engineering-memory 1.11.0 → 1.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-memory",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "Installs the Engineering Memory skill and its local MCP bridge. Sign in after installing; your organization and project are resolved from your account.",
   "license": "UNLICENSED",
   "type": "module",

package/runtime/dist/src/runtime/bridge-service.js

@@ -1019,16 +1019,26 @@ export class BridgeService {
             if (!run || typeof run.id !== 'string')
                 throw refuse('The inspection response has no run identity.', 'memory.sync_status');
             if (run.state === 'inventory' || run.state === 'planning') {
-                for (let offset = 0; offset < snapshot.files.length; offset += 1000) {
-                    const page = cleanJson({
+                for (let offset = 0; offset < snapshot.files.length;) {
+                    const page = {
                         projectId: input.projectId,
                         runId: run.id,
-                        files: snapshot.files.slice(offset, offset + 1000),
-                    });
-                    assertSafeToPersist(page);
+                        files: [],
+                    };
+                    let bytes = Buffer.byteLength(JSON.stringify(page));
+                    while (offset < snapshot.files.length && page.files.length < 1000) {
+                        const file = snapshot.files[offset];
+                        const addedBytes = Buffer.byteLength(JSON.stringify(file)) + (page.files.length ? 1 : 0);
+                        if (page.files.length && bytes + addedBytes > 64 * 1024)
+                            break;
+                        page.files.push(file);
+                        bytes += addedBytes;
+                        offset += 1;
+                    }
+                    assertSafeToPersist(cleanJson(page));
                     await this.dependencies.client.request('/memory/sync/inventory', {
                         method: 'POST',
-                        body: page,
+                        body: cleanJson(page),
                     });
                 }
                 await this.dependencies.client.request('/memory/sync/inventory', {

package/runtime/dist/src/runtime/offline-outbox.js

@@ -6,6 +6,22 @@ import { sha256, stableStringify } from '../utilities/hash.js';
 const sensitiveKeyPattern = /(authorization|password|passcode|secret|token|cookie|email|phone|mobile|customer|account|user.?id|user.?name)/i;
 const emailPattern = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i;
 const phonePattern = /\+\d[\d ()-]{7,}\d/;
+const repositoryPathFields = new Set([
+    'path',
+    'paths',
+    'originalPath',
+    'changedPaths',
+    'pathPatterns',
+    'evidencePaths',
+]);
+const iosAssetScalePathPattern = /^(?:[\p{L}\p{N}_. -]+\/)*[\p{L}\p{N}_. -]+\.xcassets\/[\p{L}\p{N}_. -]+\.(?:appiconset|imageset)\/[\p{L}\p{N}_. -]+@[123]x\.(?:png|jpe?g)$/iu;
+function emailScanValue(value, key) {
+    if (!repositoryPathFields.has(key) ||
+        !iosAssetScalePathPattern.test(value) ||
+        value.split('/').some((part) => part === '.' || part === '..'))
+        return value;
+    return value.replace(/@[123]x(?=\.(?:png|jpe?g)$)/i, '');
+}
 const bearerPattern = /\bbearer\s+[a-z0-9._~-]+/i;
 const jwtPattern = /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/;
 const privateKeyPattern = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/;
@@ -155,7 +171,7 @@ export function assertSafeToPersist(value, key = '') {
         throw new Error(`Sensitive field cannot be persisted: ${key}`);
     }
     if (typeof value === 'string') {
-        if (emailPattern.test(value) ||
+        if (emailPattern.test(emailScanValue(value, key)) ||
             phonePattern.test(value) ||
             bearerPattern.test(value) ||
             jwtPattern.test(value) ||
@@ -199,13 +215,13 @@ export function redactForCache(value) {
         return null;
     }
 }
-function redactValue(value) {
+function redactValue(value, key = '') {
     if (typeof value === 'string') {
-        assertSafeToPersist(value);
+        assertSafeToPersist(value, key);
         return value;
     }
     if (Array.isArray(value)) {
-        return value.map((entry) => redactValue(entry));
+        return value.map((entry) => redactValue(entry, key));
     }
     if (value !== null && typeof value === 'object') {
         const result = {};
@@ -213,7 +229,7 @@ function redactValue(value) {
             if (sensitiveKeyPattern.test(key)) {
                 continue;
             }
-            result[key] = redactValue(entry);
+            result[key] = redactValue(entry, key);
         }
         return result;
     }