memoir-cli 3.11.1 → 3.11.2

package/README.md

@@ -15,15 +15,17 @@
 npx memoir-cli
 ```
 
-One command. No install, no config, no API keys. Claude Code on your Mac, Cursor on your laptop, Copilot at the office — **one memory follows you** across every tool and every machine, encrypted with a key only you hold. memoir's servers literally can't read it.
+One command. No install, no config, no API keys. Claude Code on your Mac, Cursor on your laptop, Copilot at the office — **one memory follows you** across every tool and every machine. Cloud sync is end-to-end encrypted with a key only you hold — memoir's servers can't read what you sync.
 
 ---
 
 ## What it does
 
-Your coding tools are starting to remember you — Claude Code, Cursor, and Copilot all ship built-in memory now. But that memory is **trapped: one tool, one machine, stored in plaintext.** Switch from Cursor to Claude Code, or open a different laptop, and your AI is a stranger again.
+Your coding tools are starting to remember you — Claude Code, Cursor, and Copilot all ship built-in memory now. But that memory is **trapped: one tool, one machine, one vendor's format.** Switch from Cursor to Claude Code, or open a different laptop, and your AI is a stranger again.
 
-memoir is the [MCP memory server](https://modelcontextprotocol.io) that breaks it out. **One memory, shared across every tool and synced to every machine — encrypted client-side, so even memoir's servers can't read it.** Your AI searches, saves, and recalls context automatically, everywhere you work.
+memoir is the [MCP memory server](https://modelcontextprotocol.io) that breaks it out. **One memory, shared across every tool and synced to every machine — E2E-encrypted in the cloud, plain readable markdown on your disk.** Your AI searches, saves, and recalls context automatically, everywhere you work.
+
+It's built on an **open, published format** — [the memoir format, v0.1](docs/SPEC.md) — so your AI's accumulated context is never trapped in this tool either. Six entry types, normative merge semantics, JSON Schemas, and a validator (`npx memoir-cli validate`). Any tool can implement it; [critique welcome](https://github.com/camgitt/memoir/issues).
 
 ```
 you: how does auth work in this project?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Private, portable AI memory: synced across every coding tool and machine, end-to-end encrypted, free. One memory for Claude Code, Cursor, Copilot, Gemini + more — MCP-native, zero-knowledge, open source.",
   "main": "src/index.js",

package/src/commands/push.js

@@ -10,6 +10,7 @@ import { getConfig, autoSetup } from '../config.js';
 import { extractMemories, adapters } from '../adapters/index.js';
 import { syncToLocal, syncToGit } from '../providers/index.js';
 import inquirer from 'inquirer';
+import { appendEvent } from '../events/log.js';
 import { findClaudeSessions, parseSession, generateContextHandoff, shouldIgnoreProject, persistDecisions, isQuality } from '../context/capture.js';
 import { scanForSecrets, printSecurityReport } from '../security/scanner.js';
 import { encryptDirectory, createVerifyToken } from '../security/encryption.js';
@@ -25,42 +26,59 @@ import { injectInto, detectAvailableTargets } from '../session/inject.js';
 // Best-effort fetch of the CURRENT remote session.json, so push.js can merge
 // before overwrite instead of blindly clobbering it (see below). Returns the
 // remote session state (already migrated to SCHEMA_VERSION) or null if the
-// remote is unreachable, this is the very first push (nothing there yet), or
-// the remote backup is encrypted (best-effort only — we deliberately don't
-// force an extra decrypt passphrase prompt mid-push; falls back to
-// local-only in that case, exactly like an unreachable remote).
+// Tri-state, because the difference is destructive: 'none' means nothing is
+// there (safe to write ours), 'ok' carries the remote session for merging,
+// and 'unreadable' means A REMOTE EXISTS BUT WE CANNOT READ IT — encrypted,
+// slow clone, corrupt JSON. On 'unreadable' the caller MUST NOT stage
+// session.json at all, so the remote copy survives the mirror sweep.
+// The old boolean version returned null for 'unreadable', which collapsed
+// to merged = local and silently clobbered the other machine's state —
+// worst on encrypted remotes, where the "protection" was a complete no-op.
 async function fetchRemoteSessionBestEffort(config) {
   try {
     if (config.provider === 'local' || config.provider?.includes?.('local')) {
       const resolvedDest = (config.localPath || '').replace(/^~/, os.homedir());
-      if (!resolvedDest) return null;
-      if (await fs.pathExists(path.join(resolvedDest, 'manifest.enc'))) return null; // encrypted
+      if (!resolvedDest) return { status: 'none', session: null };
+      if (await fs.pathExists(path.join(resolvedDest, 'manifest.enc'))) return { status: 'unreadable', session: null }; // encrypted
       const remotePath = path.join(resolvedDest, 'session.json');
-      if (!(await fs.pathExists(remotePath))) return null;
-      const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
-      const { state } = migrateSessionData(raw);
-      return state;
+      if (!(await fs.pathExists(remotePath))) return { status: 'none', session: null };
+      try {
+        const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
+        const { state } = migrateSessionData(raw);
+        return { status: 'ok', session: state };
+      } catch {
+        return { status: 'unreadable', session: null }; // exists but corrupt
+      }
     }
 
