crbro-memory 2.10.0 → 2.11.0

package/dist/sync/git.js

@@ -11,31 +11,48 @@
 // forever. And it must never rewrite what it stores: git on Windows converts
 // line endings by default, which turns one appended line into two different
 // lines on two machines, and the logs here are append-only.
+//
+// 2.11: a third. Inside the shared daemon a synchronous git call blocks every
+// client for as long as a push takes (up to 30 s). Each multi-step operation is
+// written once as a generator of git calls and driven either synchronously or
+// asynchronously; the server path uses the async drivers.
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GITIGNORE = exports.GITATTRIBUTES = void 0;
+exports.resolveGit = resolveGit;
 exports.git = git;
+exports.gitAsync = gitAsync;
 exports.gitAvailable = gitAvailable;
+exports.gitAvailableAsync = gitAvailableAsync;
 exports.hardenRepo = hardenRepo;
 exports.initSpace = initSpace;
+exports.initSpaceAsync = initSpaceAsync;
 exports.cloneSpace = cloneSpace;
+exports.cloneSpaceAsync = cloneSpaceAsync;
 exports.syncSpace = syncSpace;
+exports.syncSpaceAsync = syncSpaceAsync;
+exports._resetGitMemoForTests = _resetGitMemoForTests;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 /**
  * Everything that could make git stop and ask a person something, turned off.
  * Without this the server hangs on the first private repository it meets.
+ * A GIT_SSH_COMMAND the user set is kept: replacing it silently overrode their
+ * own ssh setup (G16).
  */
-const SILENT_ENV = {
-    GIT_TERMINAL_PROMPT: '0',
-    GIT_ASKPASS: '',
-    SSH_ASKPASS: '',
-    GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new',
-    GCM_INTERACTIVE: 'never',
-};
+function silentEnv() {
+    return {
+        ...process.env,
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_ASKPASS: '',
+        SSH_ASKPASS: '',
+        GIT_SSH_COMMAND: process.env['GIT_SSH_COMMAND'] || 'ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new',
+        GCM_INTERACTIVE: 'never',
+    };
+}
 function classify(stderr) {
     const s = stderr.toLowerCase();
     if (s.includes('could not resolve host') || s.includes('unable to access') ||
@@ -48,38 +65,125 @@ function classify(stderr) {
         return 'conflict';
     return undefined;
 }
+// ─── Which git ───────────────────────────────────────────────────
+//
+// On Windows a bare "git" is looked up in the child's working directory before
+// PATH. Every call here runs with cwd = a space directory, whose contents come
+// from teammates: a git.exe committed at its root would run as the user (G10).
+// So the executable is resolved once, from absolute PATH entries only.
+let resolved = null;
+function resolveGit() {
+    if (process.platform !== 'win32')
+        return 'git';
+    if (resolved && (0, node_fs_1.existsSync)(resolved))
+        return resolved;
+    resolved = null;
+    for (const entry of (process.env['PATH'] || process.env['Path'] || '').split(node_path_1.default.delimiter)) {
+        const d = entry.trim().replace(/^"|"$/g, '');
+        if (!d || !node_path_1.default.isAbsolute(d))
+            continue;
+        const exe = node_path_1.default.join(d, 'git.exe');
+        try {
+            if ((0, node_fs_1.statSync)(exe).isFile()) {
+                resolved = exe;
+                return exe;
+            }
+        }
+        catch { /* not here */ }
+    }
+    // Not on PATH: the bare name fails with ENOENT from a neutral directory
+    // (see git()), which reports no_git rather than running a planted binary.
+    return 'git';
+}
+function neutralCwd(cwd) {
+    // With an absolute executable the space directory is a safe cwd. Without one
+    // (git not found), run from the system directory and pass -C instead.
