dsh-loci 2.9.0 → 2.10.0

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0.
 
+## [2.10.0] — 2026-11-15
+
+The last four findings from the audit. All four are the same shape: an operation that
+trusted an input it should have checked.
+
+### Fixed
+
+- **`snapshot --label` could write outside the memory root.** The label came from the
+  command line and was joined straight into a path, so `--label ../../tmp/x` produced a
+  database outside `$DSH_HOME/memory/loci/`. `SECURITY.md` said `assertInside` guarded
+  every generated path; this one was not guarded. The label is now reduced to a filename
+  *and* the resolved path is asserted.
+
+- **`loci_get` and `loci_forget` ignored the scope set.** Every read in the product binds
+  an explicit scope-key set except these two, which took an id and used it — so an id
+  pasted from another project's chat returned that entry's body, or soft-deleted it. Both
+  now refuse an entry outside the session's read set. A miss and a foreign hit answer the
+  same way, so the refusal does not confirm what exists elsewhere.
+
+- **An MCP write with no scope pooled in `session:unknown`.** `readScopeKeys(scopes, {
+  scope: undefined })[0]` is the *session* key, and a facade has no session — so every MCP
+  server on the machine shared that one key while no Host session ever read it. Proposals
+  were invisible to the review tab. A scope-less write now lands in the workspace the
+  facade is serving.
+
+- **Capture turned ordinary sentences into verified rules.** Bare `别` matched inside
+  级别, 特别, 识别, 区别 and 分别, and `要不要…？` matched the 不要 rule. Measured before
+  the change: *"我特别想看 diff"*, *"两者区别不大，随便选"*, *"我们分别试了两种方案"*,
+  *"识别这类错误要靠日志"*, *"这个 bug 的级别是 P1，先处理它"* — five false positives, each
+  of which becomes a `verified` line in `Rules (must follow)` with the default
+  `autoVerifyCaptured`. An imperative must now open a clause, and a sentence ending in `？`
+  is never a statement.
+
+  Verified against 8 negatives (all rejected) and 10 positives (all captured with the right
+  kind: 以后都用…, 不要再改…, 别把密钥…, 禁止…, 必须先…, 我们的约定是…, 记住…, 发布流程是…, 以后一律…, 下次别…).
+
+### Docs
+
+- `DESIGN.md` said "every captured row is a `candidate`". That stopped being true when
+  `autoVerifyCaptured` shipped and the sentence survived several releases; it now states the
+  two doors into the prompt and what the flag controls.
+
 ## [2.9.0] — 2026-11-15
 
 R3 was the last rule the product stated and did not keep.

package/docs/DESIGN.md

@@ -294,8 +294,13 @@ guess.
 | plugin unload | flush summaries, close the database | one write set |
 | maintenance (6 h) | close stale working/candidate rows, repair a drifted FTS index, `PRAGMA optimize`, backfill embeddings | bounded, no model |
 
-Nothing here can grow the prompt: every captured row is a `candidate`, and candidates
-are not injected.
+Nothing here can grow the prompt **by itself**: candidates are not injected, and a captured
+statement only becomes injectable through one of two doors — a person approving it, or the
+quote gate, which requires the sentence to be present verbatim in the user's own messages
+*and* related to the claim. `autoVerifyCaptured` (default on) is what makes the second door
+apply to capture; turn it off and every captured row waits for a click. This paragraph used
+to say "every captured row is a `candidate`", which stopped being true when that default
+landed and was left standing for several releases.
 