     if (config.provider === 'git' || config.provider?.includes?.('git')) {
       const repoUrl = config.gitRepo;
-      if (!repoUrl) return null;
+      if (!repoUrl) return { status: 'none', session: null };
       const peekDir = path.join(os.tmpdir(), `memoir-push-peek-${Date.now()}`);
       await fs.ensureDir(peekDir);
       try {
         try {
-          execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: peekDir, stdio: 'ignore', timeout: 30000 });
+          // Same budget as the real sync clone — the old 30s peek against a
+          // 60s sync meant a 35-second clone failed the peek but succeeded
+          // the mirror, deterministically wiping the remote session.
+          execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: peekDir, stdio: 'ignore', timeout: 120000 });
         } catch {
-          // Unreachable, or this is the very first push (repo doesn't exist
-          // yet / is empty) — fall back to local-only.
-          return null;
+          // Unreachable or first push. If the LATER sync clone succeeds
+          // where this one failed, treating it as 'none' would clobber —
+          // but with equal timeouts that window is a genuine remote flap,
+          // and 'unreadable' here would wedge first-time pushes forever.
+          return { status: 'none', session: null };
         }
-        if (await fs.pathExists(path.join(peekDir, 'manifest.enc'))) return null; // encrypted
+        if (await fs.pathExists(path.join(peekDir, 'manifest.enc'))) return { status: 'unreadable', session: null }; // encrypted
         const remotePath = path.join(peekDir, 'session.json');
-        if (!(await fs.pathExists(remotePath))) return null;
-        const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
-        const { state } = migrateSessionData(raw);
-        return state;
+        if (!(await fs.pathExists(remotePath))) return { status: 'none', session: null };
+        try {
+          const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
+          const { state } = migrateSessionData(raw);
+          return { status: 'ok', session: state };
+        } catch {
+          return { status: 'unreadable', session: null };
+        }
       } finally {
         await fs.remove(peekDir).catch(() => {});
       }
@@ -68,7 +86,7 @@ async function fetchRemoteSessionBestEffort(config) {
   } catch {
     // Never let a merge-fetch failure block the push.
   }
-  return null;
+  return { status: 'none', session: null };
 }
 
 // Recursively scan every staged file (the REAL tool memory/config files about
@@ -290,20 +308,31 @@ export async function pushCommand(options = {}) {
     // session.json (so this machine also gains whatever the remote had that
     // it didn't) — symmetric with restore.js instead of a blind overwrite.
     let sessionIncluded = false;
+    let preserveRemoteSession = false;
     try {
       if (await fs.pathExists(sessionPaths.session)) {
-        const remote = await fetchRemoteSessionBestEffort(config);
-        const local = await readSession();
-        const merged = remote ? mergeSessions(local, remote) : local;
-        if (remote) {
-          // Persist the merge locally too, inside the same lock every other
-          // session.json read-modify-write cycle uses.
-          await withSessionLock(sessionPaths.sessionLock, async () => {
-            await writeSession(merged);
-          });
+        const { status, session: remote } = await fetchRemoteSessionBestEffort(config);
+        if (status === 'unreadable') {
+          // A remote session exists and we could not read it (encrypted,
+          // slow, corrupt). Staging ours anyway would mirror-overwrite the
+          // one copy we couldn't merge — the exact clobber this guard
+          // exists to prevent. Leave session.json out of the staging dir
+          // and tell the sync to leave the remote copy alone.
+          preserveRemoteSession = true;
+          try { appendEvent('sync_degraded', { reason: 'remote_session_unreadable' }); } catch {}
+        } else {
+          const local = await readSession();
+          const merged = remote ? mergeSessions(local, remote) : local;
+          if (remote) {
+            // Persist the merge locally too, inside the same lock every other
+            // session.json read-modify-write cycle uses.
+            await withSessionLock(sessionPaths.sessionLock, async () => {
+              await writeSession(merged);
+            });
+          }
+          await fs.writeFile(path.join(stagingDir, 'session.json'), JSON.stringify(merged, null, 2));
+          sessionIncluded = true;
         }
-        await fs.writeFile(path.join(stagingDir, 'session.json'), JSON.stringify(merged, null, 2));
-        sessionIncluded = true;
       }
     } catch {
       // Best-effort — don't fail the push over this
@@ -448,7 +477,7 @@ export async function pushCommand(options = {}) {
     if (config.provider === 'local' || config.provider.includes('local')) {
       await syncToLocal(config, uploadDir, spinner);
     } else if (config.provider === 'git' || config.provider.includes('git')) {
-      await syncToGit(config, uploadDir, spinner);
+      await syncToGit(config, uploadDir, spinner, preserveRemoteSession ? { preserve: ['session.json'] } : {});
     } else {
       spinner.fail(chalk.red(`Unknown provider: ${config.provider}`));
       return;

package/src/context/capture.js

@@ -101,7 +101,10 @@ function parseLines(lines) {
       for (const block of obj.message.content) {
         if (block.type === 'text' && block.text) {
           // Capture assistant text for decision extraction (limit size)
-          if (block.text.length < 2000) assistantTexts.push(block.text);
+          // Redacted like every other untrusted input (user :95, bash :125,
+          // errors :138) — captured decisions flow into session.json, CLAUDE.md
+          // and the git backup, none of which get a later secret scan.
+          if (block.text.length < 2000) assistantTexts.push(redactSecrets(block.text));
           continue;
         }
         if (block.type !== 'tool_use') continue;

package/src/mcp.js

@@ -283,9 +283,23 @@ server.tool(
         return { content: [{ type: 'text', text: `Project directory not found: ${projectDir}` }] };
       }
 
