memorix 1.4.3 → 1.4.4

package/src/memory/refs.ts

@@ -1,94 +1,94 @@
-/**
- * Typed Memory Reference Protocol (Phase 3a)
- *
- * Provides a formal, unambiguous way to reference memory objects
- * (observations and mini-skills) across internal code and the MCP API.
- *
- * String format:
- *   obs:42          — observation #42
- *   skill:3         — mini-skill #3
- *   obs:42@org/proj — observation #42 in project org/proj
- *
- * Legacy support:
- *   42   (bare number)  → obs:42
- *   "42" (bare string)  → obs:42
- *
- * Display short forms (presentation only):
- *   #42  — observation
- *   S3   — mini-skill
- */
-
-import type { MemoryRef } from '../types.js';
-
-// ── Parsing ──────────────────────────────────────────────────────
-
-const TYPED_REF_RE = /^(obs|skill):(\d+)(?:@(.+))?$/;
-
-/**
- * Parse a typed memory reference from a string or number.
- *
- * Accepts:
- *   - "obs:42", "skill:3", "obs:42@org/proj"
- *   - 42 (bare number → obs:42)
- *   - "42" (bare numeric string → obs:42)
- *
- * Throws on invalid input.
- */
-export function parseMemoryRef(input: string | number): MemoryRef {
-  // Bare number → legacy observation ref
-  if (typeof input === 'number') {
-    if (!Number.isInteger(input) || input < 0) {
-      throw new Error(`Invalid memory ref: ${input} (must be a non-negative integer)`);
-    }
-    return { kind: 'obs', id: input };
-  }
-
-  const trimmed = input.trim();
-
-  // Bare numeric string → legacy observation ref
-  if (/^\d+$/.test(trimmed)) {
-    return { kind: 'obs', id: parseInt(trimmed, 10) };
-  }
-
-  // Typed ref: obs:42 or skill:3 or obs:42@org/proj
-  const match = trimmed.match(TYPED_REF_RE);
-  if (!match) {
-    throw new Error(
-      `Invalid memory ref: "${input}". Expected format: obs:<id>, skill:<id>, obs:<id>@<projectId>, or a bare number.`,
-    );
-  }
-
-  const kind = match[1] as 'obs' | 'skill';
-  const id = parseInt(match[2], 10);
-  const projectId = match[3] || undefined;
-
-  return { kind, id, projectId };
-}
-
-// ── Serialization ────────────────────────────────────────────────
-
-/**
- * Serialize a MemoryRef to its canonical string form.
- *
- * Examples:
- *   { kind: 'obs', id: 42 }                    → "obs:42"
- *   { kind: 'skill', id: 3 }                   → "skill:3"
- *   { kind: 'obs', id: 42, projectId: 'o/p' }  → "obs:42@o/p"
- */
-export function serializeMemoryRef(ref: MemoryRef): string {
-  const base = `${ref.kind}:${ref.id}`;
-  return ref.projectId ? `${base}@${ref.projectId}` : base;
-}
-
-// ── Display ──────────────────────────────────────────────────────
-
-/**
- * Format a MemoryRef for human-readable display.
- *
- * Short forms:
- *   obs:42  → "#42"
- *   skill:3 → "S3"
- */
-export function displayRef(ref: MemoryRef): string {
-  return ref.kind === 'obs' ? `#${ref.id}` : `S${ref.id}`;
-}
+/**
+ * Typed Memory Reference Protocol (Phase 3a)
+ *
+ * Provides a formal, unambiguous way to reference memory objects
+ * (observations and mini-skills) across internal code and the MCP API.
+ *
+ * String format:
+ *   obs:42          — observation #42
+ *   skill:3         — mini-skill #3
+ *   obs:42@org/proj — observation #42 in project org/proj
+ *
+ * Legacy support:
+ *   42   (bare number)  → obs:42
+ *   "42" (bare string)  → obs:42
+ *
+ * Display short forms (presentation only):
+ *   #42  — observation
+ *   S3   — mini-skill
+ */
+
+import type { MemoryRef } from '../types.js';
+
+// ── Parsing ──────────────────────────────────────────────────────
+
+const TYPED_REF_RE = /^(obs|skill):(\d+)(?:@(.+))?$/;
+
+/**
+ * Parse a typed memory reference from a string or number.
+ *
+ * Accepts:
+ *   - "obs:42", "skill:3", "obs:42@org/proj"
+ *   - 42 (bare number → obs:42)
+ *   - "42" (bare numeric string → obs:42)
+ *
+ * Throws on invalid input.
