cloudflare-mcp-smart-proxy 1.5.5 → 1.5.6

package/README.md

@@ -114,8 +114,10 @@ npx -y -p cloudflare-mcp-smart-proxy cloudmcp-connector activate codex \
 - `get_local_memory_target`：读取当前连接器工作空间的本机目标契约。
 - `verify_local_memory_target`：回读验证目标契约或一个精确条目。
 - `capture_memory`：以同一事务写入受治理的 CloudMCP memory plane 和已配置本地目标，双端回读一致后才返回成功。
+- `invalidate_memory`：以 revision、原因和证据软失效一个精确条目，并把同一 canonical JSON 提交到本地与云端。
+- `close_session`：把简洁交接转换为 `working + handoff`，复用与 `capture_memory` 相同的双端事务。
 
-`capture_memory` 只有在当前连接器通过云端鉴权、工具能力授权及精确 `memory_scope` 资源授权后才会被本地协调器暴露。它仍复用原代理的 API Key、设备签名和 CloudMCP 请求路由，不存在匿名云端写入口。
+`capture_memory / invalidate_memory / close_session` 只有在当前连接器通过云端鉴权、对应工具能力授权及精确 `memory_scope` 资源授权后才会被本地协调器暴露。它们仍复用原代理的 API Key、设备签名和 CloudMCP 请求路由，不存在匿名云端写入口。`search_memory / get_memory_entry / load_context` 保持受治理云端只读工具，由同一授权链提供。
 
 本地目录不是硬编码的。以 SoloMap 为目标时，用户或 Agent 可把其记忆根目录显式传给配置工具；未安装 CloudMCP 的 SoloMap 用户继续使用原有 Markdown 机制，公共 SoloMap 插件不会默认依赖这些工具。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-mcp-smart-proxy",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Smart proxy for Cloudflare MCP - routes tools to cloud or local execution",
   "repository": {
     "type": "git",

package/src/local-memory-coordinator.js

@@ -10,13 +10,6 @@ import {
   validateMemoryIdentifier
 } from './memory-schema.js';
 
-const SENSITIVE_MEMORY_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
-  /\bCLOUDMCP_APPROVAL_CODE\s*=/i,
-  /\b(?:api[_ -]?key|access[_ -]?token|client[_ -]?secret|private[_ -]?key)\s*[:=]\s*\S{12,}/i,
-  /\bmcp_[A-Za-z0-9]{16,}\b/
-];
-
 function writeJsonAtomically(filePath, value, mode = 0o600) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
@@ -65,12 +58,6 @@ function currentGitCommit(workspaceRoot) {
   }
 }
 
-function assertNoSensitiveMemory(input) {
-  const text = [input.title, input.content, ...(input.evidenceRefs || [])].filter(Boolean).join('\n');
-  if (SENSITIVE_MEMORY_PATTERNS.some((pattern) => pattern.test(text))) {
-    throw new Error('Memory content appears to contain a secret or approval credential');
-  }
-}
 