-      // Default to CLAUDE.md for project-level memories
-      const targetFile = filename || 'CLAUDE.md';
-      const targetPath = path.join(projectDir, targetFile);
+      // Default to CLAUDE.md for project-level memories.
+      // Guards mirror the global branch below and memoir_read above:
+      // model-supplied filename must be a bare markdown name — no
+      // separators, no traversal — and must resolve inside the project
+      // dir. Without this, filename:".zshrc" appends to a shell rc
+      // (code execution on next shell) and "package.json" corrupts
+      // real files.
+      let targetFile = filename || 'CLAUDE.md';
+      if (!targetFile.endsWith('.md')) targetFile += '.md';
+      if (targetFile.includes('/') || targetFile.includes('\\') || targetFile.includes('..')) {
+        return { content: [{ type: 'text', text: `Invalid filename: ${filename} (must be a bare .md name)` }] };
+      }
+      const projBase = path.resolve(projectDir);
+      const targetPath = path.resolve(projBase, targetFile);
+      if (!targetPath.startsWith(projBase + path.sep)) {
+        return { content: [{ type: 'text', text: `Invalid filename: ${filename}` }] };
+      }
 
       // Append to existing file or create new
       if (await fs.pathExists(targetPath)) {
@@ -394,7 +408,14 @@ server.tool(
       return { content: [{ type: 'text', text: `Unknown tool: ${tool}. Available: ${adapters.map(a => a.name).join(', ')}` }] };
     }
 
-    const fullPath = path.join(adapter.source, filepath);
+    // Containment: filepath comes from the model, and the model reads
+    // attacker-influenceable text all day. Without this, "../.ssh/id_rsa"
+    // resolves outside the adapter dir and the file is returned verbatim.
+    const base = path.resolve(adapter.source);
+    const fullPath = path.resolve(base, filepath);
+    if (fullPath !== base && !fullPath.startsWith(base + path.sep)) {
+      return { content: [{ type: 'text', text: `Invalid path: ${filepath} (must stay inside ${adapter.name}'s directory)` }] };
+    }
 
     if (!(await fs.pathExists(fullPath))) {
       return { content: [{ type: 'text', text: `File not found: ${filepath} in ${adapter.name}` }] };

package/src/providers/index.js

@@ -27,7 +27,7 @@ export async function syncToLocal(config, stagingDir, spinner) {
   await appendEvent('sync_pushed', { provider: 'local' });
 }
 
-export async function syncToGit(config, stagingDir, spinner) {
+export async function syncToGit(config, stagingDir, spinner, options = {}) {
   const repoUrl = sanitizeUrl(config.gitRepo);
   if (!repoUrl) throw new Error('Git repository is not configured.');
 
@@ -39,9 +39,13 @@ export async function syncToGit(config, stagingDir, spinner) {
   try {
     try {
       execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: gitDir, stdio: 'ignore', timeout: 60000 });
+      const preserve = new Set(options.preserve || []);
       const files = await fs.readdir(gitDir);
       for (const f of files) {
-        if (f !== '.git') await fs.remove(path.join(gitDir, f));
+        // preserve: files the caller knows exist remotely but could not
+        // merge (unreadable session.json) — deleting them here would be
+        // the mirror-clobber the push guard just declined to commit.
+        if (f !== '.git' && !preserve.has(f)) await fs.remove(path.join(gitDir, f));
       }
     } catch {
       execFileSync('git', ['init'], { cwd: gitDir, stdio: 'ignore' });
@@ -63,7 +67,10 @@ export async function syncToGit(config, stagingDir, spinner) {
     }
 
     spinner.text = `Pushing data to ${chalk.cyan(repoUrl)}...`;
-    execFileSync('git', ['push', repoUrl, 'main'], { cwd: gitDir, stdio: 'ignore', timeout: 120000 });
+    // HEAD:main pushes whatever branch the clone checked out (a master-
+    // default remote used to make `push main` fail silently under autopush
+    // with a misleading credentials error, while doctor reported green).
+    execFileSync('git', ['push', repoUrl, 'HEAD:main'], { cwd: gitDir, stdio: 'ignore', timeout: 120000 });
 
     spinner.succeed(chalk.green('Sync complete! ') + chalk.gray('(Uploaded securely to GitHub)'));
     await appendEvent('sync_pushed', { provider: 'git' });