dsh-loci 2.10.0 → 2.11.0

package/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
 
+## [2.11.0] — 2026-11-15
+
+One fix, made because it is the last thing that could put another project's facts into a
+conversation.
+
+### Fixed
+
+- **A session with no `cwd` borrowed the Host process directory as its scope.**
+  `resolveScopes` fell back to `process.cwd()` whenever the host did not supply
+  `session.header.cwd`. Every such session and every panel request therefore shared one
+  workspace key — the directory the Host process was started in, which for a packaged
+  install is the install directory. Two consequences: memories written there belonged to no
+  project, and any two cwd-less sessions could read each other's entries.
+
+  A missing cwd now yields an explicit `workspace:unresolved` / `project:unresolved`. It
+  collides with no real workspace, appears in no other session's read set, and the panel
+  labels it "unresolved workspace" — visible rather than quiet.
+
+  The trade is deliberate: a cwd-less session loses access to workspace memories instead of
+  being handed someone else's. That is the direction the I4′ invariant points.
+
+### Docs
+
+- `PRIOR-ART.md` I4′ and its expiry table said the process-cwd fallback was "a known risk,
+  not a guarantee". It is now a stated behaviour with a test, and the remaining half of that
+  risk (project-scope collapse past 12 ancestor directories, no `doctor` check on scope
+  identity) is named as still open.
+
+## [2.10.1] — 2026-11-15
+
+Three more ways a scope mistake could have answered with the wrong data. Found by checking
+the last unverified claims from the audit instead of trusting the previous pass.
+
+### Fixed
+
+- **`/api/loci/preview?cwd=…` returned 400.** The route read `resolved.readKeys` and
+  `resolved.label`, neither of which `resolveScopes` returns, so any caller that supplied a
+  `cwd` or `session` got `Cannot read properties of undefined (reading 'length')`. The panel
+  never sends those parameters, which is why it survived: a latent failure on the one
+  endpoint that answers "what does *this* conversation get". `/api/loci/knowledge` had the
+  same defect.
+
+- **An explicit empty scope set meant "the whole store".** `stats({ scopeKeys: [] })` and
+  `usageReport({ scopeKeys: [] })` dropped the filter, while `list([])` and
+  `countPending([])` returned nothing. That asymmetry turns a scope-resolution failure into
+  a confident answer about every project on the machine. Now: omitted means the whole
+  database (an admin question), `[]` means nothing.
+
+- **`update`, `pin`, `unpin`, `restore` and `merge` ignored the read set.** Only `loci_get`
+  and `loci_forget` were guarded in 2.10.0. `update` moved a foreign entry into the calling
+  session's scope, `pin` changed how it sorts in another project's index, and `restore`
+  could un-delete an entry a different project had removed.
+
+### Note
+
+`test/unit/scope-semantics.test.mjs` pins all three. The empty-versus-absent distinction is
+asserted in both directions, because the failure mode is a silent widening rather than a
+crash.
+
 ## [2.10.0] — 2026-11-15
 
 The last four findings from the audit. All four are the same shape: an operation that

