  original_context;${situation.replace(/;/g, "%3B")};`,
             `  error_pattern;${patternId};`,
             `  severity;${severity};`,
             `  timestamp;${timestamp};`,
@@ -1376,13 +1429,13 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             `priority: high;`,
             `output:`,
             `  lesson_id;${lessonId};`,
-            `  oversight_description;${oversight.replace(/;/g, ",")};`,
-            `  preventative_rule;${preventativeRule.replace(/;/g, ",")};`,
+            `  oversight_description;${oversight.replace(/;/g, "%3B")};`,
+            `  preventative_rule;${preventativeRule.replace(/;/g, "%3B")};`,
             `  rule_confidence;${confidence};`,
             `meta:`,
-            `  rationale;${fix.replace(/;/g, ",")};`,
-            `  applicability_scope;${applicableScope.replace(/;/g, ",")};`,
-            `  inverse_lesson;${inverseLesson.replace(/;/g, ",")};`,
+            `  rationale;${fix.replace(/;/g, "%3B")};`,
+            `  applicability_scope;${applicableScope.replace(/;/g, "%3B")};`,
+            `  inverse_lesson;${inverseLesson.replace(/;/g, "%3B")};`,
             `  confidence;${confidence};`,
             `log: lesson_learned;timestamp;${timestamp};pattern;${patternId};severity;${severity};id;${lessonId};`,
             `handoff: SubconsciousReflector;`,

package/lib/memory/memory-mesh.ts

@@ -648,12 +648,32 @@ export class MemoryMesh {
         await this.init();
         const topic = options.topic || "general_improvement";
         const enrichedPrompt = options.enrichedPrompt || topic; // PHASE 4: Use enriched prompt
+        const mode = options.mode || "create";
+        const targetSkillId = options.targetSkillId;
+
         // const lookback = options.lookback || 20;
-        logger.info({ topic, enrichedPrompt }, "Synthesizing logic");
+        logger.info({ topic, mode, targetSkillId }, "Synthesizing logic");
+
         // OPTIMIZATION: If we have an execution engine (kernel), use SkillCreator!
         if (this._kernel_execute) {
             logger.info("Dispatching to SkillCreator agent...");
             try {
+                // Fetch target skill content if refactoring
+                let targetContent = "";
+                let targetPath = "";
+                if (mode === "refactor" && targetSkillId) {
+                    const skill = await this.getSkill(targetSkillId);
+                    if (skill) {
+                        targetPath = skill.metadata?.source_file || "";
+                        if (targetPath && fs.existsSync(targetPath)) {
+                            targetContent = fs.readFileSync(targetPath, "utf8");
+                        } else {
+                            // Fallback to DB content if file missing
+                            targetContent = skill.yamo_text || "";
+                        }
+                    }
+                }
+
                 // Use stored skill directories
                 const skillDirs = this.skillDirectories;
                 // Track existing .yamo files before SkillCreator runs
@@ -683,8 +703,14 @@ export class MemoryMesh {
                         walk(dir);
                     }
                 }
+
                 // PHASE 4: Use enriched prompt for SkillCreator
-                await this._kernel_execute(`SkillCreator: design a new skill to handle ${enrichedPrompt}`, {