+ */
+export function parseMemoryRef(input: string | number): MemoryRef {
+  // Bare number → legacy observation ref
+  if (typeof input === 'number') {
+    if (!Number.isInteger(input) || input < 0) {
+      throw new Error(`Invalid memory ref: ${input} (must be a non-negative integer)`);
+    }
+    return { kind: 'obs', id: input };
+  }
+
+  const trimmed = input.trim();
+
+  // Bare numeric string → legacy observation ref
+  if (/^\d+$/.test(trimmed)) {
+    return { kind: 'obs', id: parseInt(trimmed, 10) };
+  }
+
+  // Typed ref: obs:42 or skill:3 or obs:42@org/proj
+  const match = trimmed.match(TYPED_REF_RE);
+  if (!match) {
+    throw new Error(
+      `Invalid memory ref: "${input}". Expected format: obs:<id>, skill:<id>, obs:<id>@<projectId>, or a bare number.`,
+    );
+  }
+
+  const kind = match[1] as 'obs' | 'skill';
+  const id = parseInt(match[2], 10);
+  const projectId = match[3] || undefined;
+
+  return { kind, id, projectId };
+}
+
+// ── Serialization ────────────────────────────────────────────────
+
+/**
+ * Serialize a MemoryRef to its canonical string form.
+ *
+ * Examples:
+ *   { kind: 'obs', id: 42 }                    → "obs:42"
+ *   { kind: 'skill', id: 3 }                   → "skill:3"
+ *   { kind: 'obs', id: 42, projectId: 'o/p' }  → "obs:42@o/p"
+ */
+export function serializeMemoryRef(ref: MemoryRef): string {
+  const base = `${ref.kind}:${ref.id}`;
+  return ref.projectId ? `${base}@${ref.projectId}` : base;
+}
+
+// ── Display ──────────────────────────────────────────────────────
+
+/**
+ * Format a MemoryRef for human-readable display.
+ *
+ * Short forms:
+ *   obs:42  → "#42"
+ *   skill:3 → "S3"
+ */
+export function displayRef(ref: MemoryRef): string {
+  return ref.kind === 'obs' ? `#${ref.id}` : `S${ref.id}`;
+}

package/src/memory/secret-filter.ts

@@ -1,79 +1,79 @@
-/**
- * Secret Filter
- *
- * Conservative credential detection and redaction for Memorix memory content.
- * Designed for low false-positive risk: only matches explicit credential
- * assignments (key=value / key: value), not generic discussion of auth concepts.
- *
- *   sanitizeCredentials()  — store-time: called inside storeObservation() before write
- *   redactCredentials()    — retrieval-time: called in format/output paths for legacy safety
- *   containsCredential()   — predicate used for testing and optional logging
- *
- * Both sanitize and redact share the same pattern logic. They are kept as
- * separate named exports so call-site semantics remain clear.
- */
-
-/**
- * Replaces the VALUE portion of matched credential patterns with [REDACTED].
- * The credential key name is preserved so context is not lost.
- *
- * Pattern categories:
- *   1. key=value / key: value forms — password, token, api_key, secret, etc.
- *      Requires a real value (6+ non-whitespace chars) to avoid matching
- *      discussion text like "password must be 8 chars".
- *   2. Bearer authorization header tokens (20+ chars)
- *   3. Structured token prefixes: GitHub (ghp_/ghs_/gho_), OpenAI (sk-), JWT (eyJ)
- */
-function applyRedaction(text: string): string {
-  if (!text) return text;
-  let out = text;
-
-  // key=value / key: "value" / key='value' — preserve key, redact value
-  out = out.replace(
-    /((?:password|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret)\s*[:=]\s*["']?)([^\s"',;\n]{6,})/gi,
-    '$1[REDACTED]',
-  );
-
-  // Bearer <token> — preserve "Bearer ", redact token
-  out = out.replace(
-    /(Bearer\s+)([A-Za-z0-9._\-/+]{20,})/g,
-    '$1[REDACTED]',
-  );
-
-  // GitHub tokens (ghp_, ghs_, gho_, github_pat_)
-  out = out.replace(/\b(?:ghp|ghs|gho|github_pat)_[A-Za-z0-9]{36,}\b/g, '[REDACTED]');
-
-  // OpenAI / similar keys (sk-...)