package/docs/PRIOR-ART.md

@@ -18,7 +18,7 @@
 | **I1** | 注入闸门 | 只有 `status='verified'` 且未过期、未删除的条目进入提示词。`status` 由 store 重新派生，模型无法通过工具断言它。verified 来自**面板/CLI 的人工操作**，或**用户自己消息里逐字存在且与主张有实质关联的引文**（§2.1 的两问闸门）。 |
 | **I2′** | 前缀稳定 | **没有任何写入会重排或改写已有行**；重求值只发生在会话/日边界，绝不在步内。尾部（`as of` 日期、`+N more`、待审提示）允许随写入与 UTC 日期变化。 |
 | **I3** | 默认零网络 | 默认配置下不发任何请求。三条可选出网路径：更新检查、HTTP 向量通道、会话结束的抽取（经宿主 `ctx.llm`，非本进程直连）。前两条默认关闭，第三条默认 `off`。 |
-| **I4′** | 作用域显式 | **会话内的每一项读取都绑定显式键集**，不使用通配。面板/导出枚举全部键，那是**明确的行政通道**（管理员视图），不是会话读取。作用域键由宿主 `session.header.cwd` 派生；该字段缺失时回落进程 cwd —— 这是已知风险，不是保证。 |
+| **I4′** | 作用域显式 | **会话内的每一项读取都绑定显式键集**，不使用通配；包括两个按 id 寻址的工具（`loci_get`/`loci_forget`）和全部按 id 寻址的写操作。面板/导出枚举全部键，那是**明确的行政通道**（管理员视图），不是会话读取。作用域键由宿主 `session.header.cwd` 派生；**该字段缺失时返回显式的 `workspace:unresolved`，不再回落进程 cwd**。 |
 
 > **旧版 I2 / I4 为什么被替换**：I2 原文"无写入时字节级不变"在 UTC 零点自破（尾部日期），且在 TTL 到期时于会话中途静默改变内容；I4 原文"读永不越界"与 `allScopeKeys()` 的通配枚举矛盾。把它们改宽不是妥协，是把判据改到能被代码验证的精度。
 
@@ -31,7 +31,7 @@
 | I1 | 结构（数据层）/ 语义依赖 | 宿主持续发 `session/event` 让引文缓冲存在 | 缓冲缺失 → 闸门**更严**（fail-safe，全部变候选）；引文门槛或 `autoVerifyCaptured` 默认值改动 → 闸门**更松** | **不会**。所有单测都桩掉验证器，真实函数只在手动 e2e 里跑过 |
 | I2′ | 结构（排序）/ 经济性依赖 | provider 的 prefix cache 粒度 | provider 改为按段缓存或取消前缀缓存 → 经济理由消失（安全性理由仍在） | **不会**。仓库里没有任何 cache 命中量；`request_stat` 记的是字节数 |
 | I3 | 结构（无直连）/ 计数依赖 | 三个默认布尔值 + 枚举完整性 | 新增经宿主服务的出网（如 `ctx.llm` 的另一处调用）→ grep 门看不见 | **部分**。直接 `fetch` 会挂 CI，宿主中介出网不会 |
-| I4′ | 结构（查询）/ 派生依赖 | `session.header.cwd` 存在性 | 会话创建时不带 cwd → 所有此类会话共享宿主进程目录；深目录超过 12 层 → 项目作用域塌成工作区 | **不会**。doctor 不检查作用域身份，无相关测试 |
+| I4′ | 结构（查询）/ 派生依赖 | `session.header.cwd` 存在性 | 会话创建时不带 cwd → 2.11.0 起落到显式的 `workspace:unresolved`（不泄漏，但该会话看不到工作区记忆）；深目录超过 12 层 → 项目作用域塌成工作区 | **部分**。无 cwd 已由测试固定并与面板标签可见；12 层上限与作用域身份仍无 doctor 检查 |
 
 **这套机制本身是这次审计最有价值的产出**：判据要带失效条件，否则它只是当时当地的偏好，被后人当成真理。任何新增不变量必须同时写它的失效信号。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-loci",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "Layered long-term memory for DeepSeek Harness: the prompt sees only a stable index, full text is one lookup away. Bi-temporal facts, strict scope isolation, verified-only injection.",
   "type": "module",
   "license": "MIT",