+                let prompt = `SkillCreator: design a new skill to handle ${enrichedPrompt}`;
+                if (mode === "refactor" && targetContent) {
+                    prompt = `SkillCreator: REFACTOR and FIX the following skill. It failed with the following context: ${enrichedPrompt}.\n\nEXISTING SKILL CONTENT:\n${targetContent}`;
+                }
+
+                await this._kernel_execute(prompt, {
                     v1_1_enabled: true,
                 });
                 // Find newly created .yamo file
@@ -845,6 +871,37 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             throw new Error(`Failed to update skill reliability: ${error.message}`);
         }
     }
+    /**
+     * Get a single synthesized skill by ID
+     * @param {string} id - Skill ID
+     * @returns {Promise<Object|null>} Skill data or null if not found
+     */
+    async getSkill(id) {
+        await this.init();
+        if (!this.skillTable) {
+            return null;
+        }
+        try {
+            const results = await this.skillTable
+                .query()
+                .filter(`id == '${id}'`)
+                .toArray();
+            if (results.length === 0) {
+                return null;
+            }
+            const record = results[0];
+            return {
+                ...record,
+                metadata: typeof record.metadata === "string"
+                    ? JSON.parse(record.metadata)
+                    : record.metadata,
+            };
+        }
+        catch (error) {
+            logger.warn({ err: error, id }, "Failed to get skill");
+            return null;
+        }
+    }
     /**
      * Prune skills
      */
@@ -1418,7 +1475,7 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             `agent: MemoryMesh_${this.agentId};`,
             `intent: distill_wisdom_from_execution;`,
             `context:`,
-            `  original_context;${situation.replace(/;/g, ",")};`,
+            `  original_context;${situation.replace(/;/g, "%3B")};`,
             `  error_pattern;${patternId};`,
             `  severity;${severity};`,
             `  timestamp;${timestamp};`,
@@ -1428,13 +1485,13 @@ description: Auto-generated skill to handle: ${enrichedPrompt || topic}
             `priority: high;`,
             `output:`,
             `  lesson_id;${lessonId};`,
-            `  oversight_description;${oversight.replace(/;/g, ",")};`,
-            `  preventative_rule;${preventativeRule.replace(/;/g, ",")};`,
+            `  oversight_description;${oversight.replace(/;/g, "%3B")};`,
+            `  preventative_rule;${preventativeRule.replace(/;/g, "%3B")};`,
             `  rule_confidence;${confidence};`,
             `meta:`,
-            `  rationale;${fix.replace(/;/g, ",")};`,
-            `  applicability_scope;${applicableScope.replace(/;/g, ",")};`,
-            `  inverse_lesson;${inverseLesson.replace(/;/g, ",")};`,
+            `  rationale;${fix.replace(/;/g, "%3B")};`,
+            `  applicability_scope;${applicableScope.replace(/;/g, "%3B")};`,
+            `  inverse_lesson;${inverseLesson.replace(/;/g, "%3B")};`,
             `  confidence;${confidence};`,
             `log: lesson_learned;timestamp;${timestamp};pattern;${patternId};severity;${severity};id;${lessonId};`,
             `handoff: SubconsciousReflector;`,