+    if (process.platform === 'win32' && resolveGit() === 'git') {
+        const root = process.env['SystemRoot'] || 'C:\\Windows';
+        return { cwd: root, args: ['-C', cwd] };
+    }
+    return { cwd, args: [] };
+}
+function toResult(status, signal, stdout, stderr, error) {
+    if (error) {
+        const code = error.code;
+        return { ok: false, stdout: '', stderr: String(error.message || ''), reason: code === 'ENOENT' ? 'no_git' : 'timeout' };
+    }
+    if (signal)
+        return { ok: false, stdout, stderr, reason: 'timeout' };
+    return { ok: status === 0, stdout, stderr, reason: status === 0 ? undefined : classify(stderr) };
+}
 function git(args, cwd, timeoutMs = 20_000) {
-    const r = (0, node_child_process_1.spawnSync)('git', args, {
-        cwd,
+    const where = neutralCwd(cwd);
+    const r = (0, node_child_process_1.spawnSync)(resolveGit(), [...where.args, ...args], {
+        cwd: where.cwd,
         encoding: 'utf-8',
         timeout: timeoutMs,
         windowsHide: true,
-        env: { ...process.env, ...SILENT_ENV },
+        env: silentEnv(),
+    });
+    return toResult(r.status, r.signal, r.stdout || '', r.stderr || '', r.error);
+}
+/** The same call without blocking the event loop. */
+function gitAsync(args, cwd, timeoutMs = 20_000) {
+    return new Promise(resolve => {
+        const where = neutralCwd(cwd);
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        let timedOut = false;
+        const done = (r) => { if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            resolve(r);
+        } };
+        let child;
+        try {
+            child = (0, node_child_process_1.spawn)(resolveGit(), [...where.args, ...args], {
+                cwd: where.cwd, windowsHide: true, env: silentEnv(), stdio: ['ignore', 'pipe', 'pipe'],
+            });
+        }
+        catch (err) {
+            done(toResult(null, null, '', '', err));
+            return;
+        }
+        const timer = setTimeout(() => { timedOut = true; child.kill(); }, timeoutMs);
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', d => { stdout += d; });
+        child.stderr.on('data', d => { stderr += d; });
+        child.on('error', err => done(toResult(null, null, stdout, stderr, err)));
+        child.on('close', (code, signal) => done(timedOut
+            ? { ok: false, stdout, stderr, reason: 'timeout' }
+            : toResult(code, signal, stdout, stderr)));
     });
-    if (r.error) {
-        const code = r.error.code;
-        return {
-            ok: false,
-            stdout: '',
-            stderr: String(r.error.message || ''),
-            reason: code === 'ENOENT' ? 'no_git' : 'timeout',
-        };
-    }
-    if (r.signal) {
-        return { ok: false, stdout: r.stdout || '', stderr: r.stderr || '', reason: 'timeout' };
-    }
-    const stderr = r.stderr || '';
-    return {
-        ok: r.status === 0,
-        stdout: r.stdout || '',
-        stderr,
-        reason: r.status === 0 ? undefined : classify(stderr),
-    };
+}
+function driveSync(g) {
+    let step = g.next();
+    while (!step.done)
+        step = g.next(git(step.value.args, step.value.cwd, step.value.timeoutMs));
+    return step.value;
+}
+async function driveAsync(g) {
+    let step = g.next();
+    while (!step.done)
+        step = g.next(await gitAsync(step.value.args, step.value.cwd, step.value.timeoutMs));
+    return step.value;
 }
 /** Is git installed at all? */
 function gitAvailable() {
     return git(['--version'], process.cwd(), 5_000).ok;
 }
+// Whether git is installed does not change between two syncs; asking costs a
+// process start. Kept for a minute, failures included.
+let availability = null;
+async function gitAvailableAsync() {
+    if (availability && Date.now() - availability.at < 60_000)
+        return availability.ok;
+    const ok = (await gitAsync(['--version'], process.cwd(), 5_000)).ok;
+    availability = { ok, at: Date.now() };
+    return ok;
+}
 /**
  * Settings that have to be on the repository itself, not on the machine.
  *
@@ -89,18 +193,21 @@ function gitAvailable() {
  * becomes two lines, and the memory quietly duplicates itself. `* -text` in
  * .gitattributes plus this setting stops it at both ends.
  */
-function hardenRepo(dir) {
-    git(['config', 'core.autocrlf', 'false'], dir);
-    git(['config', 'core.safecrlf', 'false'], dir);
-    git(['config', 'merge.ours.driver', 'true'], dir);
+function* hardenGen(dir) {
+    yield { args: ['config', 'core.autocrlf', 'false'], cwd: dir };
+    yield { args: ['config', 'core.safecrlf', 'false'], cwd: dir };
+    yield { args: ['config', 'merge.ours.driver', 'true'], cwd: dir };
     // Identity, so committing works on a machine with no global git config.