 ---
 

package/docs/SECURITY.md

@@ -13,7 +13,7 @@ file sandbox, approval policy) are the Harness's and are assumed to work.
 | T2 | Stored text breaks prompt assembly | Every later request throws | `interpolate:false` plus `{{`/`}}` neutralization at render time; `loci doctor` runs a live probe that renders hostile text and fails if any of it survives |
 | T3 | A credential is written into memory | Secret in a plaintext database and in every future prompt | nine high-confidence patterns + entropy check; default `redact`, optional `reject` |
 | T4 | An external agent or page writes memory | Poisoned long-term memory | tools are model-facing only through the Host; the MCP facade is read-only by default and can only create candidates; imported entries are candidates |
-| T5 | Cross-project leakage | Project A's facts answer in project B | explicit scope-key sets on every read; `global` requires an explicit scope; tested |
+| T5 | Cross-project leakage | Project A's facts answer in project B | explicit scope-key sets on every read, **including the two id-addressed tools** — `loci_get` and `loci_forget` used to take an id and use it, so an id pasted from another project's chat worked; both now refuse an entry outside the session's read set (`test/unit/containment.test.mjs`). `global` is read by default (`includeGlobal`) but written only on request; the MCP facade's scope-less write lands in the workspace, never in the shared `session:unknown` |
 | T6 | The panel API is reachable from another origin | Local admin surface exposed to a web page | exact `connection.fetch` route (owner Peer, same-origin fence), JSON-only writes, 256 KB body cap, no CORS headers |
 | T7 | Data written outside the Harness home | Un-backed-up, un-scoped secrets | single root `$DSH_HOME/memory/loci/`, every path asserted with `assertInside` |
 | T8 | A write blocks the agent loop | Turn hangs | WAL + bounded busy timeout + six retries; transactions are single-digit milliseconds; capture is debounced and never awaited by the turn |
@@ -54,7 +54,10 @@ schema and re-derived by the store. The MCP facade cannot either.
 ## 4. Filesystem
 
 - One root: `$DSH_HOME/memory/loci/`. Resolved as config → `$DSH_HOME` → `~/.dsh`.
-- `assertInside` guards export, import and every generated path.
+- `assertInside` guards export, import, `snapshot` and every generated path. The snapshot
+  label comes from a command line and used to be joined straight into a path, so
+  `--label ../../tmp/x` wrote a database outside the memory root; the label is now reduced
+  to a filename **and** the resolved path is asserted (`test/unit/containment.test.mjs`).
 - File permissions are the OS default; Loci does not implement encryption. Treat the
   directory like any other plaintext store of notes (BitLocker/FileVault, user ACLs).
 - Uninstall leaves the data behind by design (see OPERATIONS §7).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-loci",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Layered long-term memory for DeepSeek Harness: the prompt sees only a stable index, full text is one lookup away. Bi-temporal facts, strict scope isolation, verified-only injection.",
   "type": "module",
   "license": "MIT",

package/src/host/capture/capture.js

@@ -23,20 +23,45 @@ const MESSAGE_COUNT_CAP = 40;
 /** Buffered bytes per session. */
 const BUFFER_BYTE_CAP = 24 * 1024;
 
-/** Sentence patterns that mark a durable statement, with the kind they imply. */
+/**
+ * Sentence patterns that mark a durable statement, with the kind they imply.
+ *
+ * These run on every user message by default, so a false positive does not stay a
+ * candidate — with `autoVerifyCaptured` on it becomes a `verified` rule in the
+ * `Rules (must follow)` block. Bare substring matching was therefore expensive: `别`
+ * matched inside 级别, 特别, 识别, 区别 and 分别, and five ordinary sentences were measured
+ * turning into rules ("我特别想看 diff", "两者区别不大，随便选"). An imperative is now
+ * required to open a clause, and `不要` cannot be the tail of `要不要`.
+ */
+const CLAUSE_START = String.raw`(?:^|[，,、。；;：:！？!?\s]|但是|然后|所以|而且|并且|另外)`;
 const DURABLE_PATTERNS = Object.freeze([
-  { re: /(?:以后|今后|下次)(?:都|一律|必须|要|不要|别)/, kind: 'rule' },
-  { re: /(?:不要|别|禁止|不得|不允许|不能再|不可以)/, kind: 'rule' },
+  // A forward-looking commitment. The time word is what makes it strong regardless of
+  // where the clause begins.
+  { re: /(?:以后|今后|下次)(?:都|一律|必须|要|不要|别再?|禁止)/, kind: 'rule' },
+  {
+    re: new RegExp(`${CLAUSE_START}(?:不要|别再?|禁止|不得|不允许|不可以)`, 'u'),
+    kind: 'rule',
+  },
   { re: /(?:必须先|一定要|务必|记得先|一定要先)/, kind: 'procedural' },
   { re: /(?:流程是|步骤是|做法是|顺序是)/, kind: 'procedural' },
   { re: /(?:记住|记一下|记下来|帮我记住)/, kind: 'semantic' },
   { re: /(?:我的|我们的)(?:偏好|习惯|约定|规则|要求|标准)/, kind: 'semantic' },
-  { re: /(?:约定|规则是|标准是|原则是)/, kind: 'semantic' },
+  // `约定` on its own reads as a reference ("按约定处理"), not an announcement, so it
+  // needs the copula the way the others already had it.
+  { re: /(?:约定是|规则是|标准是|原则是)/, kind: 'semantic' },
   { re: /\b(?:always|never|from now on|remember that|we agreed|our rule)\b/i, kind: 'rule' },
 ]);
 