package/lib/utils/prompt-security.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Prompt Security Utilities — RFC-0010-A
+ *
+ * Shared sanitisation functions for all LLM prompt construction.
+ *
+ * Rule (RFC-0010-A §5): Any string originating from user input, memory retrieval,
+ * or execution logs that is interpolated into an LLM prompt MUST pass through
+ * sanitizePromptField() before interpolation.
+ *
+ * Audit sweep (2026-03-14):
+ *   - lib/memory/memory-mesh.ts   — HyDE query expansion uses `scrubbed` (pre-sanitised)
+ *   - lib/memory/memory-mesh.ts   — synthesis prompt uses `scrubbed` (pre-sanitised)
+ *   - lib/llm/client.ts           — reflection prompt: static system + formatted memory list
+ *   - lib/memory/memory-translator.ts — role-confusion protection already applied
+ */
+/**
+ * Sanitise a free-text value before injecting it into an LLM prompt.
+ *
+ * Actions:
+ *   - Collapses \r\n and \n to a single space (prevents instruction-injection via newlines)
+ *   - Escapes double-quotes → \" (prevents breaking out of JSON-encoded fields)
+ *   - Caps at maxLen characters (prevents token-budget exhaustion)
+ */
+export declare function sanitizePromptField(value: string, maxLen?: number): string;
+/**
+ * Sanitise a memory or agent identifier before injecting it into an LLM prompt.
+ *
+ * Allows only alphanumeric characters, underscores, and hyphens.
+ * Strips everything else to prevent SQL-style keywords, path traversal, or quote
+ * characters from appearing in the prompt even if the ID was tampered with in storage.
+ */
+export declare function sanitizeSkillId(value: string, maxLen?: number): string;