-    if (!git(['config', 'user.email'], dir).stdout.trim()) {
-        git(['config', 'user.email', 'crbro@localhost'], dir);
+    if (!(yield { args: ['config', 'user.email'], cwd: dir }).stdout.trim()) {
+        yield { args: ['config', 'user.email', 'crbro@localhost'], cwd: dir };
     }
-    if (!git(['config', 'user.name'], dir).stdout.trim()) {
-        git(['config', 'user.name', 'CRBRO'], dir);
+    if (!(yield { args: ['config', 'user.name'], cwd: dir }).stdout.trim()) {
+        yield { args: ['config', 'user.name', 'CRBRO'], cwd: dir };
     }
 }
+function hardenRepo(dir) {
+    driveSync(hardenGen(dir));
+}
 exports.GITATTRIBUTES = '# CRBRO shared memory. Do not edit.\n' +
     '# -text keeps git from rewriting line endings: these logs are append-only\n' +
     '# and a rewritten ending turns one line into two on the next merge.\n' +
@@ -108,71 +215,95 @@ exports.GITATTRIBUTES = '# CRBRO shared memory. Do not edit.\n' +
     '*.jsonl merge=union\n';
 exports.GITIGNORE = '# Local bookkeeping. Never shared.\n' +
     '.local/\n';
-/** Prepare a brand-new space so the first person to clone finds real history. */
-async function initSpace(dir, remote, branch = 'main') {
-    await node_fs_1.promises.mkdir(dir, { recursive: true });
-    const init = git(['init', '-b', branch], dir);
+function* initGen(dir, remote, branch) {
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    const init = yield { args: ['init', '-b', branch], cwd: dir };
     if (!init.ok && !init.stdout.includes('Reinitialized')) {
-        const legacy = git(['init'], dir);
+        const legacy = yield { args: ['init'], cwd: dir };
         if (!legacy.ok)
             return legacy;
-        git(['checkout', '-b', branch], dir);
+        yield { args: ['checkout', '-b', branch], cwd: dir };
     }
-    hardenRepo(dir);
-    await node_fs_1.promises.writeFile(node_path_1.default.join(dir, '.gitattributes'), exports.GITATTRIBUTES, 'utf-8');
-    await node_fs_1.promises.writeFile(node_path_1.default.join(dir, '.gitignore'), exports.GITIGNORE, 'utf-8');
-    git(['remote', 'remove', 'origin'], dir);
-    const add = git(['remote', 'add', 'origin', remote], dir);
+    yield* hardenGen(dir);
+    (0, node_fs_1.writeFileSync)(node_path_1.default.join(dir, '.gitattributes'), exports.GITATTRIBUTES, 'utf-8');
+    (0, node_fs_1.writeFileSync)(node_path_1.default.join(dir, '.gitignore'), exports.GITIGNORE, 'utf-8');
+    yield { args: ['remote', 'remove', 'origin'], cwd: dir };
+    // "--": a remote that starts with "-" is a URL, never an option.
+    const add = yield { args: ['remote', 'add', '--', 'origin', remote], cwd: dir };
     if (!add.ok)
         return add;
-    git(['add', '-A', '.'], dir);
-    git(['commit', '-q', '-m', 'CRBRO shared space'], dir);
+    yield { args: ['add', '-A', '.'], cwd: dir };
+    yield { args: ['commit', '-q', '-m', 'CRBRO shared space'], cwd: dir };
     // Push the first commit before anyone clones. Skipping this is how two
     // people end up with unrelated histories and a merge that refuses to run —
     // each of them keeping their own half of the memory without noticing.
-    return git(['push', '-u', 'origin', `HEAD:${branch}`], dir, 30_000);
+    return yield { args: ['push', '-u', 'origin', `HEAD:${branch}`], cwd: dir, timeoutMs: 30_000 };
 }
-/** Clone an existing space. */
-function cloneSpace(dir, remote, branch = 'main') {
+/** Prepare a brand-new space so the first person to clone finds real history. */
+async function initSpace(dir, remote, branch = 'main') {
+    return driveSync(initGen(dir, remote, branch));
+}
+function initSpaceAsync(dir, remote, branch = 'main') {
+    return driveAsync(initGen(dir, remote, branch));
+}
+function* cloneGen(dir, remote, branch) {
     const parent = node_path_1.default.dirname(dir);
     const name = node_path_1.default.basename(dir);
-    const r = git(['clone', '--branch', branch, remote, name], parent, 60_000);
+    const r = yield { args: ['clone', '--branch', branch, '--', remote, name], cwd: parent, timeoutMs: 60_000 };
     if (r.ok)
-        hardenRepo(dir);
+        yield* hardenGen(dir);
     return r;
 }
-/**
- * Bring in everyone else's notes and send ours.