 export class LocalMemoryCoordinator {
   constructor(options = {}) {
@@ -200,7 +187,6 @@ export class LocalMemoryCoordinator {
     const contract = this.getContract();
     if (!contract || contract.status !== 'active') throw new Error('Local memory target is not configured');
     const input = validateMemoryCaptureInput(params);
-    assertNoSensitiveMemory(input);
     const requestedScope = params.memory_scope_id || params.memoryScopeId || '';
     if (requestedScope && !contract.cloudScopeIds.includes(requestedScope)) {
       throw new Error(`Memory scope is not authorized by the local target contract: ${requestedScope}`);
@@ -332,4 +318,75 @@ export class LocalMemoryCoordinator {
       );
     }
   }
+
+  async invalidate(params = {}) {
+    const contract = this.getContract();
+    if (!contract || contract.status !== 'active') throw new Error('Local memory target is not configured');
+    const memoryId = validateMemoryIdentifier(params.memory_id || params.memoryId, 'memory_id');
+    const requestedScope = params.memory_scope_id || params.memoryScopeId || '';
+    if (requestedScope && !contract.cloudScopeIds.includes(requestedScope)) {
+      throw new Error(`Memory scope is not authorized by the local target contract: ${requestedScope}`);
+    }
+    let stage = 'cloud_write';
+    try {
+      const result = await this.callCloud('invalidate_memory', {
+        memory_scope_id: requestedScope || undefined,
+        memory_id: memoryId,
+        expected_revision: params.expected_revision || params.expectedRevision,
+        reason: params.reason,
+        evidence_refs: params.evidence_refs || params.evidenceRefs
+      });
+      if (result?.verified !== true) throw new Error(`Cloud memory did not confirm invalidation readback: ${memoryId}`);
+      const entry = assertMemoryEntryIntegrity(result.entry);
+      if (!contract.cloudScopeIds.includes(entry.scopeId) || entry.status !== 'invalidated') {
+        throw new Error(`CloudMCP returned an invalid memory invalidation: ${memoryId}`);
+      }
+      stage = 'local_write';
+      const entryPath = path.join(contract.directory, 'entries', `${entry.id}.json`);
+      writeJsonAtomically(entryPath, entry);
+      stage = 'local_readback';
+      const localEntry = assertMemoryEntryIntegrity(readJson(entryPath));
+      if (canonicalMemoryJson(localEntry) !== canonicalMemoryJson(entry)) {
+        throw new Error(`Local memory invalidation readback failed for ${entry.id}`);
+      }
+      return {
+        success: true,
+        memoryId: entry.id,
+        revision: entry.revision,
+        canonicalHash: entry.canonicalHash,
+        idempotent: result.idempotent === true,
+        local: { persisted: true, verified: true },
+        cloud: { persisted: true, verified: true },
+        entry
+      };
+    } catch (error) {
+      const cloudStatus = stage === 'cloud_write' ? 'unknown' : 'verified';
+      const localStatus = stage === 'cloud_write' ? 'not_started' : (stage === 'local_write' ? 'failed' : 'persisted_unverified');
+      throw new Error(
+        `Memory invalidation ${memoryId} failed at ${stage} `
+        + `(cloud=${cloudStatus}, local=${localStatus}): ${error?.message || 'unknown error'}`
+      );
+    }
+  }
+
+  async closeSession(params = {}) {
+    const summary = typeof params.summary === 'string' ? params.summary.trim() : '';
+    if (!summary) throw new Error('summary is required');
+    const nextSteps = (Array.isArray(params.next_steps) ? params.next_steps : [])
+      .map((step) => String(step).trim())
+      .filter(Boolean);
+    const content = nextSteps.length
+      ? `${summary}\n\nNext steps:\n${nextSteps.map((step) => `- ${String(step).trim()}`).join('\n')}`
+      : summary;
+    const captured = await this.capture({
+      memory_scope_id: params.memory_scope_id || params.memoryScopeId,
+      layer: 'working',
+      kind: 'handoff',
+      title: params.title || 'Session handoff',
+      content,
+      tags: params.tags,
+      transaction_id: params.transaction_id || params.transactionId
+    });
+    return { ...captured, closed: true };
+  }
 }

package/src/local-tools.js

@@ -97,6 +97,14 @@ export class LocalToolExecutor {
       case 'capture_memory':
         if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
         return await this.memoryCoordinator.capture(params || {});
+
+      case 'invalidate_memory':
+        if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
+        return await this.memoryCoordinator.invalidate(params || {});
+
+      case 'close_session':
+        if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
+        return await this.memoryCoordinator.closeSession(params || {});
       
       default:
         throw new Error(`Unknown local tool: ${toolName}`);
@@ -136,7 +144,7 @@ export class LocalToolExecutor {
       },
       {
         name: 'capture_memory',
-        description: 'Validate one memory and commit the same JSON entry to the configured local target and governed CloudMCP memory scope.',
+        description: 'Validate one governed memory and commit the same canonical JSON entry to the configured local target and CloudMCP scope.',
         inputSchema: {
           type: 'object',
           properties: {
@@ -158,6 +166,37 @@ export class LocalToolExecutor {
           required: ['content']
         }
       },
+      {
+        name: 'invalidate_memory',
+        description: 'Soft-invalidate one governed memory and verify the same canonical result in CloudMCP and the configured local target.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            memory_scope_id: { type: 'string' },
+            memory_id: { type: 'string' },
+            expected_revision: { type: 'number' },
+            reason: { type: 'string' },
+            evidence_refs: { type: 'array', items: { type: 'string' } }
+          },
+          required: ['memory_id', 'expected_revision', 'reason', 'evidence_refs']
+        }
+      },
+      {
+        name: 'close_session',
+        description: 'Persist a working handoff through the same verified local-and-cloud memory transaction.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            memory_scope_id: { type: 'string' },
+            title: { type: 'string' },
+            summary: { type: 'string' },
+            next_steps: { type: 'array', items: { type: 'string' } },
+            tags: { type: 'array', items: { type: 'string' } },
+            transaction_id: { type: 'string' }
+          },
+          required: ['summary']
+        }
+      },
       {
         name: 'read_file',
         description: 'Read a file from local filesystem',