package/lib/utils/prompt-security.js

@@ -0,0 +1,43 @@
+/**
+ * Prompt Security Utilities — RFC-0010-A
+ *
+ * Shared sanitisation functions for all LLM prompt construction.
+ *
+ * Rule (RFC-0010-A §5): Any string originating from user input, memory retrieval,
+ * or execution logs that is interpolated into an LLM prompt MUST pass through
+ * sanitizePromptField() before interpolation.
+ *
+ * Audit sweep (2026-03-14):
+ *   - lib/memory/memory-mesh.ts   — HyDE query expansion uses `scrubbed` (pre-sanitised)
+ *   - lib/memory/memory-mesh.ts   — synthesis prompt uses `scrubbed` (pre-sanitised)
+ *   - lib/llm/client.ts           — reflection prompt: static system + formatted memory list
+ *   - lib/memory/memory-translator.ts — role-confusion protection already applied
+ */
+/**
+ * Sanitise a free-text value before injecting it into an LLM prompt.
+ *
+ * Actions:
+ *   - Collapses \r\n and \n to a single space (prevents instruction-injection via newlines)
+ *   - Escapes double-quotes → \" (prevents breaking out of JSON-encoded fields)
+ *   - Caps at maxLen characters (prevents token-budget exhaustion)
+ */
+export function sanitizePromptField(value, maxLen = 256) {
+    if (!value)
+        return "";
+    return value
+        .replace(/[\r\n]+/g, " ")
+        .replace(/"/g, '\\"')
+        .slice(0, maxLen);
+}
+/**
+ * Sanitise a memory or agent identifier before injecting it into an LLM prompt.
+ *
+ * Allows only alphanumeric characters, underscores, and hyphens.
+ * Strips everything else to prevent SQL-style keywords, path traversal, or quote
+ * characters from appearing in the prompt even if the ID was tampered with in storage.
+ */
+export function sanitizeSkillId(value, maxLen = 64) {
+    if (!value)
+        return "";
+    return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, maxLen);
+}

package/lib/utils/prompt-security.ts

@@ -0,0 +1,43 @@
+/**
+ * Prompt Security Utilities — RFC-0010-A
+ *
+ * Shared sanitisation functions for all LLM prompt construction.
+ *
+ * Rule (RFC-0010-A §5): Any string originating from user input, memory retrieval,
+ * or execution logs that is interpolated into an LLM prompt MUST pass through
+ * sanitizePromptField() before interpolation.
+ *
+ * Audit sweep (2026-03-14):
+ *   - lib/memory/memory-mesh.ts   — HyDE query expansion uses `scrubbed` (pre-sanitised)
+ *   - lib/memory/memory-mesh.ts   — synthesis prompt uses `scrubbed` (pre-sanitised)
+ *   - lib/llm/client.ts           — reflection prompt: static system + formatted memory list
+ *   - lib/memory/memory-translator.ts — role-confusion protection already applied
+ */
+
+/**
+ * Sanitise a free-text value before injecting it into an LLM prompt.
+ *
+ * Actions:
+ *   - Collapses \r\n and \n to a single space (prevents instruction-injection via newlines)
+ *   - Escapes double-quotes → \" (prevents breaking out of JSON-encoded fields)
+ *   - Caps at maxLen characters (prevents token-budget exhaustion)
+ */
+export function sanitizePromptField(value: string, maxLen = 256): string {
+  if (!value) return "";
+  return value
+    .replace(/[\r\n]+/g, " ")
+    .replace(/"/g, '\\"')
+    .slice(0, maxLen);
+}
+
+/**
+ * Sanitise a memory or agent identifier before injecting it into an LLM prompt.
+ *
+ * Allows only alphanumeric characters, underscores, and hyphens.
+ * Strips everything else to prevent SQL-style keywords, path traversal, or quote
+ * characters from appearing in the prompt even if the ID was tampered with in storage.
+ */
+export function sanitizeSkillId(value: string, maxLen = 64): string {
+  if (!value) return "";
+  return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, maxLen);
+}

package/lib/yamo/emitter.d.ts

@@ -1,12 +1,13 @@
 /**
- * YAMO Emitter - Constructs structured YAMO blocks for auditability
+ * YAMO Emitter - Constructs structured YAMO ABNF blocks for auditability
  *
- * Based on YAMO Protocol specification:
- * - Semicolon-terminated key-value pairs
- * - Agent/Intent/Context/Constraints/Meta/Output structure
- * - Supports reflect, retain, recall operations
+ * Based on YAMO Protocol RFC-0011 §3.2 (ABNF colon-separated multi-line format).
+ * This format is DISTINCT from the flat wire format (RFC-0008 / RFC-0014).
  *
- * Reference: Hindsight project's yamo_integration.py
+ * Escaping: RFC-0014 — semicolons in values are percent-encoded as `%3B`.
+ * (Supersedes the comma-escape scheme used prior to 2026-03-14.)
+ *
+ * Reference: yamo-os lib/yamo/emitter.ts (canonical implementation)
  */
 /**
  * YamoEmitter class for building YAMO protocol blocks