- * Offline is a normal outcome, not an error: the work stays local and goes out
- * next time. Nothing here can lose a note, because nobody edits anyone's file.
- */
-function syncSpace(dir, author, branch = 'main', timeoutMs = 30_000) {
-    git(['add', '-A', '.'], dir);
-    const hayCambios = !git(['diff', '--cached', '--quiet'], dir).ok;
+/** Clone an existing space. */
+function cloneSpace(dir, remote, branch = 'main') {
+    return driveSync(cloneGen(dir, remote, branch));
+}
+function cloneSpaceAsync(dir, remote, branch = 'main') {
+    return driveAsync(cloneGen(dir, remote, branch));
+}
+function* syncGen(dir, author, branch, timeoutMs) {
+    yield { args: ['add', '-A', '.'], cwd: dir };
+    const hayCambios = !(yield { args: ['diff', '--cached', '--quiet'], cwd: dir }).ok;
     if (hayCambios) {
-        git(['commit', '-q', '-m', `crbro ${author} ${new Date().toISOString()}`], dir);
+        yield { args: ['commit', '-q', '-m', `crbro ${author} ${new Date().toISOString()}`], cwd: dir };
     }
-    const fetched = git(['fetch', 'origin', branch], dir, timeoutMs);
+    const fetched = yield { args: ['fetch', 'origin', '--', branch], cwd: dir, timeoutMs };
     if (!fetched.ok)
         return { pulled: fetched, pushed: null };
-    const merged = git(['merge', '--no-edit', '--allow-unrelated-histories', `origin/${branch}`], dir, timeoutMs);
+    const merged = yield { args: ['merge', '--no-edit', '--allow-unrelated-histories', `origin/${branch}`], cwd: dir, timeoutMs };
     if (!merged.ok) {
         // Union merging makes this rare, but a hand-edited file could still clash.
         // Keeping both sides and stopping beats guessing.
-        git(['merge', '--abort'], dir);
+        yield { args: ['merge', '--abort'], cwd: dir };
         return { pulled: { ...merged, reason: 'conflict' }, pushed: null };
     }
     // Push, and if someone landed first, take their work and try once more.
-    let pushed = git(['push', 'origin', `HEAD:${branch}`], dir, timeoutMs);
+    let pushed = yield { args: ['push', 'origin', `HEAD:${branch}`], cwd: dir, timeoutMs };
     for (let intento = 0; intento < 2 && !pushed.ok && pushed.reason !== 'auth'; intento++) {
-        if (!git(['fetch', 'origin', branch], dir, timeoutMs).ok)
+        if (!(yield { args: ['fetch', 'origin', '--', branch], cwd: dir, timeoutMs }).ok)
             break;
-        if (!git(['merge', '--no-edit', `origin/${branch}`], dir, timeoutMs).ok) {
-            git(['merge', '--abort'], dir);
+        if (!(yield { args: ['merge', '--no-edit', `origin/${branch}`], cwd: dir, timeoutMs }).ok) {
+            yield { args: ['merge', '--abort'], cwd: dir };
             break;
         }
-        pushed = git(['push', 'origin', `HEAD:${branch}`], dir, timeoutMs);
+        pushed = yield { args: ['push', 'origin', `HEAD:${branch}`], cwd: dir, timeoutMs };
     }
     return { pulled: merged, pushed };
 }
+/**
+ * Bring in everyone else's notes and send ours.
+ * Offline is a normal outcome, not an error: the work stays local and goes out
+ * next time. Nothing here can lose a note, because nobody edits anyone's file.
+ */
+function syncSpace(dir, author, branch = 'main', timeoutMs = 30_000) {
+    return driveSync(syncGen(dir, author, branch, timeoutMs));
+}
+function syncSpaceAsync(dir, author, branch = 'main', timeoutMs = 30_000) {
+    return driveAsync(syncGen(dir, author, branch, timeoutMs));
+}
+/** Tests: forget the resolved executable and the availability memo. */
+function _resetGitMemoForTests() {
+    resolved = null;
+    availability = null;
+}
 //# sourceMappingURL=git.js.map

package/dist/sync/space.js

@@ -37,6 +37,7 @@ const secrets_js_1 = require("../engine/secrets.js");
 const evidence_js_1 = require("../engine/evidence.js");
 const ops_js_1 = require("./ops.js");
 const git_js_1 = require("./git.js");
+const validate_js_1 = require("./validate.js");
 // Fuera de shared/: el bloqueo debe sobrevivir al traslado de un espacio.