 /** Sentence separators for the extractor. */
 const SENTENCE_SPLIT = /[。！？!?；;\n]+/;
+/**
+ * A sentence *plus* the punctuation that ended it.
+ *
+ * `split()` throws the terminator away, and whether a segment ended in `？` is the
+ * difference between a statement and a question — `要不要一起吃饭？` matched the 不要
+ * pattern and became a rule because that information was gone.
+ */
+const SENTENCE_WITH_END = /([^。！？!?；;\n]+)([。！？!?；;\n]*)/g;
 
 /**
  * Flatten message content into plain text.
@@ -483,8 +508,13 @@ export function extractDurableStatements(userMessages, maxChars = 200) {
   const out = [];
   const seen = new Set();
   for (const message of userMessages) {
-    for (const raw of String(message.text ?? '').split(SENTENCE_SPLIT)) {
-      const sentence = raw.replace(/\s+/g, ' ').trim();
+    // Keep the terminator: whether a segment ended in a question mark decides whether it
+    // can be a statement at all. `要不要一起吃饭？` used to match the 不要 pattern and
+    // become a rule; split() discards the separator, so the distinction was unavailable.
+    for (const match of String(message.text ?? '').matchAll(SENTENCE_WITH_END)) {
+      const terminator = match[2] ?? '';
+      if (terminator === '？' || terminator === '?') continue;
+      const sentence = String(match[1] ?? '').replace(/\s+/g, ' ').trim();
       if (sentence.length < 6 || sentence.length > maxChars) continue;
       const matched = DURABLE_PATTERNS.find((pattern) => pattern.re.test(sentence));
       if (matched === undefined) continue;

package/src/host/index.js

@@ -23,7 +23,7 @@ import { registerCommands } from './commands.js';
 import { runDoctor } from './doctor.js';
 
 /** Version stamped into the database and diagnostics. */
-export const VERSION = '2.9.0';
+export const VERSION = '2.10.0';
 
 /** Optional collaborators; without them the plugin still serves tools. */
 export const inject = ['systemPrompt', 'tools'];

package/src/host/store/store.js

@@ -23,6 +23,7 @@ import { EmbeddingChannel, vectorToBlob } from './embedding.js';
 import { META_KEYS, SCHEMA_VERSION, databaseVersion, readMeta, writeMeta } from './schema.js';
 import { normalizeText, tokenStream, tokenize, buildQueryPlan } from './tokenize.js';
 import { cleanText, normalizeTitle, prepareForStorage } from '../inject/sanitize.js';
+import { assertInside } from '../paths.js';
 
 /**
  * Relations a caller may declare between two facts.
@@ -1423,7 +1424,14 @@ export class Store {
    */
   snapshot(label = 'manual') {
     this.#assertWritable();
-    return backupTo(this.db, join(this.paths.backups, `${label}-${this.now()}.db`));
+    // The label comes from a command line and was joined straight into a path, so
+    // `--label ../../tmp/x` wrote a database outside the memory root. SECURITY §4 said
+    // `assertInside` guarded every generated path; this one was not guarded. Sanitise the
+    // label to a filename, then assert the resolved path anyway — belt and braces, because
+    // the assertion is the part that would survive a future change to the sanitiser.
+    const safeLabel = String(label).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 64) || 'manual';
+    const target = join(this.paths.backups, `${safeLabel}-${this.now()}.db`);
+    return backupTo(this.db, assertInside(this.paths.backups, target));
   }
 