-  out = out.replace(/\bsk-[A-Za-z0-9T-]{20,}\b/g, '[REDACTED]');
-
-  // JWT tokens (base64url header eyJ...)
-  out = out.replace(/\beyJ[A-Za-z0-9._-]{40,}\b/g, '[REDACTED]');
-
-  return out;
-}
-
-/**
- * Store-time sanitization: strips credential values before any durable write.
- * Called inside storeObservation() / upsertObservation() so that every write
- * path (hooks, git-ingest, CLI, reasoning, compact-on-write) is covered.
- */
-export function sanitizeCredentials(text: string): string {
-  return applyRedaction(text);
-}
-
-/**
- * Retrieval-time redaction: masks credential values in display output.
- * Applied in all output formatters (detail, index table, timeline, session context)
- * as a safety net for legacy observations stored before sanitization was in place.
- */
-export function redactCredentials(text: string): string {
-  return applyRedaction(text);
-}
-
-/**
- * Returns true if the text contains an obvious credential pattern.
- * Used for testing and optional diagnostic logging.
- */
-export function containsCredential(text: string): boolean {
-  return applyRedaction(text) !== text;
-}
+/**
+ * Secret Filter
+ *
+ * Conservative credential detection and redaction for Memorix memory content.
+ * Designed for low false-positive risk: only matches explicit credential
+ * assignments (key=value / key: value), not generic discussion of auth concepts.
+ *
+ *   sanitizeCredentials()  — store-time: called inside storeObservation() before write
+ *   redactCredentials()    — retrieval-time: called in format/output paths for legacy safety
+ *   containsCredential()   — predicate used for testing and optional logging
+ *
+ * Both sanitize and redact share the same pattern logic. They are kept as
+ * separate named exports so call-site semantics remain clear.
+ */
+
+/**
+ * Replaces the VALUE portion of matched credential patterns with [REDACTED].
+ * The credential key name is preserved so context is not lost.
+ *
+ * Pattern categories:
+ *   1. key=value / key: value forms — password, token, api_key, secret, etc.
+ *      Requires a real value (6+ non-whitespace chars) to avoid matching
+ *      discussion text like "password must be 8 chars".
+ *   2. Bearer authorization header tokens (20+ chars)
+ *   3. Structured token prefixes: GitHub (ghp_/ghs_/gho_), OpenAI (sk-), JWT (eyJ)
+ */
+function applyRedaction(text: string): string {
+  if (!text) return text;
+  let out = text;
+
+  // key=value / key: "value" / key='value' — preserve key, redact value
+  out = out.replace(
+    /((?:password|passwd|pwd|secret|token|api[_-]?key|auth[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret)\s*[:=]\s*["']?)([^\s"',;\n]{6,})/gi,
+    '$1[REDACTED]',
+  );
+
+  // Bearer <token> — preserve "Bearer ", redact token
+  out = out.replace(
+    /(Bearer\s+)([A-Za-z0-9._\-/+]{20,})/g,
+    '$1[REDACTED]',
+  );
+
+  // GitHub tokens (ghp_, ghs_, gho_, github_pat_)
+  out = out.replace(/\b(?:ghp|ghs|gho|github_pat)_[A-Za-z0-9]{36,}\b/g, '[REDACTED]');
+
+  // OpenAI / similar keys (sk-...)
+  out = out.replace(/\bsk-[A-Za-z0-9T-]{20,}\b/g, '[REDACTED]');
+
+  // JWT tokens (base64url header eyJ...)
+  out = out.replace(/\beyJ[A-Za-z0-9._-]{40,}\b/g, '[REDACTED]');
+
+  return out;
+}
+
+/**
+ * Store-time sanitization: strips credential values before any durable write.
+ * Called inside storeObservation() / upsertObservation() so that every write
+ * path (hooks, git-ingest, CLI, reasoning, compact-on-write) is covered.
+ */
+export function sanitizeCredentials(text: string): string {
+  return applyRedaction(text);
+}
+
+/**
+ * Retrieval-time redaction: masks credential values in display output.
+ * Applied in all output formatters (detail, index table, timeline, session context)
+ * as a safety net for legacy observations stored before sanitization was in place.
+ */
+export function redactCredentials(text: string): string {
+  return applyRedaction(text);
+}
+
+/**
+ * Returns true if the text contains an obvious credential pattern.
+ * Used for testing and optional diagnostic logging.
+ */
+export function containsCredential(text: string): boolean {
+  return applyRedaction(text) !== text;
+}