package/src/host/api/routes.js

@@ -116,8 +116,15 @@ export function registerApiRoutes(ctx, deps) {
     const sessionId = url.searchParams.get('session') ?? undefined;
     const scoped = cwd !== undefined || sessionId !== undefined;
     const resolved = scoped ? resolveScopes({ cwd, sessionId }) : undefined;
-    const scopeKeys = scoped ? resolved.readKeys : store.allScopeKeys();
-    const scopeLabel = scoped ? resolved.label : `all ${scopeKeys.length} stored scope(s)`;
+    // `resolveScopes` returns `{session, workspace, project, global, labels, cwd,
+    // projectRoot}` — there is no `readKeys` and no `label`, so this route threw
+    // "Cannot read properties of undefined (reading 'length')" whenever a caller supplied
+    // `?cwd=`. The panel never does, which is why it survived: a latent 400 on the one
+    // endpoint that answers "what does this conversation get".
+    const scopeKeys = scoped ? readScopeKeys(resolved, { includeGlobal: config.includeGlobal !== false }) : store.allScopeKeys();
+    const scopeLabel = scoped
+      ? [resolved.labels.workspace, resolved.labels.project].filter((value, index, all) => all.indexOf(value) === index).join(' / ')
+      : `all ${scopeKeys.length} stored scope(s)`;
     return json({
       ...renderIndexBody({
         store,
@@ -153,7 +160,7 @@ export function registerApiRoutes(ctx, deps) {
     const scopeKeys =
       cwd === undefined && sessionId === undefined
         ? store.allScopeKeys()
-        : resolveScopes({ cwd, sessionId }).readKeys;
+        : readScopeKeys(resolveScopes({ cwd, sessionId }), { includeGlobal: config.includeGlobal !== false });
     return json(buildKnowledge(store, { limit, scopeKeys }));
   });
 

package/src/host/index.js

@@ -23,7 +23,7 @@ import { registerCommands } from './commands.js';
 import { runDoctor } from './doctor.js';
 
 /** Version stamped into the database and diagnostics. */
-export const VERSION = '2.10.0';
+export const VERSION = '2.11.0';
 
 /** Optional collaborators; without them the plugin still serves tools. */
 export const inject = ['systemPrompt', 'tools'];

package/src/host/scope.js

@@ -80,21 +80,31 @@ function pathKey(prefix, path) {
 
 /**
  * Build the scope identity of one session.
+ *
+ * When the host does not supply a cwd, the identity is **explicitly unresolved** rather
+ * than borrowed from `process.cwd()`. Borrowing it meant every cwd-less session and every
+ * panel request shared one scope keyed to wherever the Host process happened to be
+ * installed — a silent cross-project bucket, and the opposite of what the explicit-scope
+ * invariant promises. An unresolved key appears in no other session's read set, so the
+ * failure is visible (the panel labels it "unresolved workspace") instead of a quiet leak.
+ *
  * @param options - `sessionId`, `cwd`.
  * @returns `{session, workspace, project, global, labels, cwd, projectRoot}`.
  */
 export function resolveScopes({ sessionId, cwd }) {
-  const dir = typeof cwd === 'string' && cwd.length > 0 ? canonicalDir(cwd) : canonicalDir(process.cwd());
-  const projectRoot = findProjectRoot(dir);
+  const requested = typeof cwd === 'string' && cwd.length > 0 ? cwd : undefined;
+  const dir = requested === undefined ? undefined : canonicalDir(requested);
+  const projectRoot = dir === undefined ? undefined : findProjectRoot(dir);
+  const unresolved = dir === undefined;
   return {
     session: `session:${sessionId ?? 'unknown'}`,
-    workspace: pathKey('workspace', dir),
-    project: pathKey('project', projectRoot),
+    workspace: unresolved ? 'workspace:unresolved' : pathKey('workspace', dir),
+    project: unresolved ? 'project:unresolved' : pathKey('project', projectRoot),
     global: 'global:',
     labels: {
       session: sessionId ? `session ${sessionId}` : 'session',
-      workspace: basename(dir) || dir,
-      project: basename(projectRoot) || projectRoot,
+      workspace: unresolved ? 'unresolved workspace' : basename(dir) || dir,
+      project: unresolved ? 'unresolved project' : basename(projectRoot) || projectRoot,
       global: 'global',
     },
     cwd: dir,