   /** Health checks used by `doctor`. */

package/src/host/tools/tools.js

@@ -82,6 +82,28 @@ function strList(args, key, options = {}) {
  * @param exec - tool execution context.
  * @returns `{sessionId, scopes, header}`.
  */
+/**
+ * Refuse an id-addressed operation that points outside this session's scopes.
+ *
+ * Reads were scoped everywhere except here: `loci_get` and `loci_forget` took an id and
+ * used it, so a model that had seen an id from another project could read its body or
+ * soft-delete it. SECURITY T5 says every read binds an explicit scope-key set; by id it
+ * did not. The check runs after the lookup, so a miss and a foreign hit answer the same
+ * way — the caller learns nothing about what exists elsewhere.
+ *
+ * @param store - open store.
+ * @param id - the id the caller supplied.
+ * @param scopeKeys - this session's explicit read set.
+ * @param operation - name used in the error message.
+ * @throws when the entry exists but is outside the scope set.
+ */
+function assertInScope(store, id, scopeKeys, operation) {
+  const found = store.get(id);
+  if (found?.entry === undefined) return;
+  if (scopeKeys.includes(found.entry.scopeKey)) return;
+  throw new Error(`${operation}: ${id} is not in this session's scope`);
+}
+
 function execContext(exec) {
   const session = exec?.agent?.session;
   const sessionId = session?.id;
@@ -366,10 +388,12 @@ export function createTools(deps) {
     },
     timeoutMs: 10_000,
     isConcurrencySafe: () => true,
-    execute: async (args) => {
+    execute: async (args, exec) => {
       const id = str(args, 'id', { required: true, maxChars: 64 });
       const revision = int(args, 'revision', { min: 1 });
       const includeHistory = bool(args, 'includeHistory', true);
+      const context = execContext(exec);
+      assertInScope(store, id, readScopeKeys(context.scopes, { includeGlobal: config('includeGlobal') }), 'loci_get');
       const result = store.get(id, { revision, includeHistory });
       // A read counter is what separates "the index line was enough" from "the model
       // had to open it". It must never fail the read itself.
@@ -406,10 +430,14 @@ export function createTools(deps) {
     },
     timeoutMs: 10_000,
     isConcurrencySafe: () => false,
-    execute: async (args) => {
+    execute: async (args, exec) => {
       const id = str(args, 'id', { required: true, maxChars: 64 });
       const mode = oneOf(args, 'mode', ['soft', 'restore'], 'soft');
       const reason = str(args, 'reason', { fallback: undefined, maxChars: 200 });
+      const context = execContext(exec);
+      // Without this, a model that had seen an id from another project could soft-delete
+      // it. Deletion is the one operation where an unscoped id is worse than a bad read.
+      assertInScope(store, id, readScopeKeys(context.scopes, { includeGlobal: config('includeGlobal') }), 'loci_forget');
       return store.forget(id, { mode, reason, actor: 'model' });
     },
   };

package/src/mcp/server.js

@@ -162,11 +162,17 @@ async function callTool(name, args) {
     }
     case 'loci_write': {
       if (!allowWrite) throw new Error('this server is read-only; start it with --allow-write to propose memories');
-      const scopeKeys = readScopeKeys(scopes, { scope: requestedScope(args) });
-      const scopeKey = scopeKeys[0] ?? scopes.workspace;
+      // Never fall back to `scopeKeys[0]`. With no scope requested that is
+      // `session:unknown` — a key every MCP server on the machine shares and no Host
+      // session ever reads, so proposals pooled in a scope the user could not see in the
+      // panel's review tab. A facade has no session, so the honest default is the
+      // workspace it is serving.
+      const requested = requestedScope(args);
+      const writeScope = requested === undefined || requested === 'session' ? 'workspace' : requested;
+      const scopeKey = readScopeKeys(scopes, { scope: writeScope, includeGlobal: false })[0] ?? scopes.workspace;
       const result = store.write({
         kind: ['semantic', 'procedural', 'rule', 'episodic'].includes(args?.kind) ? args.kind : 'semantic',
-        scope: ['workspace', 'project', 'global'].includes(args?.scope) ? args.scope : 'workspace',
+        scope: writeScope,
         scopeKey,
         scopeLabel: 'mcp',
         title: String(args?.title ?? ''),

package/src/mcp/store-facade.js

@@ -36,7 +36,7 @@ export function openFacadeStore(options = {}) {
     memoryRoot: root,
     paths,
     config,
-    pluginVersion: '2.9.0',
+    pluginVersion: '2.10.0',
     readOnly: options.readOnly === true,
   });
   return { store, paths };