 // Orden: shared-state -> shared-outbox-state -> JSON. Nunca a la inversa.
 // Git retiene shared-state, pero NUNCA shared-outbox-state. Los emisores de
@@ -97,16 +98,24 @@ async function getIdentity(brain, author) {
     await (0, fs_js_1.writeJSON)(p, id);
     return id;
 }
+/**
+ * The folder of a space. Throws for a name that is not a plain slug or that
+ * would resolve outside shared/: with "..", create used to run `git add -A`
+ * and push the whole brain to whatever remote it was given (G1).
+ */
 function spaceDir(brain, name) {
-    return node_path_1.default.join(brain.paths.shared, name);
+    return (0, validate_js_1.safeSpaceDir)(brain.paths.shared, name);
 }
+/** The space's config, or null — also for a name that cannot be a space. */
 async function readSpace(brain, name) {
+    if ((0, validate_js_1.spaceNameProblem)(name))
+        return null;
     return (0, fs_js_1.readJSON)(node_path_1.default.join(spaceDir(brain, name), 'space.json'));
 }
 async function listSpaces(brain) {
     try {
         const entries = await node_fs_1.promises.readdir(brain.paths.shared, { withFileTypes: true });
-        return entries.filter(e => e.isDirectory()).map(e => e.name);
+        return entries.filter(e => e.isDirectory() && !(0, validate_js_1.spaceNameProblem)(e.name)).map(e => e.name);
     }
     catch {
         return [];
@@ -116,8 +125,16 @@ async function listSpaces(brain) {
 async function createSpace(brain, name, remote, author, branch = 'main') {
     return withSharedState(brain, () => createSpaceUnlocked(brain, name, remote, author, branch));
 }
+/** One message for a name, remote or branch that cannot be used. */
+function invalidInput(name, remote, branch) {
+    const problem = (0, validate_js_1.spaceNameProblem)(name) || (0, validate_js_1.remoteProblem)(remote) || (0, validate_js_1.branchProblem)(branch);
+    return problem ? { ok: false, message: `Nothing was created or cloned. ${problem}` } : null;
+}
 async function createSpaceUnlocked(brain, name, remote, author, branch) {
-    if (!(0, git_js_1.gitAvailable)()) {
+    const invalido = invalidInput(name, remote, branch);
+    if (invalido)
+        return invalido;
+    if (!(await (0, git_js_1.gitAvailableAsync)())) {
         return { ok: false, message: 'git is not installed, and it is what carries the shared memory. Install it and try again.' };
     }
     const dir = spaceDir(brain, name);
@@ -125,30 +142,33 @@ async function createSpaceUnlocked(brain, name, remote, author, branch) {
         return { ok: false, message: `The space "${name}" already exists on this machine.` };
     }
     const id = await getIdentity(brain, author);
-    const pushed = await (0, git_js_1.initSpace)(dir, remote, branch);
+    const pushed = await (0, git_js_1.initSpaceAsync)(dir, remote, branch);
     const cfg = { v: 1, name, created_by: id.author, created: (0, fs_js_1.now)(), branch };
     await (0, fs_js_1.writeJSON)(node_path_1.default.join(dir, 'space.json'), cfg);
     await node_fs_1.promises.mkdir(node_path_1.default.join(dir, '.local'), { recursive: true });
-    (0, git_js_1.git)(['add', '-A', '.'], dir);
-    (0, git_js_1.git)(['commit', '-q', '-m', `CRBRO space "${name}"`], dir);
-    const again = (0, git_js_1.git)(['push', 'origin', `HEAD:${branch}`], dir, 30_000);
+    await (0, git_js_1.gitAsync)(['add', '-A', '.'], dir);
+    await (0, git_js_1.gitAsync)(['commit', '-q', '-m', `CRBRO space "${name}"`], dir);
+    const again = await (0, git_js_1.gitAsync)(['push', 'origin', `HEAD:${branch}`], dir, 30_000);
     if (!pushed.ok && !again.ok) {
         return {
             ok: false,
             message: 'The space was created locally but could not reach the remote. Check the URL and that you have push access.',
-            detail: (again.stderr || pushed.stderr).slice(0, 300),
+            detail: (0, secrets_js_1.redact)((again.stderr || pushed.stderr).slice(0, 300)).text,
         };
     }
     return {
         ok: true,