package/src/host/store/store.js

@@ -1048,8 +1048,29 @@ export class Store {
    */
   stats(options = {}) {
     const keys = options.scopeKeys ?? [];
-    const filtered = keys.length > 0;
-    const marks = filtered ? ` AND m.scope_key IN (${keys.map(() => '?').join(', ')})` : '';
+    // undefined means nobody asked for a scope (an admin whole-store view); [] means
+    // someone asked for a scope and got no keys — which must answer *nothing*, not
+    // *everything*. It used to drop the filter in both cases, so a scope-resolution
+    // failure turned into a confident answer about every project on the machine.
+    if (Array.isArray(options.scopeKeys) && options.scopeKeys.length === 0) {
+      return {
+        schemaVersion: this.schemaVersion(),
+        indexRev: this.indexRev(),
+        revisions: 0,
+        heads: 0,
+        byStatus: {},
+        byKind: {},
+        byScope: {},
+        hostVersion: this.hostVersion ?? readMeta(this.db, META_KEYS.hostVersion) ?? null,
+        pendingCandidates: 0,
+        disputed: 0,
+        lastInjection: null,
+        dbBytes: existsSync(this.paths.db) ? statSync(this.paths.db).size : 0,
+        vector: { ...this.vector, ...this.embedding.health() },
+        memoryRoot: this.memoryRoot,
+      };
+    }
+    const marks = keys.length > 0 ? ` AND m.scope_key IN (${keys.map(() => '?').join(', ')})` : '';
     const byStatus = {};
     for (const row of this.db
       .prepare(
@@ -1200,6 +1221,9 @@ export class Store {
   usageReport(options = {}) {
     const keys = options.scopeKeys ?? [];
     const limit = Math.max(1, Math.min(200, options.limit ?? 20));
+    // Same rule as `stats`: an explicit empty list means no rows; an absent one means the
+    // whole store, which is what the panel's admin report asks for.
+    if (Array.isArray(options.scopeKeys) && options.scopeKeys.length === 0) return [];
     const marks = keys.length > 0 ? ` AND m.scope_key IN (${keys.map(() => '?').join(', ')})` : '';
     const rows = this.db
       .prepare(

package/src/host/tools/tools.js

@@ -209,11 +209,18 @@ export function createTools(deps) {
       const context = execContext(exec);
       const op = oneOf(args, 'op', ['create', 'update', 'merge', 'pin', 'unpin', 'restore'], 'create');
       const id = str(args, 'id', { fallback: undefined });
+      // Every id-addressed op has to respect the read set, not just the two literally named
+      // get/forget. `update` moved a foreign entry into this session's scope, `pin` changed
+      // how it sorts in another project's index, and `restore` could un-delete something a
+      // different project had removed.
+      const idScopeKeys = () => readScopeKeys(context.scopes, { includeGlobal: config('includeGlobal') });
+      if (id !== undefined && op !== 'create') assertInScope(store, id, idScopeKeys(), `loci_write ${op}`);
 
       if (op === 'merge') {
         if (id === undefined) throw new Error('id is required for merge (the entry to keep)');
         const sourceIds = Array.isArray(args?.sourceIds) ? args.sourceIds.filter((value) => typeof value === 'string') : [];
         if (sourceIds.length === 0) throw new Error('sourceIds is required for merge (at least one id to fold in)');
+        for (const sourceId of sourceIds) assertInScope(store, sourceId, idScopeKeys(), 'loci_write merge source');
         const result = store.merge({
           targetId: id,
           sourceIds,

package/src/mcp/store-facade.js

@@ -36,7 +36,7 @@ export function openFacadeStore(options = {}) {
     memoryRoot: root,
     paths,
     config,
-    pluginVersion: '2.10.0',
+    pluginVersion: '2.11.0',
     readOnly: options.readOnly === true,
   });
   return { store, paths };