package/src/memory-schema.js

@@ -5,6 +5,17 @@ const MEMORY_KINDS = new Set([
   'preference', 'rule', 'project_fact', 'decision', 'pattern', 'domain', 'handoff', 'observation'
 ]);
 const MEMORY_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const MEMORY_KIND_LAYERS = new Map([
+  ['preference', 'stable'], ['rule', 'stable'], ['project_fact', 'stable'],
+  ['decision', 'stable'], ['pattern', 'stable'], ['domain', 'stable'],
+  ['handoff', 'working'], ['observation', 'candidate']
+]);
+const SENSITIVE_MEMORY_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
+  /\bCLOUDMCP_APPROVAL_CODE\s*=/i,
+  /\b(?:api[_ -]?key|access[_ -]?token|client[_ -]?secret|private[_ -]?key)\s*[:=]\s*\S{12,}/i,
+  /\bmcp_[A-Za-z0-9]{16,}\b/
+];
 
 function normalizeString(value, fallback = null) {
   const normalized = typeof value === 'string' ? value.trim() : '';
@@ -28,6 +39,14 @@ function normalizeStringArray(value, limit = 32) {
   ));
 }
 
+export function assertNoSensitiveMemory(input = {}) {
+  const text = [input.title, input.content, ...(input.evidenceRefs || input.evidence_refs || [])]
+    .filter(Boolean).join('\n');
+  if (SENSITIVE_MEMORY_PATTERNS.some((pattern) => pattern.test(text))) {
+    throw new Error('Memory content appears to contain a secret or approval credential');
+  }
+}
+
 function sortValue(value) {
   if (Array.isArray(value)) return value.map(sortValue);
   if (!value || typeof value !== 'object') return value;
@@ -58,15 +77,18 @@ export function validateMemoryCaptureInput(payload = {}) {
   if (content.length > 12000) throw new Error('Memory content exceeds 12000 characters');
   if (title && title.length > 240) throw new Error('Memory title exceeds 240 characters');
   const layer = normalizeString(payload.layer, 'candidate');
+  if (layer === 'stable' && !normalizeString(payload.kind)) throw new Error('Stable memory requires an explicit kind');
   const kind = normalizeString(payload.kind, layer === 'working' ? 'handoff' : 'observation');
   if (!MEMORY_LAYERS.has(layer)) throw new Error(`Unsupported memory layer: ${layer}`);
   if (!MEMORY_KINDS.has(kind)) throw new Error(`Unsupported memory kind: ${kind}`);
+  const requiredLayer = MEMORY_KIND_LAYERS.get(kind);
+  if (requiredLayer !== layer) throw new Error(`Memory kind ${kind} must use the ${requiredLayer} layer`);
   const evidenceRefs = normalizeStringArray(payload.evidence_refs || payload.evidenceRefs, 20);
   const verifiedAt = normalizeIsoDate(payload.verified_at || payload.verifiedAt);
-  if (layer === 'stable' && evidenceRefs.length === 0 && !verifiedAt) {
-    throw new Error('Stable memory requires evidence_refs or verified_at');
+  if (layer === 'stable' && evidenceRefs.length === 0) {
+    throw new Error('Stable memory requires at least one evidence_ref');
   }
-  return {
+  const normalized = {
     title: title || 'Untitled memory',
     content,
     layer,
@@ -79,6 +101,8 @@ export function validateMemoryCaptureInput(payload = {}) {
     supersedes: normalizeStringArray(payload.supersedes, 20)
       .map((id) => validateMemoryIdentifier(id, 'supersedes entry id'))
   };
+  assertNoSensitiveMemory(normalized);
+  return normalized;
 }
 
 export function assertMemoryEntryIntegrity(entry) {

package/src/router.js

@@ -72,7 +72,9 @@ export class SmartRouter {
         'configure_local_memory_target',
         'get_local_memory_target',
         'verify_local_memory_target',
-        'capture_memory'
+        'capture_memory',
+        'invalidate_memory',
+        'close_session'
       ],
       
       // 云端工具（需要网络或云端资源）
@@ -294,7 +296,10 @@ export class SmartRouter {
     }
 
     const cloudNames = new Set(cloudTools.map((tool) => tool.name));
-    const eligibleLocalTools = localTools.filter((tool) => tool.name !== 'capture_memory' || cloudNames.has('capture_memory'));
+    const governedLocalMemoryTools = new Set(['capture_memory', 'invalidate_memory', 'close_session']);
+    const eligibleLocalTools = localTools.filter((tool) => (
+      !governedLocalMemoryTools.has(tool.name) || cloudNames.has(tool.name)
+    ));
     const localNames = new Set(eligibleLocalTools.map((tool) => tool.name));
     return [
       ...cloudTools.filter((tool) => !localNames.has(tool.name)).map((tool) => ({ ...tool, source: 'cloud' })),