-        message: `Space "${name}" created and pushed. Anyone you invite to ${remote} can now join it.`,
+        message: (0, secrets_js_1.redact)(`Space "${name}" created and pushed. Anyone you invite to ${remote} can now join it.`).text,
     };
 }
 async function joinSpace(brain, name, remote, author, branch = 'main') {
     return withSharedState(brain, () => joinSpaceUnlocked(brain, name, remote, author, branch));
 }
 async function joinSpaceUnlocked(brain, name, remote, author, branch) {
-    if (!(0, git_js_1.gitAvailable)()) {
+    const invalido = invalidInput(name, remote, branch);
+    if (invalido)
+        return invalido;
+    if (!(await (0, git_js_1.gitAvailableAsync)())) {
         return { ok: false, message: 'git is not installed, and it is what carries the shared memory. Install it and try again.' };
     }
     const dir = spaceDir(brain, name);
@@ -157,14 +177,14 @@ async function joinSpaceUnlocked(brain, name, remote, author, branch) {
     }
     await getIdentity(brain, author);
     await node_fs_1.promises.mkdir(brain.paths.shared, { recursive: true });
-    const r = (0, git_js_1.cloneSpace)(dir, remote, branch);
+    const r = await (0, git_js_1.cloneSpaceAsync)(dir, remote, branch);
     if (!r.ok) {
         return {
             ok: false,
             message: r.reason === 'auth'
                 ? 'Cloned nothing: no access to that repository. Ask to be added as a collaborator.'
                 : 'Could not clone the space. Check the URL and your connection.',
-            detail: r.stderr.slice(0, 300),
+            detail: (0, secrets_js_1.redact)(r.stderr.slice(0, 300)).text,
         };
     }
     await node_fs_1.promises.mkdir(node_path_1.default.join(dir, '.local'), { recursive: true });
@@ -175,7 +195,7 @@ function neuronOps(neuron, id) {
     const at = (0, fs_js_1.now)();
     const ops = [
         { v: ops_js_1.OPS_VERSION, op: 'neuron', nid: neuron.id, by: id.author, at,
-            name: neuron.name, ntype: neuron.type, domain: neuron.domain },
+            name: (0, secrets_js_1.redact)(neuron.name || '').text, ntype: neuron.type, domain: neuron.domain },
     ];
     for (const f of neuron.facts || []) {
         if (!f.text)
@@ -186,7 +206,7 @@ function neuronOps(neuron, id) {
             ...(f.reference ? { reference: f.reference } : {}),
             ...(f.temporal ? { temporal: f.temporal } : {}),
             ...(f.verification_invalidated_at ? { verification_invalidated_at: f.verification_invalidated_at } : {}),
-            ...(f.keys?.length ? { keys: f.keys } : {}),
+            ...(f.keys?.length ? { keys: f.keys.map(k => (0, secrets_js_1.redact)(k).text) } : {}),
             ...(f.shelf_life ? { shelf: f.shelf_life } : {}) });
         if (f.verified) {
             ops.push({ v: ops_js_1.OPS_VERSION, op: 'verify', nid: neuron.id, by: id.author, at: f.verified, eid: fid, ekind: 'fact',
@@ -194,14 +214,14 @@ function neuronOps(neuron, id) {
         }
         if (f.status === 'superseded' || f.status === 'retracted') {
             ops.push({ v: ops_js_1.OPS_VERSION, op: 'status', nid: neuron.id, by: id.author,
-                at: f.revised || at, fid, to: f.status, why: f.revision_note });
+                at: f.revised || at, fid, to: f.status, why: f.revision_note ? (0, secrets_js_1.redact)(f.revision_note).text : undefined });
         }
     }
     for (const d of neuron.decisions || []) {
         if (!d.text)
             continue;
         ops.push({ v: ops_js_1.OPS_VERSION, op: 'decision', nid: neuron.id, by: id.author,
-            at: d.date || at, did: (0, ops_js_1.entryId)(d.text), text: d.text, why: d.rationale });
+            at: d.date || at, did: (0, ops_js_1.entryId)(d.text), text: d.text, why: d.rationale ? (0, secrets_js_1.redact)(d.rationale).text : d.rationale });
     }
     // Dated entries carry their own date in `at`, so the team sees when a
     // pattern, error or debt was really recorded, not when it was shared.