package/lib/yamo/emitter.js

@@ -1,14 +1,19 @@
 // @ts-nocheck
 /**
- * YAMO Emitter - Constructs structured YAMO blocks for auditability
+ * YAMO Emitter - Constructs structured YAMO ABNF blocks for auditability
  *
- * Based on YAMO Protocol specification:
- * - Semicolon-terminated key-value pairs
- * - Agent/Intent/Context/Constraints/Meta/Output structure
- * - Supports reflect, retain, recall operations
+ * Based on YAMO Protocol RFC-0011 §3.2 (ABNF colon-separated multi-line format).
+ * This format is DISTINCT from the flat wire format (RFC-0008 / RFC-0014).
  *
- * Reference: Hindsight project's yamo_integration.py
+ * Escaping: RFC-0014 — semicolons in values are percent-encoded as `%3B`.
+ * (Supersedes the comma-escape scheme used prior to 2026-03-14.)
+ *
+ * Reference: yamo-os lib/yamo/emitter.ts (canonical implementation)
  */
+/** Percent-encode semicolons in a value so they don't break the YAMO line format. */
+function escapeValue(value) {
+    return String(value).replace(/;/g, "%3B");
+}
 /**
  * YamoEmitter class for building YAMO protocol blocks
  * YAMO (Yet Another Multi-agent Orchestration) blocks provide
@@ -22,17 +27,17 @@ export class YamoEmitter {
     static buildReflectBlock(params) {
         const { topic, memoryCount, agentId = "default", reflection, confidence = 0.8, } = params;
         const timestamp = new Date().toISOString();
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: synthesize_insights_from_context;
 context:
-  topic;${topic || "general"};
+  topic;${escapeValue(topic || "general")};
   memory_count;${memoryCount};
   timestamp;${timestamp};
 constraints:
   hypothesis;Reflection generates new insights from existing facts;
 priority: high;
 output:
-  reflection;${reflection};
+  reflection;${escapeValue(reflection)};
   confidence;${confidence};
 meta:
   rationale;Synthesized from ${memoryCount} relevant memories;
@@ -50,26 +55,26 @@ handoff: End;
         const { content, metadata: _metadata = {}, id, agentId = "default", memoryType = "event", } = params;
         const timestamp = new Date().toISOString();
         const contentPreview = content.length > 100 ? `${content.substring(0, 100)}...` : content;
-        // Escape semicolons in content for YAMO format
-        const escapedContent = contentPreview.replace(/;/g, ",");
-        return `agent: MemoryMesh_${agentId};
+        // RFC-0014: percent-encode semicolons (replaces legacy comma-escape)
+        const escapedContent = escapeValue(contentPreview);
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: store_memory_for_future_retrieval;
 context:
-  memory_id;${id};
-  memory_type;${memoryType};
+  memory_id;${escapeValue(id)};
+  memory_type;${escapeValue(memoryType)};
   timestamp;${timestamp};
   content_length;${content.length};
 constraints:
   hypothesis;New information should be integrated into world model;
 priority: medium;
 output:
-  memory_stored;${id};
+  memory_stored;${escapeValue(id)};
   content_preview;${escapedContent};
 meta:
   rationale;Memory persisted for semantic search and retrieval;
   observation;Content vectorized and stored in LanceDB;
   confidence;1.0;
-log: memory_retained;timestamp;${timestamp};id;${id};type;${memoryType};
+log: memory_retained;timestamp;${timestamp};id;${escapeValue(id)};type;${escapeValue(memoryType)};
 handoff: End;
 `;
     }
@@ -81,11 +86,11 @@ handoff: End;
         const { query, resultCount, limit = 10, agentId = "default", searchType = "semantic", } = params;
         const timestamp = new Date().toISOString();
         const recallRatio = resultCount > 0 ? (resultCount / limit).toFixed(2) : "0.00";
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: retrieve_relevant_memories;
 context:
-  query;${query};
-  search_type;${searchType};
+  query;${escapeValue(query)};
+  search_type;${escapeValue(searchType)};
   requested_limit;${limit};
   timestamp;${timestamp};
 constraints:
@@ -98,7 +103,7 @@ meta:
   rationale;Semantic search finds similar content by vector similarity;
   observation;${resultCount} memories found matching query;
   confidence;${resultCount > 0 ? "0.9" : "0.5"};
-log: memory_recalled;timestamp;${timestamp};results;${resultCount};query;${query};
+log: memory_recalled;timestamp;${timestamp};results;${resultCount};query;${escapeValue(query)};
 handoff: End;
 `;
     }
@@ -109,22 +114,22 @@ handoff: End;
     static buildDeleteBlock(params) {
         const { id, agentId = "default", reason = "user_request" } = params;
         const timestamp = new Date().toISOString();
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: remove_memory_from_storage;
 context:
-  memory_id;${id};
-  reason;${reason};
+  memory_id;${escapeValue(id)};
+  reason;${escapeValue(reason)};
   timestamp;${timestamp};
 constraints:
   hypothesis;Memory removal should be traceable for audit;
 priority: low;
 output:
-  deleted;${id};
+  deleted;${escapeValue(id)};
 meta:
   rationale;Memory removed from vector store;
   observation;Deletion recorded for provenance;
   confidence;1.0;
-log: memory_deleted;timestamp;${timestamp};id;${id};
+log: memory_deleted;timestamp;${timestamp};id;${escapeValue(id)};
 handoff: End;
 `;
     }
@@ -157,7 +162,8 @@ handoff: End;
                 // Allow empty lines and comments
                 if (trimmed &&
                     !trimmed.startsWith("agent:") &&
-                    !trimmed.startsWith("handoff:")) {
+                    !trimmed.startsWith("handoff:") &&
+                    !trimmed.endsWith(":")) {
                     errors.push(`Line not semicolon-terminated: ${trimmed.substring(0, 50)}`);
                 }
             }