@@ -273,7 +293,21 @@ async function prepareShare(brain, cortex, neuronRef, spaceName) {
     for (const [k, v] of Object.entries(neuron.entry_verification || {})) {
         revisarReferencia(`entry_verification[${k}].reference`, v.reference);
     }
-    (neuron.decisions || []).forEach((d, i) => revisar(`decisions[${i}]`, d.text));
+    (neuron.decisions || []).forEach((d, i) => {
+        revisar(`decisions[${i}]`, d.text);
+        revisar(`decisions[${i}].rationale`, d.rationale);
+    });
+    // Every other field that travels in an op, not only the entry texts (G8):
+    // a credential in a rationale, an alias or a revision note went out while
+    // the dry run reported nothing blocked.
+    (neuron.facts || []).forEach((f, i) => {
+        (f.keys || []).forEach((k, j) => revisar(`facts[${i}].keys[${j}]`, k));
+        if (f.revision_note)
+            revisar(`facts[${i}].revision_note`, f.revision_note);
+    });
+    revisar('name', neuron.name);
+    revisar('summary', neuron.summary);
+    (neuron.tags || []).forEach((t, i) => revisar(`tags[${i}]`, t));
     (neuron.patterns || []).forEach((p, i) => revisar(`patterns[${i}]`, p));
     (neuron.errors || []).forEach((e, i) => revisar(`errors[${i}]`, e));
     (neuron.debts || []).forEach((d, i) => revisar(`debts[${i}]`, d));
@@ -471,6 +505,7 @@ async function emitOps(brain, neuronId, make) {
     });
 }
 // ─── Sync ────────────────────────────────────────────────────────
+const MAX_LOG_BYTES = 32 * 1024 * 1024;
 async function readAllOps(dir, neuronId) {
     const opsDir = node_path_1.default.join(dir, 'neurons', neuronId, 'ops');
     let files;
@@ -485,7 +520,11 @@ async function readAllOps(dir, neuronId) {
         if (!f.endsWith('.jsonl'))
             continue;
         try {
-            const raw = await node_fs_1.promises.readFile(node_path_1.default.join(opsDir, f), 'utf-8');
+            const p = node_path_1.default.join(opsDir, f);
+            // A log that size is not notes; reading it whole would only cost memory.
+            if ((await node_fs_1.promises.stat(p)).size > MAX_LOG_BYTES)
+                continue;
+            const raw = await node_fs_1.promises.readFile(p, 'utf-8');
             all.push(...(0, ops_js_1.decodeOps)(raw).ops);
         }
         catch { /* unreadable log: skip it, keep the rest */ }
@@ -503,11 +542,16 @@ async function syncSpaceUnlocked(brain, cortex, spaceName, timeoutMs) {
     if (!cfg)
         return { ...base, state: 'not_joined', message: `You are not in a space called "${spaceName}".` };
     await withOutboxState(brain, () => drainOutboxUnlocked(brain, spaceName));
-    if (!(0, git_js_1.gitAvailable)())
+    if (!(await (0, git_js_1.gitAvailableAsync)()))
         return { ...base, state: 'no_git', message: 'git is not installed on this machine.' };
+    // space.json arrives from the remote: its branch is checked like any input.
+    const branch = cfg.branch || 'main';
+    if ((0, validate_js_1.branchProblem)(branch)) {
+        return { ...base, state: 'conflict', message: 'The space.json of this space names an invalid branch. Nothing was synced.' };
+    }
     const dir = spaceDir(brain, spaceName);
     const id = await getIdentity(brain);
-    const { pulled, pushed } = (0, git_js_1.syncSpace)(dir, id.author, cfg.branch || 'main', timeoutMs);
+    const { pulled, pushed } = await (0, git_js_1.syncSpaceAsync)(dir, id.author, branch, timeoutMs);
     if (!pulled.ok) {
         const state = (pulled.reason === 'offline' || pulled.reason === 'timeout') ? 'offline'
             : pulled.reason === 'auth' ? 'auth'
@@ -531,10 +575,30 @@ async function syncSpaceUnlocked(brain, cortex, spaceName, timeoutMs) {
     catch { /* nothing shared yet */ }
     // Neurons this machine stopped following: no merge, no markShared.
     const fuera = new Set(await unsharedList(brain));
+    const mapa = await sharedMap(brain);
+    const intactas = [];
+    let descartadas = 0;
     for (const nid of neuronIds) {
         if (fuera.has(nid))
             continue;
-        const ops = await readAllOps(dir, nid);
+        // A folder name is what becomes a file name in the cortex: only what
+        // CRBRO itself would have written.