package/lib/yamo/emitter.ts

@@ -1,14 +1,20 @@
 // @ts-nocheck
 /**
- * YAMO Emitter - Constructs structured YAMO blocks for auditability
+ * YAMO Emitter - Constructs structured YAMO ABNF blocks for auditability
  *
- * Based on YAMO Protocol specification:
- * - Semicolon-terminated key-value pairs
- * - Agent/Intent/Context/Constraints/Meta/Output structure
- * - Supports reflect, retain, recall operations
+ * Based on YAMO Protocol RFC-0011 §3.2 (ABNF colon-separated multi-line format).
+ * This format is DISTINCT from the flat wire format (RFC-0008 / RFC-0014).
  *
- * Reference: Hindsight project's yamo_integration.py
+ * Escaping: RFC-0014 — semicolons in values are percent-encoded as `%3B`.
+ * (Supersedes the comma-escape scheme used prior to 2026-03-14.)
+ *
+ * Reference: yamo-os lib/yamo/emitter.ts (canonical implementation)
  */
+
+/** Percent-encode semicolons in a value so they don't break the YAMO line format. */
+function escapeValue(value: string): string {
+  return String(value).replace(/;/g, "%3B");
+}
 /**
  * YamoEmitter class for building YAMO protocol blocks
  * YAMO (Yet Another Multi-agent Orchestration) blocks provide
@@ -22,17 +28,17 @@ export class YamoEmitter {
     static buildReflectBlock(params) {
         const { topic, memoryCount, agentId = "default", reflection, confidence = 0.8, } = params;
         const timestamp = new Date().toISOString();
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: synthesize_insights_from_context;
 context:
-  topic;${topic || "general"};
+  topic;${escapeValue(topic || "general")};
   memory_count;${memoryCount};
   timestamp;${timestamp};
 constraints:
   hypothesis;Reflection generates new insights from existing facts;
 priority: high;
 output:
-  reflection;${reflection};
+  reflection;${escapeValue(reflection)};
   confidence;${confidence};
 meta:
   rationale;Synthesized from ${memoryCount} relevant memories;
@@ -50,26 +56,26 @@ handoff: End;
         const { content, metadata: _metadata = {}, id, agentId = "default", memoryType = "event", } = params;
         const timestamp = new Date().toISOString();
         const contentPreview = content.length > 100 ? `${content.substring(0, 100)}...` : content;
-        // Escape semicolons in content for YAMO format
-        const escapedContent = contentPreview.replace(/;/g, ",");
-        return `agent: MemoryMesh_${agentId};
+        // RFC-0014: percent-encode semicolons (replaces legacy comma-escape)
+        const escapedContent = escapeValue(contentPreview);
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: store_memory_for_future_retrieval;
 context:
-  memory_id;${id};
-  memory_type;${memoryType};
+  memory_id;${escapeValue(id)};
+  memory_type;${escapeValue(memoryType)};
   timestamp;${timestamp};
   content_length;${content.length};
 constraints:
   hypothesis;New information should be integrated into world model;
 priority: medium;
 output:
-  memory_stored;${id};
+  memory_stored;${escapeValue(id)};
   content_preview;${escapedContent};
 meta:
   rationale;Memory persisted for semantic search and retrieval;
   observation;Content vectorized and stored in LanceDB;
   confidence;1.0;
-log: memory_retained;timestamp;${timestamp};id;${id};type;${memoryType};
+log: memory_retained;timestamp;${timestamp};id;${escapeValue(id)};type;${escapeValue(memoryType)};
 handoff: End;
 `;
     }
@@ -81,11 +87,11 @@ handoff: End;
         const { query, resultCount, limit = 10, agentId = "default", searchType = "semantic", } = params;
         const timestamp = new Date().toISOString();
         const recallRatio = resultCount > 0 ? (resultCount / limit).toFixed(2) : "0.00";
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: retrieve_relevant_memories;
 context:
-  query;${query};
-  search_type;${searchType};
+  query;${escapeValue(query)};
+  search_type;${escapeValue(searchType)};
   requested_limit;${limit};
   timestamp;${timestamp};
 constraints:
@@ -98,7 +104,7 @@ meta:
   rationale;Semantic search finds similar content by vector similarity;
   observation;${resultCount} memories found matching query;
   confidence;${resultCount > 0 ? "0.9" : "0.5"};
-log: memory_recalled;timestamp;${timestamp};results;${resultCount};query;${query};
+log: memory_recalled;timestamp;${timestamp};results;${resultCount};query;${escapeValue(query)};
 handoff: End;
 `;
     }
@@ -109,22 +115,22 @@ handoff: End;
     static buildDeleteBlock(params) {
         const { id, agentId = "default", reason = "user_request" } = params;
         const timestamp = new Date().toISOString();
-        return `agent: MemoryMesh_${agentId};
+        return `agent: MemoryMesh_${escapeValue(agentId)};
 intent: remove_memory_from_storage;
 context:
-  memory_id;${id};
-  reason;${reason};
+  memory_id;${escapeValue(id)};
+  reason;${escapeValue(reason)};
   timestamp;${timestamp};
 constraints:
   hypothesis;Memory removal should be traceable for audit;
 priority: low;
 output:
-  deleted;${id};
+  deleted;${escapeValue(id)};
 meta:
   rationale;Memory removed from vector store;
   observation;Deletion recorded for provenance;
   confidence;1.0;
-log: memory_deleted;timestamp;${timestamp};id;${id};
+log: memory_deleted;timestamp;${timestamp};id;${escapeValue(id)};
 handoff: End;
 `;
     }
@@ -157,7 +163,8 @@ handoff: End;
                 // Allow empty lines and comments
                 if (trimmed &&
                     !trimmed.startsWith("agent:") &&
-                    !trimmed.startsWith("handoff:")) {
+                    !trimmed.startsWith("handoff:") &&
+                    !trimmed.endsWith(":")) {
                     errors.push(`Line not semicolon-terminated: ${trimmed.substring(0, 50)}`);
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yamo/memory-mesh",
-  "version": "3.2.5",
+  "version": "3.2.6",
   "description": "Portable semantic memory system with Layer 0 Scrubber for YAMO agents (v3 Singularity Edition)",
   "repository": {
     "type": "git",