+        if (!validate_js_1.NEURON_DIR_RE.test(nid))
+            continue;
+        const owner = mapa[nid];
+        // Followed in another space: that space's sync owns it.
+        if (owner && owner !== spaceName)
+            continue;
+        // A local neuron you never shared here stays yours. Until 2.10 a
+        // teammate could create neurons/<your id>/ and the next sync merged into
+        // it and marked it shared, so everything you learned there went out (G2).
+        if (!owner && await (0, fs_js_1.fileExists)(brain.paths.neuron(nid))) {
+            intactas.push(nid);
+            continue;
+        }
+        const leidas = await readAllOps(dir, nid);
+        const { ops, dropped } = (0, validate_js_1.sanitizeIncomingOps)(nid, leidas);
+        descartadas += dropped;
         if (ops.length === 0)
             continue;
         const { report, created } = await cortex.mergeFromSync(nid, ops);
@@ -547,8 +611,13 @@ async function syncSpaceUnlocked(brain, cortex, spaceName, timeoutMs) {
             base.neurons_touched.push(nid);
             base.merged.push(report);
         }
-        await markSharedUnlocked(brain, nid, spaceName);
+        if (!owner)
+            await markSharedUnlocked(brain, nid, spaceName);
     }
+    if (intactas.length)
+        base.left_alone = intactas;
+    if (descartadas)
+        base.ops_dropped = descartadas;
     const pending = await withOutboxState(brain, () => drainOutboxUnlocked(brain, spaceName));
     // Git solo envió lo que había antes: lo añadido después espera el próximo sync.
     base.pushed = !!pushed?.ok && pending === 0;
@@ -559,6 +628,12 @@ async function syncSpaceUnlocked(brain, cortex, spaceName, timeoutMs) {
     if (!base.pushed && pushed) {
         base.message += ' Your own notes could not be pushed this time; they will go with the next sync.';
     }
+    if (intactas.length) {
+        base.message += ` ${intactas.length} neuron(s) in the space have the id of a private neuron of yours and were left ` +
+            `alone (${intactas.slice(0, 5).join(', ')}${intactas.length > 5 ? ', …' : ''}). To merge one, crbro_share it into "${spaceName}".`;
+    }
+    if (descartadas)
+        base.message += ` ${descartadas} malformed incoming note(s) were ignored.`;
     return base;
 }
 /** Sync every space. Used at boot and at consolidation, with a short budget. */
@@ -593,7 +668,7 @@ function attachSync(brain, cortex) {
                         ...(change.reference ? { reference: change.reference } : {}),
                         ...(change.temporal ? { temporal: change.temporal } : {}),
                         ...(change.verification_invalidated_at ? { verification_invalidated_at: change.verification_invalidated_at } : {}),
-                        ...(change.keys?.length ? { keys: change.keys } : {}),
+                        ...(change.keys?.length ? { keys: change.keys.map(k => (0, secrets_js_1.redact)(k).text) } : {}),
                         ...(change.shelf ? { shelf: change.shelf } : {}) }];
             }
             if (change.kind === 'verify') {
@@ -601,11 +676,11 @@ function attachSync(brain, cortex) {
                         ...(change.verification ? { verification: change.verification } : {}) }];
             }
             if (change.kind === 'status') {
-                return [{ ...comun, op: 'status', fid: change.fid, to: change.to, why: change.why }];
+                return [{ ...comun, op: 'status', fid: change.fid, to: change.to, why: change.why ? (0, secrets_js_1.redact)(change.why).text : change.why }];
             }
             if (change.kind === 'decision') {
                 return [{ ...comun, op: 'decision', did: (0, ops_js_1.entryId)(change.text),
-                        text: change.text, why: change.why }];
+                        text: change.text, why: change.why ? (0, secrets_js_1.redact)(change.why).text : change.why }];
             }
             if (change.kind === 'error') {
                 return [{ ...comun, op: 'error', text: change.text }];